Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 10, 2025, 10:53 a.m.	April 10, 2025, 10:59 a.m.

Size	794.0B
Type	ASCII text
MD5	`5070287d3b01b1aff921d11c9be09b9c`
SHA256	`e711f8bba14a0f6b8fd38341585580f0937c9fd8dd37faedbf9dc1cf49519590`
CRC32	`B25128F6`
ssdeep	`12:CMy81kJu+m5t81kJuum81kJuI81kJuY81kJuiLq81kJufW8m81kJuvJK:WJu+WVJuumJuwJugJuiLqJuYJu0`
Yara	None matched

wscript.exe "C:\Windows\System32\wscript.exe" C:\Users\test22\AppData\Local\Temp\exclusion.vbs
1020
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\TuApp'
  2136
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.exe'
  2188
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dat'
  2248
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.bin'
  2308
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dll'
  2384
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.vbs'
  2460
- powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.js'
  2604

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (42 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 10, 2025, 10:53 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (7 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 10, 2025, 10:53 a.m.			0	0
IsDebuggerPresent April 10, 2025, 10:53 a.m.			0	0
IsDebuggerPresent April 10, 2025, 10:53 a.m.			0	0
IsDebuggerPresent April 10, 2025, 10:53 a.m.			0	0
IsDebuggerPresent April 10, 2025, 10:53 a.m.			0	0
IsDebuggerPresent April 10, 2025, 10:53 a.m.			0	0
IsDebuggerPresent April 10, 2025, 10:53 a.m.			0	0

Command line console output was observed (50 out of 56 events)

Time & API	Arguments	Status	Return
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + Add-MpPreference <<<< -ExclusionPath 'C:\Users\Public\TuApp' console_handle: 0x00000053	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + Add-MpPreference <<<< -ExclusionExtension '.exe' console_handle: 0x00000053	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + Add-MpPreference <<<< -ExclusionExtension '.dat' console_handle: 0x00000053	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + Add-MpPreference <<<< -ExclusionExtension '.bin' console_handle: 0x00000053	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + Add-MpPreference <<<< -ExclusionExtension '.dll' console_handle: 0x00000053	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: h was included, verify that the path is correct and try again. console_handle: 0x0000003b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: At line:1 char:17 console_handle: 0x00000047	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + Add-MpPreference <<<< -ExclusionExtension '.vbs' console_handle: 0x00000053	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + CategoryInfo : ObjectNotFound: (Add-MpPreference:String) [], Co console_handle: 0x0000005f	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: mmandNotFoundException console_handle: 0x0000006b	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: + FullyQualifiedErrorId : CommandNotFoundException console_handle: 0x00000077	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: The term 'Add-MpPreference' is not recognized as the name of a cmdlet, function console_handle: 0x00000023	1	1
WriteConsoleW April 10, 2025, 10:53 a.m.	buffer: , script file, or operable program. Check the spelling of the name, or if a pat console_handle: 0x0000002f	1	1

Uses Windows APIs to generate a cryptographic key (50 out of 322 events)

Time & API	Arguments	Status	Return
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca980 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca240 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caac0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca6c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005cad40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005caf40 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005ca9c0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00405ff8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00406138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00406138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 10, 2025, 10:53 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00406138 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 10, 2025, 10:53 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 959 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02840000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72681000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0248a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72682000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02492000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02841000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02842000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02493000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02494000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024cb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0248b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024c5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02495000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x027b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02496000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x024b9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02831000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02832000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02833000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02834000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02835000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02836000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02837000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02838000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02839000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0283a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0283b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0283c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0283d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0283e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0283f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a03000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 10, 2025, 10:53 a.m.	process_identifier: 2136 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04a04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (14 events)

cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dll'
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.vbs'
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.exe'
cmdline	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.exe'
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.bin'
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.js'
cmdline	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.bin'
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\TuApp'
cmdline	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.vbs'
cmdline	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dat'
cmdline	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.js'
cmdline	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dll'
cmdline	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\TuApp'
cmdline	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dat'

A process created a hidden window (14 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW April 10, 2025, 10:53 a.m.	thread_identifier: 2140 thread_handle: 0x000002f4 process_identifier: 2136 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\TuApp' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002fc	1	1
ShellExecuteExW April 10, 2025, 10:53 a.m.	show_type: 0 filepath_r: powershell parameters: -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\TuApp' filepath: powershell	1	1
CreateProcessInternalW April 10, 2025, 10:53 a.m.	thread_identifier: 2192 thread_handle: 0x000002a8 process_identifier: 2188 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.exe' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f4	1	1
ShellExecuteExW April 10, 2025, 10:53 a.m.	show_type: 0 filepath_r: powershell parameters: -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.exe' filepath: powershell	1	1
CreateProcessInternalW April 10, 2025, 10:53 a.m.	thread_identifier: 2252 thread_handle: 0x000002c8 process_identifier: 2248 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dat' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f4	1	1
ShellExecuteExW April 10, 2025, 10:53 a.m.	show_type: 0 filepath_r: powershell parameters: -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dat' filepath: powershell	1	1
CreateProcessInternalW April 10, 2025, 10:53 a.m.	thread_identifier: 2312 thread_handle: 0x000002a4 process_identifier: 2308 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.bin' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f4	1	1
ShellExecuteExW April 10, 2025, 10:53 a.m.	show_type: 0 filepath_r: powershell parameters: -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.bin' filepath: powershell	1	1
CreateProcessInternalW April 10, 2025, 10:53 a.m.	thread_identifier: 2388 thread_handle: 0x000001c4 process_identifier: 2384 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dll' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f4	1	1
ShellExecuteExW April 10, 2025, 10:53 a.m.	show_type: 0 filepath_r: powershell parameters: -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dll' filepath: powershell	1	1
CreateProcessInternalW April 10, 2025, 10:53 a.m.	thread_identifier: 2464 thread_handle: 0x000001ac process_identifier: 2460 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.vbs' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f4	1	1
ShellExecuteExW April 10, 2025, 10:53 a.m.	show_type: 0 filepath_r: powershell parameters: -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.vbs' filepath: powershell	1	1
CreateProcessInternalW April 10, 2025, 10:53 a.m.	thread_identifier: 2608 thread_handle: 0x000002cc process_identifier: 2604 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe track: 1 command_line: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.js' filepath_r: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe stack_pivoted: 0 creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000002f4	1	1
ShellExecuteExW April 10, 2025, 10:53 a.m.	show_type: 0 filepath_r: powershell parameters: -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.js' filepath: powershell	1	1

File has been identified by 2 AntiVirus engines on VirusTotal as malicious (2 events)

Rising	Trojan.WDBypass/PS!1.EA04 (CLASSIC)
Microsoft	Trojan:Script/Wacatac.C!ml

Checks for the Locally Unique Identifier on the system for a suspicious privilege (7 events)

Time & API	Arguments	Status	Return
LookupPrivilegeValueW April 10, 2025, 10:53 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 10, 2025, 10:53 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 10, 2025, 10:53 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 10, 2025, 10:53 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 10, 2025, 10:53 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 10, 2025, 10:53 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1
LookupPrivilegeValueW April 10, 2025, 10:53 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1

A potential heapspray has been detected. 64 megabytes was sprayed onto the heap of the powershell.exe process (1 event)

count

1039

name

heapspray

process

powershell.exe

total_mb

length

65536

protection

PAGE_READWRITE

One or more non-whitelisted processes were created (14 events)

parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dll'
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.vbs'
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.exe'
parent_process	wscript.exe	martian_process	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.exe'
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.bin'
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.js'
parent_process	wscript.exe	martian_process	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.bin'
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\TuApp'
parent_process	wscript.exe	martian_process	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.vbs'
parent_process	wscript.exe	martian_process	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dat'
parent_process	wscript.exe	martian_process	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.js'
parent_process	wscript.exe	martian_process	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dll'
parent_process	wscript.exe	martian_process	powershell -WindowStyle Hidden -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\TuApp'
parent_process	wscript.exe	martian_process	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command Add-MpPreference -ExclusionExtension '.dat'

Creates a suspicious Powershell process (14 events)

option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window
option	-windowstyle hidden	value	Attempts to execute command with a hidden window

The process wscript.exe wrote an executable file to disk which it then attempted to execute (1 event)

file	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

exclusion.vbs

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All