guloader | 3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f

Analysis

max time kernel
147s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2023 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
Size

267KB
MD5

4dbe71a4ca0eaea634ec73b4a82d32a9
SHA1

48ba9c1be52988de95bf1a2597fd573f96892895
SHA256

3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f
SHA512

5f157e987b2c2b25a2d66e49dcc583220da474bd8756b6ea8d206ebeb99e994a02f98800a081a750b885b576f20204b89b8632de956bf0d8cec9d5785c6fcd70
SSDEEP

6144:GDOmbbC0309OSXjr2Z2UCEVSOuzAtf/QZv3z9jnnOldiUf:4bZ309//2HCEVNuzaf/QZvj1nki

Score

10^/10

guloader warzonerat downloader evasion infostealer persistence rat upx

Malware Config

Extracted

Family

warzonerat

dnmpbczm0963fxtdplc.duckdns.org:5689

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2848-169-0x0000000000400000-0x0000000001654000-memory.dmp	warzonerat
behavioral2/memory/2848-173-0x0000000000400000-0x0000000001654000-memory.dmp	warzonerat
behavioral2/memory/2848-196-0x0000000000400000-0x0000000001654000-memory.dmp	warzonerat
behavioral2/memory/3080-240-0x0000000000400000-0x0000000001654000-memory.dmp	warzonerat
behavioral2/memory/3080-244-0x0000000000400000-0x0000000001654000-memory.dmp	warzonerat
behavioral2/memory/3080-290-0x0000000000400000-0x0000000001654000-memory.dmp	warzonerat
behavioral2/memory/3080-292-0x0000000000400000-0x0000000001654000-memory.dmp	warzonerat

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1792 netsh.exe

pid	process
1792	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Windows.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll"	Windows.exe

Checks QEMU agent file 2 TTPs 4 IoCs

Checks presence of QEMU agent, possibly to detect virtualization.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Solicitud de Cotización (Ulatina) 15-03-23·pd.exeSolicitud de Cotización (Ulatina) 15-03-23·pd.exeWindows.exeWindows.exe

description	ioc	process
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Windows.exe
File opened (read-only)	C:\Program Files\Qemu-ga\qemu-ga.exe	Windows.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Windows.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	Windows.exe

Executes dropped EXE 2 IoCs

Processes:

Windows.exe5.exe

pid process

2332 Windows.exe
3952 5.exe
Loads dropped DLL 4 IoCs

Processes:

Solicitud de Cotización (Ulatina) 15-03-23·pd.exeWindows.exeWindows.exesvchost.exe

pid process

5116 Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
2332 Windows.exe
3080 Windows.exe
2120 svchost.exe

pid	process
2332	Windows.exe
3952	5.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\5.exe	upx
C:\Users\Admin\AppData\Local\Temp\5.exe	upx
C:\Users\Admin\AppData\Local\Temp\5.exe	upx
behavioral2/memory/3952-286-0x0000000000260000-0x000000000028D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Solicitud de Cotización (Ulatina) 15-03-23·pd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows update = "C:\\Users\\Admin\\Documents\\Windows.exe"	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

Windows.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	Windows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	Windows.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	Windows.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\jFHFnym = "0"	Windows.exe

Drops file in System32 directory 1 IoCs

Processes:

Windows.exe

description ioc process

File created C:\Windows\System32\rfxvmt.dll Windows.exe
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

Processes:

Solicitud de Cotización (Ulatina) 15-03-23·pd.exeWindows.exe

pid process

2848 Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
3080 Windows.exe

description	ioc	process
File created	C:\Windows\System32\rfxvmt.dll	Windows.exe

pid	process
2848	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
3080	Windows.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

Solicitud de Cotización (Ulatina) 15-03-23·pd.exeSolicitud de Cotización (Ulatina) 15-03-23·pd.exeWindows.exeWindows.exe

pid	process
5116	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
2848	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
2332	Windows.exe
3080	Windows.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Solicitud de Cotización (Ulatina) 15-03-23·pd.exeWindows.exe

description	pid	process	target process
PID 5116 set thread context of 2848	5116	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
PID 2332 set thread context of 3080	2332	Windows.exe	Windows.exe

Drops file in Program Files directory 2 IoCs

Processes:

Windows.exe

description	ioc	process
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	Windows.exe
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	Windows.exe

Drops file in Windows directory 4 IoCs

Processes:

Solicitud de Cotización (Ulatina) 15-03-23·pd.exeWindows.exe

description	ioc	process
File opened for modification	C:\Windows\resources\0409\Aquench\Kadencens\Skandinavisten55.Nec	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
File opened for modification	C:\Windows\resources\0409\Ulnare\Stabbingness5.ini	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
File opened for modification	C:\Windows\resources\0409\Aquench\Kadencens\Skandinavisten55.Nec	Windows.exe
File opened for modification	C:\Windows\resources\0409\Ulnare\Stabbingness5.ini	Windows.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2720 3952 WerFault.exe 5.exe

pid	pid_target	process	target process
2720	3952	WerFault.exe	5.exe

NSIS installer 6 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\Documents\Windows.exe	nsis_installer_1
C:\Users\Admin\Documents\Windows.exe	nsis_installer_2
C:\Users\Admin\Documents\Windows.exe	nsis_installer_1
C:\Users\Admin\Documents\Windows.exe	nsis_installer_2
C:\Users\Admin\Documents\Windows.exe	nsis_installer_1
C:\Users\Admin\Documents\Windows.exe	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exesvchost.exe

pid process

1792 powershell.exe
1792 powershell.exe
1492 powershell.exe
1492 powershell.exe
2120 svchost.exe
2120 svchost.exe
2120 svchost.exe
2120 svchost.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

652
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

Solicitud de Cotización (Ulatina) 15-03-23·pd.exeWindows.exe

pid process

5116 Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
2332 Windows.exe

pid	process
1792	powershell.exe
1792	powershell.exe
1492	powershell.exe
1492	powershell.exe
2120	svchost.exe
2120	svchost.exe
2120	svchost.exe
2120	svchost.exe

pid	process
652

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exeWindows.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	1492	powershell.exe
Token: SeDebugPrivilege	3080	Windows.exe
Token: SeAuditPrivilege	2120	svchost.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

Solicitud de Cotización (Ulatina) 15-03-23·pd.exeSolicitud de Cotización (Ulatina) 15-03-23·pd.exeWindows.exeWindows.exe5.exe

description	pid	process	target process
PID 5116 wrote to memory of 2848	5116	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
PID 5116 wrote to memory of 2848	5116	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
PID 5116 wrote to memory of 2848	5116	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
PID 5116 wrote to memory of 2848	5116	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
PID 2848 wrote to memory of 1792	2848	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	powershell.exe
PID 2848 wrote to memory of 1792	2848	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	powershell.exe
PID 2848 wrote to memory of 1792	2848	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	powershell.exe
PID 2848 wrote to memory of 2332	2848	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	Windows.exe
PID 2848 wrote to memory of 2332	2848	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	Windows.exe
PID 2848 wrote to memory of 2332	2848	Solicitud de Cotización (Ulatina) 15-03-23·pd.exe	Windows.exe
PID 2332 wrote to memory of 3080	2332	Windows.exe	Windows.exe
PID 2332 wrote to memory of 3080	2332	Windows.exe	Windows.exe
PID 2332 wrote to memory of 3080	2332	Windows.exe	Windows.exe
PID 2332 wrote to memory of 3080	2332	Windows.exe	Windows.exe
PID 3080 wrote to memory of 1492	3080	Windows.exe	powershell.exe
PID 3080 wrote to memory of 1492	3080	Windows.exe	powershell.exe
PID 3080 wrote to memory of 1492	3080	Windows.exe	powershell.exe
PID 3080 wrote to memory of 4160	3080	Windows.exe	cmd.exe
PID 3080 wrote to memory of 4160	3080	Windows.exe	cmd.exe
PID 3080 wrote to memory of 4160	3080	Windows.exe	cmd.exe
PID 3080 wrote to memory of 4160	3080	Windows.exe	cmd.exe
PID 3080 wrote to memory of 4160	3080	Windows.exe	cmd.exe
PID 3080 wrote to memory of 3952	3080	Windows.exe	5.exe
PID 3080 wrote to memory of 3952	3080	Windows.exe	5.exe
PID 3080 wrote to memory of 3952	3080	Windows.exe	5.exe
PID 3952 wrote to memory of 1792	3952	5.exe	netsh.exe
PID 3952 wrote to memory of 1792	3952	5.exe	netsh.exe
PID 3952 wrote to memory of 1792	3952	5.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
"C:\Users\Admin\AppData\Local\Temp\Solicitud de Cotización (Ulatina) 15-03-23·pd.exe"
1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5116

C:\Users\Admin\AppData\Local\Temp\Solicitud de Cotización (Ulatina) 15-03-23·pd.exe
"C:\Users\Admin\AppData\Local\Temp\Solicitud de Cotización (Ulatina) 15-03-23·pd.exe"
2⤵
- Checks QEMU agent file
- Adds Run key to start application
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2848

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Users\Admin\Documents\Windows.exe
"C:\Users\Admin\Documents\Windows.exe"
3⤵
- Checks QEMU agent file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2332

C:\Users\Admin\Documents\Windows.exe
"C:\Users\Admin\Documents\Windows.exe"
4⤵
- Sets DLL path for service in the registry
- Checks QEMU agent file
- Checks computer location settings
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
5⤵
PID:4160

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=3389
6⤵
- Modifies Windows Firewall
PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 396
6⤵
- Program crash
PID:2720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3952 -ip 3952
1⤵
PID:316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft DN1\sqlmap.dll
Filesize
114KB

MD5
461ade40b800ae80a40985594e1ac236

SHA1
b3892eef846c044a2b0785d54a432b3e93a968c8

SHA256
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

SHA512
421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
d4ccf82269b1f99499622edacf84d5ce

SHA1
1454dc3c450b85b34c151ddacd93615b940f2c07

SHA256
a40962bd1a9e00f869615fb13b660e00443c90958bbc4ac77b567865239779c3

SHA512
eac0b2f13f2a63832bdfe154787e5221903713d9d8f8ea073d18f875c007c4f52fc33290aa260f1863beb6d667745ba02174c08689fce158a99fb3b78203e736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_E32DA5C2498E8CF7649760B1F24B32AF
Filesize
471B

MD5
f404c86bd5c34759a2d966fd219cbf2e

SHA1
323a73895f6345d7e5b80fa9092fba269797ad94

SHA256
332b2a32eb2fa8fdbd424442f4618cc5902110099e65cf06ed9fd7e3ef0638dd

SHA512
2819708bf17d2378ec7e86c177307d4d02db421bd78154af54b324f436ceb2d4f96540373095c7e220081e2684c94d0436c988ff19e889736980766056b8c21e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
724B

MD5
f569e1d183b84e8078dc456192127536

SHA1
30c537463eed902925300dd07a87d820a713753f

SHA256
287bc80237497eb8681dbf136a56cc3870dd5bd12d48051525a280ae62aab413

SHA512
49553b65a8e3fc0bf98c1bc02bae5b22188618d8edf8e88e4e25932105796956ae8301c63c487e0afe368ea39a4a2af07935a808f5fb53287ef9287bc73e1012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_75B7C74DAC2A7692FAD0A4B72A918B03
Filesize
471B

MD5
ad8c85c44804fefc0a7bb63fc0e67734

SHA1
43492fc02c98b775a4aefbf88b62b99d844f2fe5

SHA256
99085ce1c4abe0d7361b2cfba610aff4b2b0e97b6ae6dd6c9734d8366afe0665

SHA512
483462e24068170a79e403920064a994ad4977965fb561748cae942d1bf2020ac8696412893d33eeb89b1623477a67d5b6f418e4b8f5fb91035835000920876c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
d6ca8137f8e3e5af869c69a26528a8e0

SHA1
8db376fee8b1f35e7a52d44567ef13391307cabb

SHA256
a8ee022ff2747c824a54741d5645c036c390844f808e5b69e76ab57bf7219c12

SHA512
33c4f40cb3621d88bbd25ec3b92250a27e4d20eb9f14d3625150991ceca3ca82c34dedfdc49c99671082d32eb95d1a9f10254e11ab539bc15e2a067dea122bbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_E32DA5C2498E8CF7649760B1F24B32AF
Filesize
406B

MD5
23ea9568809bf63dbac091e86998a397

SHA1
e80b415eed39127ad71806699dbacfff8d3673e8

SHA256
bb12d15f32dc5c69ae925e3cbe6edad1d840bdfcdc18282b4f9025fdad95e7f2

SHA512
06c9f810f632fce0735edb03e3254630268cc5ab59e237c15f9783b67f6377473227bde5ea8a0cb1ced19f7c16267d6058ee38972bf1d6ee100e6180414db125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize
392B

MD5
9decdd59d553b9b46778b6c722c1f149

SHA1
1b3e4c7554448e02761c8dd137eb05a8ea1904a4

SHA256
a196d206ce38e4af58072bdd4b2d1655c2fa0613df4a707b3c206a7c9c131799

SHA512
777d3dbc17ef7872624878d2dad1623ff1d89a3cc77de7f3542721b07cb35f1984282ccc59026c9a3d0a7facbfeb16b204a23859646ccfe185e130cbf380d176

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_75B7C74DAC2A7692FAD0A4B72A918B03
Filesize
406B

MD5
603ab18882f3913c58e0a5df61221d09

SHA1
c6172dab0a54c90c47ea033c28ee09975b767c6c

SHA256
9f8e5359e840753003cafa88355a5698155d61106e9d3e99d6451259ad930ece

SHA512
50d95dd5b9d2dcd615534eee27f3b85bf217b6252a08faed49f20f7e5d9ba5025d5f37c68faca93528a07366bdd6b9825565bef4c5f6aec3db1509f9e8cb07b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
ee113aa8c39846b8daf2b393565802a2

SHA1
562a7a8028090e3fd9470469ead9785394f4670e

SHA256
f500f9ea10acb3ddf79f27f5eb1a2f1a3c0af4f173852ac173acba25ff9347ad

SHA512
58e3aed0c359a5b58010304c3d02d7ba44bdd499f5433cb1a6470e03c242b756c9aa3fa0d0e7b22d4e4906957745523e2eb2a4212d14514fc65ddd9f5c1d770a

Download Submit
C:\Users\Admin\AppData\Local\Temp\5.exe
Filesize
70KB

MD5
ca96229390a0e6a53e8f2125f2c01114

SHA1
a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

SHA256
0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

SHA512
e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\5.exe
Filesize
70KB

MD5
ca96229390a0e6a53e8f2125f2c01114

SHA1
a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

SHA256
0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

SHA512
e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\5.exe
Filesize
70KB

MD5
ca96229390a0e6a53e8f2125f2c01114

SHA1
a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

SHA256
0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

SHA512
e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2xfdam5.mgp.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq227D.tmp\System.dll
Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsq227D.tmp\System.dll
Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst6C4C.tmp\System.dll
Filesize
11KB

MD5
b0c77267f13b2f87c084fd86ef51ccfc

SHA1
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3

SHA256
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77

SHA512
f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e

Download Submit
C:\Users\Admin\Documents\Windows.exe
Filesize
267KB

MD5
4dbe71a4ca0eaea634ec73b4a82d32a9

SHA1
48ba9c1be52988de95bf1a2597fd573f96892895

SHA256
3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f

SHA512
5f157e987b2c2b25a2d66e49dcc583220da474bd8756b6ea8d206ebeb99e994a02f98800a081a750b885b576f20204b89b8632de956bf0d8cec9d5785c6fcd70

Download Submit
C:\Users\Admin\Documents\Windows.exe
Filesize
267KB

MD5
4dbe71a4ca0eaea634ec73b4a82d32a9

SHA1
48ba9c1be52988de95bf1a2597fd573f96892895

SHA256
3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f

SHA512
5f157e987b2c2b25a2d66e49dcc583220da474bd8756b6ea8d206ebeb99e994a02f98800a081a750b885b576f20204b89b8632de956bf0d8cec9d5785c6fcd70

Download Submit
C:\Users\Admin\Documents\Windows.exe
Filesize
267KB

MD5
4dbe71a4ca0eaea634ec73b4a82d32a9

SHA1
48ba9c1be52988de95bf1a2597fd573f96892895

SHA256
3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f

SHA512
5f157e987b2c2b25a2d66e49dcc583220da474bd8756b6ea8d206ebeb99e994a02f98800a081a750b885b576f20204b89b8632de956bf0d8cec9d5785c6fcd70

Download Submit
C:\Users\Admin\Doliolidae\Flugtskydninger\Privatvejens\Haandfuldenes\Impregnating\Kontaktcentrenes.Fla
Filesize
236KB

MD5
b7d956e078c957cb5360c4ea2d3c2273

SHA1
c628a326cf84d3dae3554e68fda7a3ea00a1b92f

SHA256
ff47cd620bf8e3272e23989d45344b155305fe012786d5cd36daae86e437fdf1

SHA512
c0a8f0d04295f810988e4cef08ee036326f1fc2247d2c35480fd9d019e0014f6a96ed07c0bf299fe230cb1f107f83c32bde8c04ae7445c6aa6eff881ae9f10f8

Download Submit
C:\Users\Admin\Doliolidae\Flugtskydninger\Privatvejens\Haandfuldenes\Impregnating\Superprecise.Jum
Filesize
89KB

MD5
951a26dcadeac34af41bc733cec364c1

SHA1
113d2cd326d79e26f9df13f1637b1d62de5e68b7

SHA256
a3bc552ffe558a34a32cce7e4cb9b90d36ec8971f29d408ef9ed2f519a60525c

SHA512
2d6987fbf99db85ccc7c5a6f3fa87f003d982ba06d5ba5e5e79f1f797399fa283cc3790483e9acb62a2e744c2accab433c26234e341ec0f9797d74d2fcfed378

Download Submit
\??\c:\program files\microsoft dn1\rdpwrap.ini
Filesize
299KB

MD5
fca6ba93c780afa00a5703df9ac65754

SHA1
3ed423763fdd9722ff8bed3667ffa93f77390138

SHA256
1c4930123ec2a809b3bd93969967d6c321d8d65fc7b886e062b2581c741944e5

SHA512
538b0995be3796737575a2fd3aaa1644b3e6566e4cd5ed5c4df9e0a586368e7ceea8f0284de53f7c3f0874fc90b9a194d2ea1438bc9d7779eb12d00b8807f595

Download Submit
\??\c:\program files\microsoft dn1\sqlmap.dll
Filesize
114KB

MD5
461ade40b800ae80a40985594e1ac236

SHA1
b3892eef846c044a2b0785d54a432b3e93a968c8

SHA256
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

SHA512
421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

Download Submit
memory/1492-257-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/1492-258-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/1492-259-0x00000000050E0000-0x00000000050F0000-memory.dmp

Filesize
64KB

Download
memory/1492-260-0x000000006ED40000-0x000000006ED8C000-memory.dmp

Filesize
304KB

Download
memory/1492-270-0x000000007F590000-0x000000007F5A0000-memory.dmp

Filesize
64KB

Download
memory/1792-191-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

Filesize
120KB

Download
memory/1792-199-0x0000000074C20000-0x0000000074C6C000-memory.dmp

Filesize
304KB

Download
memory/1792-219-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

Filesize
104KB

Download
memory/1792-220-0x0000000006E40000-0x0000000006E4A000-memory.dmp

Filesize
40KB

Download
memory/1792-175-0x00000000021E0000-0x0000000002216000-memory.dmp

Filesize
216KB

Download
memory/1792-222-0x0000000007050000-0x00000000070E6000-memory.dmp

Filesize
600KB

Download
memory/1792-223-0x0000000007000000-0x000000000700E000-memory.dmp

Filesize
56KB

Download
memory/1792-224-0x0000000007110000-0x000000000712A000-memory.dmp

Filesize
104KB

Download
memory/1792-225-0x00000000070F0000-0x00000000070F8000-memory.dmp

Filesize
32KB

Download
memory/1792-176-0x0000000004CE0000-0x0000000005308000-memory.dmp

Filesize
6.2MB

Download
memory/1792-214-0x0000000000D00000-0x0000000000D10000-memory.dmp

Filesize
64KB

Download
memory/1792-218-0x0000000007410000-0x0000000007A8A000-memory.dmp

Filesize
6.5MB

Download
memory/1792-177-0x0000000005340000-0x0000000005362000-memory.dmp

Filesize
136KB

Download
memory/1792-211-0x0000000006070000-0x000000000608E000-memory.dmp

Filesize
120KB

Download
memory/1792-209-0x000000007F300000-0x000000007F310000-memory.dmp

Filesize
64KB

Download
memory/1792-178-0x0000000005410000-0x0000000005476000-memory.dmp

Filesize
408KB

Download
memory/1792-198-0x0000000006090000-0x00000000060C2000-memory.dmp

Filesize
200KB

Download
memory/1792-188-0x00000000055F0000-0x0000000005656000-memory.dmp

Filesize
408KB

Download
memory/1792-189-0x0000000000D00000-0x0000000000D10000-memory.dmp

Filesize
64KB

Download
memory/1792-190-0x0000000000D00000-0x0000000000D10000-memory.dmp

Filesize
64KB

Download
memory/2332-228-0x0000000004050000-0x0000000004F7F000-memory.dmp

Filesize
15.2MB

Download
memory/2332-221-0x0000000004050000-0x0000000004F7F000-memory.dmp

Filesize
15.2MB

Download
memory/2848-194-0x0000000001660000-0x000000000258F000-memory.dmp

Filesize
15.2MB

Download
memory/2848-156-0x0000000001660000-0x000000000258F000-memory.dmp

Filesize
15.2MB

Download
memory/2848-169-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2848-172-0x0000000001660000-0x000000000258F000-memory.dmp

Filesize
15.2MB

Download
memory/2848-196-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2848-174-0x0000000001660000-0x000000000258F000-memory.dmp

Filesize
15.2MB

Download
memory/2848-173-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/2848-155-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3080-230-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3080-256-0x0000000001660000-0x000000000258F000-memory.dmp

Filesize
15.2MB

Download
memory/3080-244-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3080-243-0x0000000001660000-0x000000000258F000-memory.dmp

Filesize
15.2MB

Download
memory/3080-240-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3080-231-0x0000000001660000-0x000000000258F000-memory.dmp

Filesize
15.2MB

Download
memory/3080-290-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3080-292-0x0000000000400000-0x0000000001654000-memory.dmp

Filesize
18.3MB

Download
memory/3952-286-0x0000000000260000-0x000000000028D000-memory.dmp

Filesize
180KB

Download
memory/4160-271-0x0000000001CB0000-0x0000000001CB1000-memory.dmp

Filesize
4KB

Download
memory/5116-154-0x0000000004190000-0x00000000050BF000-memory.dmp

Filesize
15.2MB

Download
memory/5116-153-0x0000000004190000-0x00000000050BF000-memory.dmp

Filesize
15.2MB

Download