command_line: powershell.exe -NoProfile -EncodedCommand SYNTHETIC_VALUE