codex keeps trying to run powershell command that bitdefender blocks

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.616.30709 • Released Jun 18, 2026

What subscription do you have?

Pro

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

codex keeps trying to run this command, which bitdefender blocks, and no, i won't allow it because bitdefender can still protect me from dumb stuff ai can do sometimes

1.0\powershell.exe was passed a malicious command line and has been blocked. Your device is now safe.

Command line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand CgAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACIAUwB0AG8AcAAiAAoAJABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAiAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIgAKAAoAJABjAG8AZABlACAAPQAgAEAAIgAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAFMAZQByAHYAaQBjAGUAcwA7AAoACgBbAFMAdAByAHUAYwB0AEwAYQB5AG8AdQB0ACgATABhAHkAbwB1AHQASwBpAG4AZAAuAFMAZQBxAHUAZQBuAHQAaQBhAGwAKQBdAAoAcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAFMASQBaAEUAIAB7AAoAIAAgAHAAdQBiAGwAaQBjACAAaQBuAHQAIABjAHgAOwAKACAAIABwAHUAYgBsAGkAYwAgAGkAbgB0ACAAYwB5ADsACgAgACAAcAB1AGIAbABpAGMAIABTAEkAWgBFACgAaQBuAHQAIAB4ACwAIABpAG4AdAAgAHkAKQAgAHsAIABjAHgAIAA9ACAAeAA7ACAAYwB5ACAAPQAgAHkAOwAgAH0ACgB9AAoACgBbAFMAdAByAHUAYwB0AEwAYQB5AG8AdQB0ACgATABhAHkAbwB1AHQASwBpAG4AZAAuAFMAZQBxAHUAZQBuAHQAaQBhAGwAKQBdAAoAcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAEIASQBUAE0AQQBQAEkATgBGAE8ASABFAEEARABFAFIAIAB7AAoAIAAgAHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAGIAaQBTAGkAegBlADsACgAgACAAcAB1AGIAbABpAGMAIABpAG4AdAAgAGIAaQBXAGkAZAB0AGgAOwAKACAAIABwAHUAYgBsAGkAYwAgAGkAbgB0ACAAYgBpAEgAZQBpAGcAaAB0ADsACgAgACAAcAB1AGIAbABpAGMAIAB1AHMAaABvAHIAdAAgAGIAaQBQAGwAYQBuAGUAcwA7AAoAIAAgAHAAdQBiAGwAaQBjACAAdQBzAGgAbwByAHQAIABiAGkAQgBpAHQAQwBvAHUAbgB0ADsACgAgACAAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAYgBpAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgA7AAoAIAAgAHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAGIAaQBTAGkAegBlAEkAbQBhAGcAZQA7AAoAIAAgAHAAdQBiAGwAaQBjACAAaQBuAHQAIABiAGkAWABQAGUAbABzAFAAZQByAE0AZQB0AGUAcgA7AAoAIAAgAHAAdQBiAGwAaQBjACAAaQBuAHQAIABiAGkAWQBQAGUAbABzAFAAZQByAE0AZQB0AGUAcgA7AAoAIAAgAHAAdQBiAGwAaQBjACAAdQBpAG4AdAAgAGIAaQBDAGwAcgBVAHMAZQBkADsACgAgACAAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAYgBpAEMAbAByAEkAbQBwAG8AcgB0AGEAbgB0ADsACgB9AAoACgBbAFMAdAByAHUAYwB0AEwAYQB5AG8AdQB0ACgATABhAHkAbwB1AHQASwBpAG4AZAAuAFMAZQBxAHUAZQBuAHQAaQBhAGwAKQBdAAoAcAB1AGIAbABpAGMAIABzAHQAcgB1AGMAdAAgAEIASQBUAE0AQQBQAEkATgBGAE8AIAB7AAoAIAAgAHAAdQBiAGwAaQBjACAAQgBJAFQATQBBAFAASQBOAEYATwBIAEUAQQBEAEUAUgAgAGIAbQBpAEgAZQBhAGQAZQByADsACgAgACAAcAB1AGIAbABpAGMAIAB1AGkAbgB0ACAAYgBtAGkAQwBvAGwAbwByAHMAOwAKAH0ACgAKAFsAQwBvAG0ASQBtAHAAbwByAHQAXQAKAFsASQBuAHQAZQByAGYAYQBjAGUAVAB5AHAAZQAoAEMAbwBtAEkAbgB0AGUAcgBmAGEAYwBlAFQAeQBwAGUALgBJAG4AdABlAHIAZgBhAGMAZQBJAHMASQBVAG4AawBuAG8AdwBuACkAXQAKAFsARwB1AGkAZAAoACIAYgBjAGMAMQA4AGIANwA5AC0AYgBhADEANgAtADQANAAyAGYALQA4ADAAYwA0AC0AOABhADUAOQBjADMAMABjADQANgAzAGIAIgApAF0ACgBwAHUAYgBsAGkAYwAgAGkAbgB0AGUAcgBmAGEAYwBlACAASQBTAGgAZQBsAGwASQB0AGUAbQBJAG0AYQBnAGUARgBhAGMAdABvAHIAeQAgAHsACgAgACAAdgBvAGkAZAAgAEcAZQB0AEkAbQBhAGcAZQAoAFMASQBaAEUAIABzAGkAegBlACwAIABpAG4AdAAgAGYAbABhAGcAcwAsACAAbwB1AHQAIABJAG4AdABQAHQAcgAgAHAAaABiAG0AKQA7AAoAfQAKAAoAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGMAbABhAHMAcwAgAEMAbwBkAGUAeABTAGgAZQBsAGwASQBjAG8AbgBOAGEAdABpAHYAZQAgAHsACgAgACAAYwBvAG4AcwB0ACAAaQBuAHQAIABCAEkAXwBSAEcAQgAgAD0AIAAwADsACgAgACAAYwBvAG4AcwB0ACAAaQBuAHQAIABEAEkAQgBfAFIARwBCAF8AQwBPAEwATwBSAFMAIAA9ACAAMAA7AAoAIAAgAGMAbwBuAHMAdAAgAGkAbgB0ACAASQBDAE8ATgBfAE8ATgBMAFkAIAA9ACAANAA7AAoACgAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAcwBoAGUAbABsADMAMgAuAGQAbABsACIALAAgAEMAaABhAHIAUwBlAHQAIAA9ACAAQwBoAGEAcgBTAGUAdAAuAFUAbgBpAGMAbwBkAGUALAAgAFAAcgBlAHMAZQByAHYAZQBTAGkAZwAgAD0AIABmAGEAbABzAGUAKQBdAAoAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAHYAbwBpAGQAIABTAEgAQwByAGUAYQB0AGUASQB0AGUAbQBGAHIAbwBtAFAAYQByAHMAaQBuAGcATgBhAG0AZQAoAAoAIAAgACAAIABzAHQAcgBpAG4AZwAgAHAAcwB6AFAAYQB0AGgALAAKACAAIAAgACAASQBuAHQAUAB0AHIAIABwAGIAYwAsAAoAIAAgACAAIAByAGUAZgAgAEcAdQBpAGQAIAByAGkAaQBkACwACgAgACAAIAAgAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ASQBuAHQAZQByAGYAYQBjAGUAKQBdACAAbwB1AHQAIABJAFMAaABlAGwAbABJAHQAZQBtAEkAbQBhAGcAZQBGAGEAYwB0AG8AcgB5ACAAcABwAHYACgAgACAAKQA7AAoACgAgACAAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAZwBkAGkAMwAyAC4AZABsAGwAIgApAF0ACgAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAYgBvAG8AbAAgAEQAZQBsAGUAdABlAE8AYgBqAGUAYwB0ACgASQBuAHQAUAB0AHIAIABoAE8AYgBqAGUAYwB0ACkAOwAKAAoAIAAgAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGcAZABpADMAMgAuAGQAbABsACIAKQBdAAoAIAAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAEcAZQB0AEQASQBCAGkAdABzACgACgAgACAAIAAgAEkAbgB0AFAAdAByACAAaABkAGMALAAKACAAIAAgACAASQBuAHQAUAB0AHIAIABoAGIAbQBwACwACgAgACAAIAAgAHUAaQBuAHQAIAB1AFMAdABhAHIAdABTAGMAYQBuACwACgAgACAAIAAgAHUAaQBuAHQAIABjAFMAYwBhAG4ATABpAG4AZQBzACwACgAgACAAIAAgAGIAeQB0AGUAWwBdACAAbABwAHYAQgBpAHQAcwAsAAoAIAAgACAAIAByAGUAZgAgAEIASQBUAE0AQQBQAEkATgBGAE8AIABsAHAAYgBpACwACgAgACAAIAAgAHUAaQBuAHQAIAB1AFUAcwBhAGcAZQAKACAAIAApADsACgAKACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAAoAIAAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEcAZQB0AEQAQwAoAEkAbgB0AFAAdAByACAAaABXAG4AZAApADsACgAKACAAIABbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgB1AHMAZQByADMAMgAuAGQAbABsACIAKQBdAAoAIAAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABpAG4AdAAgAFIAZQBsAGUAYQBzAGUARABDACgASQBuAHQAUAB0AHIAIABoAFcAbgBkACwAIABJAG4AdABQAHQAcgAgAGgARABDACkAOwAKAAoAIAAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABzAHQAcgBpAG4AZwAgAEcAZQB0AEEAcABwAHMARgBvAGwAZABlAHIASQBjAG8AbgBEAGEAdABhAFUAcgBsACgAcwB0AHIAaQBuAGcAIABhAHAAcABJAGQAKQAgAHsACgAgACAAIAAgAEcAdQBpAGQAIABpAGkAZAAgAD0AIABuAGUAdwAgAEcAdQBpAGQAKAAiAGIAYwBjADEAOABiADcAOQAtAGIAYQAxADYALQA0ADQAMgBmAC0AOAAwAGMANAAtADgAYQA1ADkAYwAzADAAYwA0ADYAMwBiACIAKQA7AAoAIAAgACAAIABJAFMAaABlAGwAbABJAHQAZQBtAEkAbQBhAGcAZQBGAGEAYwB0AG8AcgB5ACAAZgBhAGMAdABvAHIAeQA7AAoAIAAgACAAIABTAEgAQwByAGUAYQB0AGUASQB0AGUAbQBGAHIAbwBtAFAAYQByAHMAaQBuAGcATgBhAG0AZQAoACIAcwBoAGUAbABsADoAQQBwAHAAcwBGAG8AbABkAGUAcgBcAFwAIgAgACsAIABhAHAAcABJAGQALAAgAEkAbgB0AFAAdAByAC4AWgBlAHIAbwAsACAAcgBlAGYAIABpAGkAZAAsACAAbwB1AHQAIABmAGEAYwB0AG8AcgB5ACkAOwAKAAoAIAAgACAAIABJAG4AdABQAHQAcgAgAGgAYgBpAHQAbQBhAHAAOwAKACAAIAAgACAAZgBhAGMAdABvAHIAeQAuAEcAZQB0AEkAbQBhAGcAZQAoAG4AZQB3ACAAUwBJAFoARQAoADMAMgAsACAAMwAyACkALAAgAEkAQwBPAE4AXwBPAE4ATABZACwAIABvAHUAdAAgAGgAYgBpAHQAbQBhAHAAKQA7AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAHYAYQByACAAYgBpAHQAbQBhAHAAIAA9ACAAQgBpAHQAbQBhAHAARgByAG8AbQBIAEIAaQB0AG0AYQBwAFAAcgBlAHMAZQByAHYAZQBBAGwAcABoAGEAKABoAGIAaQB0AG0AYQBwACwAIAAzADIALAAgADMAMgApACkACgAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAHYAYQByACAAcwB0AHIAZQBhAG0AIAA9ACAAbgBlAHcAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgAKQApACAAewAKACAAIAAgACAAIAAgACAAIABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKABzAHQAcgBlAGEAbQAsACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ASQBtAGEAZwBpAG4AZwAuAEkAbQBhAGcAZQBGAG8AcgBtAGEAdAAuAFAAbgBnACkAOwAKACAAIAAgACAAIAAgACAAIAByAGUAdAB1AHIAbgAgACIAZABhAHQAYQA6AGkAbQBhAGcAZQAvAHAAbgBnADsAYgBhAHMAZQA2ADQALAAiACAAKwAgAEMAbwBuAHYAZQByAHQALgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKABzAHQAcgBlAGEAbQAuAFQAbwBBAHIAcgBhAHkAKAApACkAOwAKACAAIAAgACAAIAAgAH0ACgAgACAAIAAgAH0AIABmAGkAbgBhAGwAbAB5ACAAewAKACAAIAAgACAAIAAgAEQAZQBsAGUAdABlAE8AYgBqAGUAYwB0ACgAaABiAGkAdABtAGEAcAApADsACgAgACAAIAAgAH0ACgAgACAAfQAKAAoAIAAgAHMAdABhAHQAaQBjACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAIABCAGkAdABtAGEAcABGAHIAbwBtAEgAQgBpAHQAbQBhAHAAUAByAGUAcwBlAHIAdgBlAEEAbABwAGgAYQAoAEkAbgB0AFAAdAByACAAaABiAGkAdABtAGEAcAAsACAAaQBuAHQAIAB3AGkAZAB0AGgALAAgAGkAbgB0ACAAaABlAGkAZwBoAHQAKQAgAHsACgAgACAAIAAgAHYAYQByACAAaQBuAGYAbwAgAD0AIABuAGUAdwAgAEIASQBUAE0AQQBQAEkATgBGAE8AKAApADsACgAgACAAIAAgAGkAbgBmAG8ALgBiAG0AaQBIAGUAYQBkAGUAcgAuAGIAaQBTAGkAegBlACAAPQAgACgAdQBpAG4AdAApAE0AYQByAHMAaABhAGwALgBTAGkAegBlAE8AZgAoAHQAeQBwAGUAbwBmACgAQgBJAFQATQBBAFAASQBOAEYATwBIAEUAQQBEAEUAUgApACkAOwAKACAAIAAgACAAaQBuAGYAbwAuAGIAbQBpAEgAZQBhAGQAZQByAC4AYgBpAFcAaQBkAHQAaAAgAD0AIAB3AGkAZAB0AGgAOwAKACAAIAAgACAAaQBuAGYAbwAuAGIAbQBpAEgAZQBhAGQAZQByAC4AYgBpAEgAZQBpAGcAaAB0ACAAPQAgAC0AaABlAGkAZwBoAHQAOwAKACAAIAAgACAAaQBuAGYAbwAuAGIAbQBpAEgAZQBhAGQAZQByAC4AYgBpAFAAbABhAG4AZQBzACAAPQAgADEAOwAKACAAIAAgACAAaQBuAGYAbwAuAGIAbQBpAEgAZQBhAGQAZQByAC4AYgBpAEIAaQB0AEMAbwB1AG4AdAAgAD0AIAAzADIAOwAKACAAIAAgACAAaQBuAGYAbwAuAGIAbQBpAEgAZQBhAGQAZQByAC4AYgBpAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAgAD0AIABCAEkAXwBSAEcAQgA7AAoAIAAgACAAIABpAG4AZgBvAC4AYgBtAGkASABlAGEAZABlAHIALgBiAGkAUwBpAHoAZQBJAG0AYQBnAGUAIAA9ACAAKAB1AGkAbgB0ACkAKAB3AGkAZAB0AGgAIAAqACAAaABlAGkAZwBoAHQAIAAqACAANAApADsACgAKACAAIAAgACAAYgB5AHQAZQBbAF0AIABwAGkAeABlAGwAcwAgAD0AIABuAGUAdwAgAGIAeQB0AGUAWwB3AGkAZAB0AGgAIAAqACAAaABlAGkAZwBoAHQAIAAqACAANABdADsACgAgACAAIAAgAEkAbgB0AFAAdAByACAAaABkAGMAIAA9ACAARwBlAHQARABDACgASQBuAHQAUAB0AHIALgBaAGUAcgBvACkAOwAKACAAIAAgACAAdAByAHkAIAB7AAoAIAAgACAAIAAgACAAaQBuAHQAIABzAGMAYQBuAEwAaQBuAGUAcwAgAD0AIABHAGUAdABEAEkAQgBpAHQAcwAoAGgAZABjACwAIABoAGIAaQB0AG0AYQBwACwAIAAwACwAIAAoAHUAaQBuAHQAKQBoAGUAaQBnAGgAdAAsACAAcABpAHgAZQBsAHMALAAgAHIAZQBmACAAaQBuAGYAbwAsACAARABJAEIAXwBSAEcAQgBfAEMATwBMAE8AUgBTACkAOwAKACAAIAAgACAAIAAgAGkAZgAgACgAcwBjAGEAbgBMAGkAbgBlAHMAIAA9AD0AIAAwACkAIAB7AAoAIAAgACAAIAAgACAAIAAgAHQAaAByAG8AdwAgAG4AZQB3ACAASQBuAHYAYQBsAGkAZABPAHAAZQByAGEAdABpAG8AbgBFAHgAYwBlAHAAdABpAG8AbgAoACIARwBlAHQARABJAEIAaQB0AHMAIABmAGEAaQBsAGUAZAAuACIAKQA7AAoAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQAgAGYAaQBuAGEAbABsAHkAIAB7AAoAIAAgACAAIAAgACAAUgBlAGwAZQBhAHMAZQBEAEMAKABJAG4AdABQAHQAcgAuAFoAZQByAG8ALAAgAGgAZABjACkAOwAKACAAIAAgACAAfQAKAAoAIAAgACAAIAB2AGEAcgAgAGIAaQB0AG0AYQBwACAAPQAgAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AQgBpAHQAbQBhAHAAKAB3AGkAZAB0AGgALAAgAGgAZQBpAGcAaAB0ACwAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4AUABpAHgAZQBsAEYAbwByAG0AYQB0AC4ARgBvAHIAbQBhAHQAMwAyAGIAcABwAEEAcgBnAGIAKQA7AAoAIAAgACAAIAB2AGEAcgAgAGQAYQB0AGEAIAA9ACAAYgBpAHQAbQBhAHAALgBMAG8AYwBrAEIAaQB0AHMAKAAKACAAIAAgACAAIAAgAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4AUgBlAGMAdABhAG4AZwBsAGUAKAAwACwAIAAwACwAIAB3AGkAZAB0AGgALAAgAGgAZQBpAGcAaAB0ACkALAAKACAAIAAgACAAIAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUATABvAGMAawBNAG8AZABlAC4AVwByAGkAdABlAE8AbgBsAHkALAAKACAAIAAgACAAIAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBQAGkAeABlAGwARgBvAHIAbQBhAHQALgBGAG8AcgBtAGEAdAAzADIAYgBwAHAAQQByAGcAYgAKACAAIAAgACAAKQA7AAoAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIABNAGEAcgBzAGgAYQBsAC4AQwBvAHAAeQAoAHAAaQB4AGUAbABzACwAIAAwACwAIABkAGEAdABhAC4AUwBjAGEAbgAwACwAIABwAGkAeABlAGwAcwAuAEwAZQBuAGcAdABoACkAOwAKACAAIAAgACAAfQAgAGYAaQBuAGEAbABsAHkAIAB7AAoAIAAgACAAIAAgACAAYgBpAHQAbQBhAHAALgBVAG4AbABvAGMAawBCAGkAdABzACgAZABhAHQAYQApADsACgAgACAAIAAgAH0ACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAYgBpAHQAbQBhAHAAOwAKACAAIAB9AAoAfQAKACIAQAAKAAoAQQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAKAGkAZgAgACgALQBuAG8AdAAgACgAIgBDAG8AZABlAHgAUwBoAGUAbABsAEkAYwBvAG4ATgBhAHQAaQB2AGUAIgAgAC0AYQBzACAAWwB0AHkAcABlAF0AKQApACAAewAKACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAFQAeQBwAGUARABlAGYAaQBuAGkAdABpAG8AbgAgACQAYwBvAGQAZQAgAC0AUgBlAGYAZQByAGUAbgBjAGUAZABBAHMAcwBlAG0AYgBsAGkAZQBzACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAfQAKAAoAZgB1AG4AYwB0AGkAbwBuACAAQwBvAG4AdgBlAHIAdAAtAEkAbQBhAGcAZQBGAGkAbABlAFQAbwBEAGEAdABhAFUAcgBsACgAWwBzAHQAcgBpAG4AZwBdACQAUABhAHQAaAApACAAewAKACAAIABpAGYAIAAoAC0AbgBvAHQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAFAAYQB0AGgAIAAtAFAAYQB0AGgAVAB5AHAAZQAgAEwAZQBhAGYAKQApACAAewAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAkAG4AdQBsAGwACgAgACAAfQAKAAoAIAAgACQAZQB4AHQAZQBuAHMAaQBvAG4AIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQARQB4AHQAZQBuAHMAaQBvAG4AKAAkAFAAYQB0AGgAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAIAAgACQAbQBpAG0AZQBUAHkAcABlACAAPQAgAHMAdwBpAHQAYwBoACAAKAAkAGUAeAB0AGUAbgBzAGkAbwBuACkAIAB7AAoAIAAgACAAIAAiAC4AcABuAGcAIgAgAHsAIAAiAGkAbQBhAGcAZQAvAHAAbgBnACIAIAB9AAoAIAAgACAAIAAiAC4AagBwAGcAIgAgAHsAIAAiAGkAbQBhAGcAZQAvAGoAcABlAGcAIgAgAH0ACgAgACAAIAAgACIALgBqAHAAZQBnACIAIAB7ACAAIgBpAG0AYQBnAGUALwBqAHAAZQBnACIAIAB9AAoAIAAgACAAIAAiAC4AaQBjAG8AIgAgAHsAIAAiAGkAbQBhAGcAZQAvAHgALQBpAGMAbwBuACIAIAB9AAoAIAAgACAAIAAiAC4AYgBtAHAAIgAgAHsAIAAiAGkAbQBhAGcAZQAvAGIAbQBwACIAIAB9AAoAIAAgACAAIABkAGUAZgBhAHUAbAB0ACAAewAgACQAbgB1AGwAbAAgAH0ACgAgACAAfQAKACAAIABpAGYAIAAoACQAbgB1AGwAbAAgAC0AZQBxACAAJABtAGkAbQBlAFQAeQBwAGUAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAIAAgAH0ACgAKACAAIAAkAGIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACQAUABhAHQAaAApAAoAIAAgAHIAZQB0AHUAcgBuACAAIgBkAGEAdABhADoAJABtAGkAbQBlAFQAeQBwAGUAOwBiAGEAcwBlADYANAAsACQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMAKQApACIACgB9AAoACgBmAHUAbgBjAHQAaQBvAG4AIABDAG8AbgB2AGUAcgB0AC0ARQB4AGUASQBjAG8AbgBUAG8ARABhAHQAYQBVAHIAbAAoAFsAcwB0AHIAaQBuAGcAXQAkAFAAYQB0AGgAKQAgAHsACgAgACAAaQBmACAAKAAtAG4AbwB0ACAAKABUAGUAcwB0AC0AUABhAHQAaAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJABQAGEAdABoACAALQBQAGEAdABoAFQAeQBwAGUAIABMAGUAYQBmACkAKQAgAHsACgAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsAAoAIAAgAH0ACgAKACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACQAaQBjAG8AbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAYwBvAG4AXQA6ADoARQB4AHQAcgBhAGMAdABBAHMAcwBvAGMAaQBhAHQAZQBkAEkAYwBvAG4AKAAkAFAAYQB0AGgAKQAKACAAIABpAGYAIAAoACQAbgB1AGwAbAAgAC0AZQBxACAAJABpAGMAbwBuACkAIAB7AAoAIAAgACAAIAByAGUAdAB1AHIAbgAgACQAbgB1AGwAbAAKACAAIAB9AAoACgAgACAAJABiAGkAdABtAGEAcAAgAD0AIAAkAG4AdQBsAGwACgAgACAAJABzAHQAcgBlAGEAbQAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAKACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAAJABpAGMAbwBuAC4AVABvAEIAaQB0AG0AYQBwACgAKQAKACAAIAAgACAAJABiAGkAdABtAGEAcAAuAFMAYQB2AGUAKAAkAHMAdAByAGUAYQBtACwAIABbAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEkAbQBhAGcAaQBuAGcALgBJAG0AYQBnAGUARgBvAHIAbQBhAHQAXQA6ADoAUABuAGcAKQAKACAAIAAgACAAcgBlAHQAdQByAG4AIAAiAGQAYQB0AGEAOgBpAG0AYQBnAGUALwBwAG4AZwA7AGIAYQBzAGUANgA0ACwAJAAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHMAdAByAGUAYQBtAC4AVABvAEEAcgByAGEAeQAoACkAKQApACIACgAgACAAfQAgAGYAaQBuAGEAbABsAHkAIAB7AAoAIAAgACAAIABpAGYAIAAoACQAbgB1AGwAbAAgAC0AbgBlACAAJABiAGkAdABtAGEAcAApACAAewAgACQAYgBpAHQAbQBhAHAALgBEAGkAcwBwAG8AcwBlACgAKQAgAH0ACgAgACAAIAAgACQAaQBjAG8AbgAuAEQAaQBzAHAAbwBzAGUAKAApAAoAIAAgACAAIAAkAHMAdAByAGUAYQBtAC4ARABpAHMAcABvAHMAZQAoACkACgAgACAAfQAKAH0ACgAKACQAQQBwAHAAUABhAHQAaAAgAD0AIAAkAGUAbgB2ADoAQwBPAEQARQBYAF8ATgBBAFQASQBWAEUAXwBEAEUAUwBLAFQATwBQAF8AQQBQAFAAXwBJAEMATwBOAF8AUABBAFQASAAKAGkAZgAgACgAWwBzAHQAcgBpAG4AZwBdADoAOgBJAHMATgB1AGwAbABPAHIAVwBoAGkAdABlAFMAcABhAGMAZQAoACQAQQBwAHAAUABhAHQAaAApACkAIAB7AAoAIAAgAGUAeABpAHQAIAAwAAoAfQAKAAoAJAB0AHIAaQBtAG0AZQBkAEEAcABwAFAAYQB0AGgAIAA9ACAAJABBAHAAcABQAGEAdABoAC4AVAByAGkAbQAoACkACgBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAkAHQAcgBpAG0AbQBlAGQAQQBwAHAAUABhAHQAaAAgAC0AUABhAHQAaABUAHkAcABlACAATABlAGEAZgApACAAewAKACAAIAAkAGUAeAB0AGUAbgBzAGkAbwBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AEUAeAB0AGUAbgBzAGkAbwBuACgAJAB0AHIAaQBtAG0AZQBkAEEAcABwAFAAYQB0AGgAKQAuAFQAbwBMAG8AdwBlAHIASQBuAHYAYQByAGkAYQBuAHQAKAApAAoAIAAgACQAZABhAHQAYQBVAHIAbAAgAD0AIABpAGYAIAAoACQAZQB4AHQAZQBuAHMAaQBvAG4AIAAtAGUAcQAgACIALgBlAHgAZQAiACAALQBvAHIAIAAkAGUAeAB0AGUAbgBzAGkAbwBuACAALQBlAHEAIAAiAC4AZABsAGwAIgApACAAewAKACAAIAAgACAAQwBvAG4AdgBlAHIAdAAtAEUAeABlAEkAYwBvAG4AVABvAEQAYQB0AGEAVQByAGwAIAAkAHQAcgBpAG0AbQBlAGQAQQBwAHAAUABhAHQAaAAKACAAIAB9ACAAZQBsAHMAZQAgAHsACgAgACAAIAAgAEMAbwBuAHYAZQByAHQALQBJAG0AYQBnAGUARgBpAGwAZQBUAG8ARABhAHQAYQBVAHIAbAAgACQAdAByAGkAbQBtAGUAZABBAHAAcABQAGEAdABoAAoAIAAgAH0ACgAgACAAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAZABhAHQAYQBVAHIAbAApACAAewAKACAAIAAgACAAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAkAGQAYQB0AGEAVQByAGwACgAgACAAfQAKACAAIABlAHgAaQB0ACAAMAAKAH0ACgAKAHQAcgB5ACAAewAKACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACgAWwBDAG8AZABlAHgAUwBoAGUAbABsAEkAYwBvAG4ATgBhAHQAaQB2AGUAXQA6ADoARwBlAHQAQQBwAHAAcwBGAG8AbABkAGUAcgBJAGMAbwBuAEQAYQB0AGEAVQByAGwAKAAkAHQAcgBpAG0AbQBlAGQAQQBwAHAAUABhAHQAaAApACkACgB9ACAAYwBhAHQAYwBoACAAewAKACAAIABlAHgAaQB0ACAAMAAKAH0ACgA=

utf16-le for

$ErrorActionPreference = "Stop"
$ProgressPreference = "SilentlyContinue"

$code = @"
using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential)]
public struct SIZE {
public int cx;
public int cy;
public SIZE(int x, int y) { cx = x; cy = y; }
}

[StructLayout(LayoutKind.Sequential)]
public struct BITMAPINFOHEADER {
public uint biSize;
public int biWidth;
public int biHeight;
public ushort biPlanes;
public ushort biBitCount;
public uint biCompression;
public uint biSizeImage;
public int biXPelsPerMeter;
public int biYPelsPerMeter;
public uint biClrUsed;
public uint biClrImportant;
}

[StructLayout(LayoutKind.Sequential)]
public struct BITMAPINFO {
public BITMAPINFOHEADER bmiHeader;
public uint bmiColors;
}

[ComImport]
[InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
[Guid("bcc18b79-ba16-442f-80c4-8a59c30c463b")]
public interface IShellItemImageFactory {
void GetImage(SIZE size, int flags, out IntPtr phbm);
}

public static class CodexShellIconNative {
const int BI_RGB = 0;
const int DIB_RGB_COLORS = 0;
const int ICON_ONLY = 4;

[DllImport("shell32.dll", CharSet = CharSet.Unicode, PreserveSig = false)]
public static extern void SHCreateItemFromParsingName(
string pszPath,
IntPtr pbc,
ref Guid riid,
[MarshalAs(UnmanagedType.Interface)] out IShellItemImageFactory ppv
);

[DllImport("gdi32.dll")]
public static extern bool DeleteObject(IntPtr hObject);

[DllImport("gdi32.dll")]
static extern int GetDIBits(
IntPtr hdc,
IntPtr hbmp,
uint uStartScan,
uint cScanLines,
byte[] lpvBits,
ref BITMAPINFO lpbi,
uint uUsage
);

[DllImport("user32.dll")]
static extern IntPtr GetDC(IntPtr hWnd);

[DllImport("user32.dll")]
static extern int ReleaseDC(IntPtr hWnd, IntPtr hDC);

public static string GetAppsFolderIconDataUrl(string appId) {
Guid iid = new Guid("bcc18b79-ba16-442f-80c4-8a59c30c463b");
IShellItemImageFactory factory;
SHCreateItemFromParsingName("shell:AppsFolder\\" + appId, IntPtr.Zero, ref iid, out factory);

IntPtr hbitmap;
factory.GetImage(new SIZE(32, 32), ICON_ONLY, out hbitmap);
try {
using (var bitmap = BitmapFromHBitmapPreserveAlpha(hbitmap, 32, 32))
using (var stream = new System.IO.MemoryStream()) {
bitmap.Save(stream, System.Drawing.Imaging.ImageFormat.Png);
return "data:image/png;base64," + Convert.ToBase64String(stream.ToArray());
}
} finally {
DeleteObject(hbitmap);
}
}

static System.Drawing.Bitmap BitmapFromHBitmapPreserveAlpha(IntPtr hbitmap, int width, int height) {
var info = new BITMAPINFO();
info.bmiHeader.biSize = (uint)Marshal.SizeOf(typeof(BITMAPINFOHEADER));
info.bmiHeader.biWidth = width;
info.bmiHeader.biHeight = -height;
info.bmiHeader.biPlanes = 1;
info.bmiHeader.biBitCount = 32;
info.bmiHeader.biCompression = BI_RGB;
info.bmiHeader.biSizeImage = (uint)(width height 4);

byte[] pixels = new byte[width height 4];
IntPtr hdc = GetDC(IntPtr.Zero);
try {
int scanLines = GetDIBits(hdc, hbitmap, 0, (uint)height, pixels, ref info, DIB_RGB_COLORS);
if (scanLines == 0) {
throw new InvalidOperationException("GetDIBits failed.");
}
} finally {
ReleaseDC(IntPtr.Zero, hdc);
}

var bitmap = new System.Drawing.Bitmap(width, height, System.Drawing.Imaging.PixelFormat.Format32bppArgb);
var data = bitmap.LockBits(
new System.Drawing.Rectangle(0, 0, width, height),
System.Drawing.Imaging.ImageLockMode.WriteOnly,
System.Drawing.Imaging.PixelFormat.Format32bppArgb
);
try {
Marshal.Copy(pixels, 0, data.Scan0, pixels.Length);
} finally {
bitmap.UnlockBits(data);
}
return bitmap;
}
}
"@

Add-Type -AssemblyName System.Drawing
if (-not ("CodexShellIconNative" -as [type])) {
Add-Type -TypeDefinition $code -ReferencedAssemblies System.Drawing
}

function Convert-ImageFileToDataUrl([string]$Path) {
if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) {
return $null
}

$extension = [System.IO.Path]::GetExtension($Path).ToLowerInvariant()
$mimeType = switch ($extension) {
".png" { "image/png" }
".jpg" { "image/jpeg" }
".jpeg" { "image/jpeg" }
".ico" { "image/x-icon" }
".bmp" { "image/bmp" }
default { $null }
}
if ($null -eq $mimeType) {
return $null
}

$bytes = [System.IO.File]::ReadAllBytes($Path)
return "data:$mimeType;base64,$([Convert]::ToBase64String($bytes))"
}

function Convert-ExeIconToDataUrl([string]$Path) {
if (-not (Test-Path -LiteralPath $Path -PathType Leaf)) {
return $null
}

Add-Type -AssemblyName System.Drawing
$icon = [System.Drawing.Icon]::ExtractAssociatedIcon($Path)
if ($null -eq $icon) {
return $null
}

$bitmap = $null
$stream = New-Object System.IO.MemoryStream
try {
$bitmap = $icon.ToBitmap()
$bitmap.Save($stream, [System.Drawing.Imaging.ImageFormat]::Png)
return "data:image/png;base64,$([Convert]::ToBase64String($stream.ToArray()))"
} finally {
if ($null -ne $bitmap) { $bitmap.Dispose() }
$icon.Dispose()
$stream.Dispose()
}
}

$AppPath = $env:CODEX_NATIVE_DESKTOP_APP_ICON_PATH
if ([string]::IsNullOrWhiteSpace($AppPath)) {
exit 0
}

$trimmedAppPath = $AppPath.Trim()
if (Test-Path -LiteralPath $trimmedAppPath -PathType Leaf) {
$extension = [System.IO.Path]::GetExtension($trimmedAppPath).ToLowerInvariant()
$dataUrl = if ($extension -eq ".exe" -or $extension -eq ".dll") {
Convert-ExeIconToDataUrl $trimmedAppPath
} else {
Convert-ImageFileToDataUrl $trimmedAppPath
}
if ($null -ne $dataUrl) {
Write-Output $dataUrl
}
exit 0
}

try {
Write-Output ([CodexShellIconNative]::GetAppsFolderIconDataUrl($trimmedAppPath))
} catch {
exit 0
}

What steps can reproduce the bug?

just have the new version

What is the expected behavior?

_No response_

Additional information

_No response_

The app C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe was passed a malicious command line and has been blocked. Your device is now safe.

Command line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand ...