guloader | hxxps://jecvsdiolkjsdkm[.]sa[.]com/Collumelliaceous[.]7z

Analysis

max time kernel
208s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/01/2024, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://jecvsdiolkjsdkm.sa.com/Collumelliaceous.7z
Sample240119-mfgb1acff9

Score

10^/10

guloader nanocore downloader keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

ndichinnenanna0110.ddns.net:6839
nworkforcedichinnenanna0110.ddns.net:6839

Mutex

03f0dee0-ca0f-4d70-a8c7-b9621fb8d202

Attributes

activate_away_mode
true
backup_connection_host
nworkforcedichinnenanna0110.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2023-10-29T15:26:15.609440536Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
6839
default_group
WOEKFORCE
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
03f0dee0-ca0f-4d70-a8c7-b9621fb8d202
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
ndichinnenanna0110.ddns.net
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 5 IoCs

pid	Process
972	Collumelliaceous.exe
2816	Collumelliaceous.exe
4468	Collumelliaceous.exe
2380	Collumelliaceous.exe
3884	Collumelliaceous.exe

Loads dropped DLL 25 IoCs

pid	Process
972	Collumelliaceous.exe
972	Collumelliaceous.exe
972	Collumelliaceous.exe
972	Collumelliaceous.exe
972	Collumelliaceous.exe
2816	Collumelliaceous.exe
2816	Collumelliaceous.exe
2816	Collumelliaceous.exe
2816	Collumelliaceous.exe
2816	Collumelliaceous.exe
4468	Collumelliaceous.exe
4468	Collumelliaceous.exe
4468	Collumelliaceous.exe
4468	Collumelliaceous.exe
4468	Collumelliaceous.exe
2380	Collumelliaceous.exe
2380	Collumelliaceous.exe
2380	Collumelliaceous.exe
2380	Collumelliaceous.exe
2380	Collumelliaceous.exe
3884	Collumelliaceous.exe
3884	Collumelliaceous.exe
3884	Collumelliaceous.exe
3884	Collumelliaceous.exe
3884	Collumelliaceous.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\stertorious\Platefuls.Til207	Collumelliaceous.exe
File opened for modification	C:\Windows\SysWOW64\stertorious\Platefuls.Til207	Collumelliaceous.exe
File opened for modification	C:\Windows\SysWOW64\pi.for	Collumelliaceous.exe
File opened for modification	C:\Windows\SysWOW64\stertorious\Platefuls.Til207	Collumelliaceous.exe
File opened for modification	C:\Windows\SysWOW64\pi.for	Collumelliaceous.exe
File opened for modification	C:\Windows\SysWOW64\stertorious\Platefuls.Til207	Collumelliaceous.exe
File opened for modification	C:\Windows\SysWOW64\pi.for	Collumelliaceous.exe
File opened for modification	C:\Windows\SysWOW64\stertorious\Platefuls.Til207	Collumelliaceous.exe
File opened for modification	C:\Windows\SysWOW64\pi.for	Collumelliaceous.exe
File opened for modification	C:\Windows\SysWOW64\pi.for	Collumelliaceous.exe

Suspicious use of NtCreateThreadExHideFromDebugger 3 IoCs

pid	Process
2640	msbuild.exe
1404	msbuild.exe
1104	msbuild.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
972	Collumelliaceous.exe
2640	msbuild.exe
2816	Collumelliaceous.exe
1404	msbuild.exe
2380	Collumelliaceous.exe
1104	msbuild.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 972 set thread context of 2640	972	Collumelliaceous.exe	116
PID 2816 set thread context of 1404	2816	Collumelliaceous.exe	123
PID 2380 set thread context of 1104	2380	Collumelliaceous.exe	128

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\sponsoredes.bev	Collumelliaceous.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	dw20.exe
File opened for modification	C:\Windows\sponsoredes.bev	Collumelliaceous.exe
File opened for modification	C:\Windows\sponsoredes.bev	Collumelliaceous.exe
File opened for modification	C:\Windows\sponsoredes.bev	Collumelliaceous.exe
File opened for modification	C:\Windows\sponsoredes.bev	Collumelliaceous.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Collumelliaceous.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Collumelliaceous.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1836	msedge.exe
1836	msedge.exe
4192	identity_helper.exe
4192	identity_helper.exe
4316	msedge.exe
4316	msedge.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4404	7zFM.exe
4468	Collumelliaceous.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
972	Collumelliaceous.exe
2816	Collumelliaceous.exe
2380	Collumelliaceous.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeRestorePrivilege	4404	7zFM.exe
Token: 35	4404	7zFM.exe
Token: SeSecurityPrivilege	4404	7zFM.exe
Token: SeRestorePrivilege	2692	dw20.exe
Token: SeBackupPrivilege	2692	dw20.exe
Token: SeBackupPrivilege	2692	dw20.exe
Token: SeBackupPrivilege	2692	dw20.exe
Token: SeBackupPrivilege	2692	dw20.exe
Token: SeSecurityPrivilege	4404	7zFM.exe
Token: SeSecurityPrivilege	4404	7zFM.exe
Token: SeSecurityPrivilege	4404	7zFM.exe
Token: SeSecurityPrivilege	4404	7zFM.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe
4404	7zFM.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe
1836	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1836 wrote to memory of 4444	1836	msedge.exe	47
PID 1836 wrote to memory of 4444	1836	msedge.exe	47
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 652	1836	msedge.exe	89
PID 1836 wrote to memory of 1852	1836	msedge.exe	87
PID 1836 wrote to memory of 1852	1836	msedge.exe	87
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88
PID 1836 wrote to memory of 3176	1836	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://jecvsdiolkjsdkm.sa.com/Collumelliaceous.7z
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ba5046f8,0x7ff8ba504708,0x7ff8ba504718
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Collumelliaceous.7z"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4404
- - C:\Users\Admin\AppData\Local\Temp\7zO43162487\Collumelliaceous.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO43162487\Collumelliaceous.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: MapViewOfSection
    PID:972
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO43162487\Collumelliaceous.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2640
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        
        dw20.exe -x -s 1912
        5⤵
        Drops file in Windows directory
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:2692
- - C:\Users\Admin\AppData\Local\Temp\7zO431A3508\Collumelliaceous.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO431A3508\Collumelliaceous.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: MapViewOfSection
    PID:2816
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO431A3508\Collumelliaceous.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1404
- - C:\Users\Admin\AppData\Local\Temp\7zO43153228\Collumelliaceous.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO43153228\Collumelliaceous.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\7zO431D8979\Collumelliaceous.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO431D8979\Collumelliaceous.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: MapViewOfSection
    PID:2380
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\msbuild.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO431D8979\Collumelliaceous.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1104
- - C:\Users\Admin\AppData\Local\Temp\7zO431E3499\Collumelliaceous.exe
    "C:\Users\Admin\AppData\Local\Temp\7zO431E3499\Collumelliaceous.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,6340082618963738925,10772951140369677468,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3572

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4352

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
Size 717B
SHA256 c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8
MD5 60fe01df86be2e5331b0cdbe86165686
SHA1 2a79f9713c3f192862ff80508062e64e8e0b29bd
SHA512 ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23
MD5 SHA1 SHA512

Submit Download

A6F919C353E5383B541AE005B56FC846

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A6F919C353E5383B541AE005B56FC846
Size 503B
SHA256 b5f9d7dc0fb63d465f55c9e770743ed61a34e98c730ecf5e607eb416f76e367b
MD5 1e5be645a5001b72822005c473466aad
SHA1 6411572d3cc895047e2ef2c54fde6d34231b8d53
SHA512 23f662ff21e78b71c34cfb69c83de124d71643903945dbb5be94d81229e404dddbeb0a8c095d45707fceb69c1e6a30e9ac5c7f47e36b2516622f57e1303bdcfb
MD5 SHA1 SHA512

Submit Download

103621DE9CD5414CC2538780B4B75751

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Size 192B
SHA256 9b66521404bcd6e512c89ab626c859f78ad4b1374c1f6ac6a3b9a39e09e0c9ff
MD5 4c0f47f50c4fb419241442040f4225fe
SHA1 0ca80bee20951b070634435723bc350e2220740b
SHA512 adf3fa30cbdf3d8d4fa71d5c6335c3c3886ddd5576e3d99ffc7537509df2a9dfbd28adaf8b32914cbc860e6b6b1ddf0de0f395e4c6116b2a47df5a6cb1ff4449
MD5 SHA1 SHA512

Submit Download

A6F919C353E5383B541AE005B56FC846

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A6F919C353E5383B541AE005B56FC846
Size 556B
SHA256 7ada2624c5215df37ae10278a3a3d0f4efd2ffc3adc70a606e988d538d703dd9
MD5 220eede57cf1d263744897b103f4c6e4
SHA1 4b56552c3b1713d447fe74d92cb9d27ce6ea6933
SHA512 d6a4ec62572e7cbb81548e33c682672c857e94bbd29a00431be16a4df84b95cafd77c55123e3c8dba0c398c08e3ef80b87fbd2f8fc1ba3fa1e414a7393306b17
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11
MD5 5e77545b7e1c504b2f5ce7c5cc2ce1fe
SHA1 d81a6af13cf31fa410b85471e4509124ebeaff7e
SHA512 cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 46879a73d37cb97b62b81bdb3a4524f2cbd9c26ccda25befe962da5f67ba4fae
MD5 ef33881ba2b3639428fb782cf6cc5547
SHA1 7bd7dd43bc859eba5f5f266e91d64c5545e707f7
SHA512 ef5c10ec391305b0491e2375482a493cc6feef34861555183cd907ec6d9cc15f5e50ed9bd66748c81df3f602f724b304d255beeb3a5bb8caffbfa1f61e757ff0
SSDEEP 96:naak8sQjqu1HhnswpvWMoiVmdeHTMCtUWQyV+VD7AiEwb:nTku5mGWMXHrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 99773bd1f521b1cc4d0e9cc56f122b5ab7c625dc20516b9b7c5066f931d0480c
MD5 17428a012e5bc9e7477361a080597275
SHA1 9cc52c3bf6310aa9b003ce5bf360239f5fbeedaa
SHA512 c7005b34d01d649f63c50931d3b8ddb414b51c4c7f12df3bb87a823a060765a311230330fd0112b72cc566cba5443e07dbd42bcd006eb30b970bc67a49fa01b0
SSDEEP 96:nawkSqu1HhnswpvWMoiVmdeHTMuUWQyV+VDCzia:n5kk5mGWMXrrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4
MD5 6db2d2ceb22a030bd1caa72b32cfbf98
SHA1 fe50f35e60f88624a28b93b8a76be1377957618b
SHA512 d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912
SSDEEP 768:nYXexSxWTfbn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqELl200zRrUNe/:nYXexSxWTfbnu1jaDELMZzaNS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e501d69f94cb5f9abe684a3ee91da10ccdb455d58e1c400989eb51511875e826
MD5 7a6051899a80ee5ac7108c3fc54f12d7
SHA1 6ded3d022bb9b95d1f3b5e7bf5e8c2e7d2ce66f9
SHA512 1ac9646c81ba7b380e827553c739ed688a80945dedf42b1cfb578bdba492a460f3a84e907d19bd491a1965ec8e31955109cbaf41d3db0487718a69160bded4ed
SSDEEP 192:LoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupHT0e2RUARbChBRHdCnR7DV:79iIxuERzA83h09RZxYmihBBcnZDV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Collumelliaceous.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO43153228\Collumelliaceous.exe
Size 348KB
SHA256 7c84e82d8f6e859a0cf4be0d599c1aaccd62dcb4bfac2020c1d0cf37ec79fef1
MD5 b8b8da4c83b961480c78ef89d8f01d0f
SHA1 9378b54d33d60ca89ae73179468d4a5eb90c8255
SHA512 f4f6b431bb3fd31b4a4bebec800450e0a00e54bdbe792e64c028b9023a3dd0dee07ea187483c667366cad49f199a25b69a33c27499ff48f61d6f4d97450479e7
SSDEEP 6144:obE/HUl94mhaTdoF2c5OoBDqScgQF4iPXEziM8HvZYAgBJyJr85X6JUrKWU3SQVW:obwbRo1OoBoOn8/OJyJ85KJxWsSQtqlB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Collumelliaceous.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO43153228\Collumelliaceous.exe
Size 239KB
SHA256 382ab8726d091e867c14d7df752982a9afb2aa555b89c7e2dcab58da96ff39eb
MD5 746d7c439778e765cc6034aedfdfd662
SHA1 8d8967d1c4692429331126f5795122a020526ecb
SHA512 469c130d3a1a4896a5e520ff49b64b963f22950c03363d3ac17f51604a1ea6a45f6175dd8df3009b9c4dbc697e13b796dceeffd09e580920bd902928dff41968
SSDEEP 6144:obE/HUl94mhaTdoF2c5OoBDqScgQF4iPXEziM8HvZYAgBJyJr85V:obwbRo1OoBoOn8/OJyJ85V
MD5 SHA1 SHA512 SSDEEP

Submit Download

Collumelliaceous.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO43162487\Collumelliaceous.exe
Size 540KB
SHA256 64985d399657dc969e47de6e8d3ece75bdf8309921d414155f29c8989e806d79
MD5 c58b6b9a4c353e166e274d3ea0a0d061
SHA1 1bfccd67f30565b6088d5f01b3290e3e7b12e169
SHA512 f672cd7a8caab3e549c3eb9246d3faabe99a27303ac559a6a97120777cb0413206e336c7285282101f68dd7ca86bb96ad620bdeae21fb7898ad445709b29256d
SSDEEP 12288:obwbRo1OoBoOn8/OJyJ85KJxWsSQtqlLOpeUE1nVM9+4L:obwjoBoOn8/Oa85KJxWpeeS9+S
MD5 SHA1 SHA512 SSDEEP

Submit Download

Collumelliaceous.exe

Path C:\Users\Admin\AppData\Local\Temp\7zO431D8979\Collumelliaceous.exe
Size 122KB
SHA256 7a0917cf1a096ab986e48095baaa110da16a41d010efd739369b8fabf2abd45a
MD5 11a2d12f2bbb12a087accc954b1b3c30
SHA1 295d1d000e339254ca2de98a7abeca2ce46f870d
SHA512 57919fa92f2d88c99a4bf1377652f6b3381e98641fe83ec6aff9145d7127945a7fe022878c6600003d018552e6895c7bc102c24020d94b86111802c8bda8d57f
SSDEEP 3072:obG7N2kDTHUpoud8IFsbmKRAPXjeqPUdQpFmRcvROoBio+CdDYZSNDbk:obE/HUl94mhaTdoF2c5OoBDqSu
MD5 SHA1 SHA512 SSDEEP

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb954C.tmp\LangDLL.dll
Size 5KB
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsb954C.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

chefdelegeredes.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\chefdelegeredes.lnk
Size 980B
SHA256 a473f4392054991ace4ec2f6de3a813edfce08ffbe5853ebbd28e90afbeb9948
MD5 634675346e0fe36a5dd48fa87ca1934b
SHA1 d1a323a8260492772f62b4d462063c12a14412b0
SHA512 8356eb33ec643f87fe420cb1a97de6a9ebf0e0f5a7908284924ef76b2e6b69c50ddc466ba8d765a7bb3d458a1dad3539712dd891b3b0fe35d2e0c8265f5a1934
MD5 SHA1 SHA512

Submit Download

Collumelliaceous.7z

Path C:\Users\Admin\Downloads\Collumelliaceous.7z
Size 520KB
SHA256 7b973e2dc2a324d2729ccde0fddabf9f5458f5c9bf3d8093b4447c1f4d76d911
MD5 def2f54ac7a3360dfda60def472ff082
SHA1 b3dbe756cfd2f422f4416af4892f0ca5a2c7b4fd
SHA512 334b2e4adc6c75abedc3daebd08a960346930f568e9f0b1ebf1110a06b01d2906e1ab35492235f1e7919b721de65c91e2a1e1cae086a87a47527604825cc10c5
SSDEEP 12288:7Q428/OoBRnn8HOJGyT5odxWs9QtjlMHqLUE1nVMU9Cd:M4aoBRnn8HO9T5odxWxLLSom
MD5 SHA1 SHA512 SSDEEP

Submit Download

Counterguard.fde

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\Counterguard.fde
Size 64KB
SHA256 cc95560f29837642ee32e2ad029400751aa2a4cc18e7adfaf0a89bb1a8cfea62
MD5 937f78bdd8d3030a67c7ab427b3d36f3
SHA1 353a3dd3dcda35640590a56b966b3d885afd47d7
SHA512 b6ba8e72cee2f83b7f6768b2df1c16229d2afe4c76ccc19d0b0e68d60c124fa3ac2be482733c8786b569ddad67510aea6fa104959fc5dbd58850740c4d1b56d9
SSDEEP 384:CtWYfSefLpkmaKtYwerBHmLyytRDWekfqkv3tA/Ln6r9mua4jPMTBMHr:CJ6HaKfg6ba4zMTI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Snoningsapparatets52.rat

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\Snoningsapparatets52.rat
Size 285KB
SHA256 333c923ebcaa0d4befde330a39ef711cc12745244cedd34565ea20c6755e2ded
MD5 4783a4ee6b15da1664f13a47735c5a04
SHA1 4ab7dfd2a926d7a15e054375e525886167e5610d
SHA512 ed455ac42ebe7edb05fd52b673baabc3d8223bda58ffd904223f64ceea10806ed2e4499780aecebd25f49032c497b09a7cbd4547e7f9bd28b19fc41446b475c0
SSDEEP 768:W5ezX0UkRrFX46THeX2ddb8HqWIAidPwNdnDcS9sGoohvlYel/yempIoNtVNQZK8:GJBeHiuuXQIlf+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tergiversated33.ove

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\Tergiversated33.ove
Size 251KB
SHA256 62d7666a68aa7487bb32b344c40e383a41525b967c2bdc5e14ee9bb93bd992e9
MD5 d589fcd69b4cda50f8e0db2ab901858e
SHA1 c8125d9a1885c96189d3f36248909e49615be81d
SHA512 b9e720d0679e882ab71a858712f07bb7e627372564feff10a250ec4d974c1e40f8c06a989890426c6a9d497027438d002859afd0b9ff858f12dddea5540530a7
SSDEEP 768:PkT4BpemMlJJ+bf+6KuQP2khA8WBxpanYnLMtzttqZxDNqwwSt1bxPW2pOs7h3pR:Gi8Qp0MzTrH7sk6i
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tergiversated33.ove

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\Tergiversated33.ove
Size 144KB
SHA256 614edf00ba28bfd7ed4e28bed403530ac3d227c97e87b4808d0d981c73577878
MD5 5d0eb9101c8e4bf3f4accfb42f2e9b2b
SHA1 9b1cc546ecc9e5dc69d52fb352caed578c692a0d
SHA512 3115250509c7ecfa9443736d9012feba4892a6e6dfaeb355cf5335c52ac57c174366a2dcc930396123ae184c892c048c2a74ad68a3e61988d73d42f75736275f
SSDEEP 768:PkT4BpemMlJJ+bf+6KuQP2khA8WBxpanYnLMtzttqZxDNqww:Gi8Qp0Mz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vejrberetningers.txt

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\Vejrberetningers.txt
Size 401B
SHA256 fd588d0f8005fb059f1239ab7d6b6622127608555560911ea22ae112b5654bd7
MD5 01f8bb44f61e34a61e1b1c20a85ceb4c
SHA1 96379273e7c4427061eb1bffcc95ffb33899c3f7
SHA512 c315cc5840b8ed66e4fd0194b3ba75347d05f9c8862eca10cd680dae5111c36e8c2a5f17a532eff33b53a14259e712131a00956a0ee3237d1328fa3cba987f89
MD5 SHA1 SHA512

Submit Download

camisoles.und

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\camisoles.und
Size 207KB
SHA256 3d9fc7c886064380e028c737a3ddfc22863e40791ea54f5716d9496545aac122
MD5 206a0aab08f567cab67e853048242dae
SHA1 d9e99954b2ccba6e05ab41342a26abbb170672e8
SHA512 d7ffe0a3baf18126f3ee4e78ef2e1971dd0716410f5f5201294bebccd34e0a75e2731985e39e314183410ed42c12d26ee834bfc80a2cd8a1e65e07c534dda8b9
SSDEEP 768:bvvMCcZAuQNFRNZZxyu2QTIqvyg8qkP5ysW+ttz9qbs3ma/D3+ZWXyr:bdxVrKgiwzez9BU
MD5 SHA1 SHA512 SSDEEP

Submit Download

camisoles.und

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\camisoles.und
Size 71KB
SHA256 61530e759114020cdb34f9e7d381999966b6f52acf70e150a52b6f84a99644c0
MD5 02b13accd9b378d56d99a65d7cf17adc
SHA1 f6e137c0c6f208c607503f375087307f5d225e7b
SHA512 23b1b03d2f492c8daae565f7bf668182c40e210e6d8e37c717bf257dea6d6be3d911305a56f00a7f4319c89e2702468bd0bda94034f0c0cc1ebe23390196c793
SSDEEP 384:uSqkKsrg8EOMuNpedNlNg1SAi3zd1pqcqFuyZMW97iaxyXeRRmMm75eRf4:bvvMCcZAuQNFRNZZxyu2Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

fattigfin.sud

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\fattigfin.sud
Size 131KB
SHA256 98aecde8d732a88d7325330cb263a46ff07a9b97698d76631f3eb51a37813dc4
MD5 1750b19b7c90f95460c6feebb16a1729
SHA1 add100d595e0926a8e29d0278f25205337768b8e
SHA512 4fd9b8e3c8e10fd5e512f7cba3377cc80412188cc576741ee97fe2d622d1f592eb3aee24b535084ab0fee71ce44053b00435e6e1c8ef6d37dbefbf609b680e24
SSDEEP 768:Mu+HTd563QANsJcMD6ujhNg50y6nSAIXgT/Naa9vyI:wLA2FbP
MD5 SHA1 SHA512 SSDEEP

Submit Download

fattigfin.sud

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\fattigfin.sud
Size 73KB
SHA256 6ae6373d7ce2fddf35ab7790e8029f13cce53e8c54cffd410be4c91947f40b13
MD5 bee4591ea6ed65926e46c2d2cef8bf60
SHA1 b7bfc0ab5d1bd85a2151252cd59d1cf0e91072af
SHA512 e0c2a1bdce53111a7f72c1f722fc26715f75047fd19f5df02525520a1aaf8c77a2c36ba7489eec41c42d5adfd6e00f92bf87a6e4f3ead9c6279db1755e271ff4
SSDEEP 384:e5W/lWNuY0omolmOO6vqU+nnY6YAspR2zhsJRee9BcM:Mu+HTd563QANsJcM
MD5 SHA1 SHA512 SSDEEP

Submit Download

frostsikr.str

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\frostsikr.str
Size 264KB
SHA256 bc111b69f0cc95549046096776b937a263aa21a6c7b26dc6250008f295c1f62f
MD5 628e3ea84c330d2e640eecc24578695d
SHA1 d52380e7f5e6c0eb2049121701cc6e0663e35bd1
SHA512 d083d47ce94d7052506369a22024ec83857a5c32968edc30d76bec50242c00b082f9c09094cb697ca75f37ef3f19d249e2ae0b77bd5deb971a01af67ebea9581
SSDEEP 768:+rJt1H0SzWnr8VzR2guVijDOhA7b6Td7sAYqC+UgbgTt7RpEY0xJqFxLCIXupHWZ:w3op77y0S3Xt1m90lo
MD5 SHA1 SHA512 SSDEEP

Submit Download

frostsikr.str

Path C:\Users\Admin\profited\trende\terosen\Pantry\Nikolai171\medieforskernes\frostsikr.str
Size 50KB
SHA256 ced6395690200efbc880b68bfbe830324c07ad5608dbefdbd0f993b7efcc61e8
MD5 32c364f8b48c60dea46f6ee4cc2f5c5b
SHA1 d41b87329eaca906bc048306379e371b88d5ccd9
SHA512 37e45b18d5fca181edf06b176957208a465926f2ca72b6e136eacc4c68f7e680544cd1b73d3710e312b64758d757b451bb349310dfcfb4ac12bc536f85b6ea49
SSDEEP 384:+rz3XRGbst0M2YmkzMpzefG+NujP4KtnxkTe8R:+rJt1H0SzWnr8
MD5 SHA1 SHA512 SSDEEP

Submit Download

kontorchefernes.bje

Path C:\Users\Admin\profited\trende\terosen\kontorchefernes.bje
Size 49KB
SHA256 b584d7b83bce59441013674b901cc05b0825c81d054b42715e9ec4a0ffee03ec
MD5 19b6088dc89a95845c67fbe1fb21f5f7
SHA1 2d9a66f22dba61e8c321b89b7ec908b420277b9c
SHA512 9c1895dbf41869d8de9c58ec652605cab43d2cd39e0d6947e7ffcbc6b0ddc725e990e921a7a9d94d176d737978350ab6adead5b6f69fa4546d9735edffc02d53
SSDEEP 384:WqcfkmgbdetNqZmfYYp/qiEa6WEMM9Z2XLmY:+kAtgZdYp/quc+X6
MD5 SHA1 SHA512 SSDEEP

Submit Download

zappiest.sel

Path C:\Users\Admin\profited\trende\terosen\zappiest.sel
Size 95KB
SHA256 baead6f6152dd9160f694f3afc7a9f348d02c566bbbbca2b565f3b966950d361
MD5 339e39092a4b3fb94b9ecd5bb2996376
SHA1 e08042f69cd60513f7748a49b2284fca3bee95e5
SHA512 759150e6b4f71c73927bb3cfb97cbafec81eea3b345e6e9bf60a04f5da7f9112e0c250ef8dafb33212cdb53a979f785a1aea7ed7ded2088208ab4e08beef68ca
SSDEEP 384:eyjZnvIr0AWXXODPBXYuwlrs86zRrbQYNAiPT7nRNAPi8ZLuCzMK7zWEJ7BMa1MD:ecwoAWOVAVmtA67F4/7aE9SBJXFOQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zappiest.sel

Path C:\Users\Admin\profited\trende\terosen\zappiest.sel
Size 72KB
SHA256 60d5650b567af35c6cd4dec10cbf5c50d6fd31b1847de71e416088c5e3dd7f62
MD5 345bd566b9b21744b16f618953fdbe1d
SHA1 05d5dc9dc25ba21c85757c399afcbf7373f308e5
SHA512 e9e7dcf81b92eb53bfebe7759e7d365443a2d3775c30c38442b5bc2f9ed6cd9014a4fd71077a9bfc68cb235d351e6e96d7e87d6664acfd2901ed82e53d92af4e
SSDEEP 384:eyjZnvIr0AWXXODPBXYuwlrs86zRrbQYNAiPT7nRNAPi8ZLuCzMKE:ecwoAWOVAVmtA67F4/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/972-348-0x0000000073940000-0x0000000073947000-memory.dmp

Download

memory/972-337-0x0000000004340000-0x0000000005A38000-memory.dmp

Download

memory/972-347-0x0000000076E81000-0x0000000076FA1000-memory.dmp

Download

memory/972-352-0x0000000004340000-0x0000000005A38000-memory.dmp

Download

memory/1104-1469-0x00000000009C0000-0x00000000020B8000-memory.dmp

Download

memory/1104-1466-0x0000000072640000-0x0000000073894000-memory.dmp

Download

memory/1104-1464-0x00000000009C0000-0x00000000020B8000-memory.dmp

Download

memory/1404-920-0x0000000000B80000-0x0000000002278000-memory.dmp

Download

memory/1404-926-0x00000000726D0000-0x0000000073924000-memory.dmp

Download

memory/1404-929-0x0000000000B80000-0x0000000002278000-memory.dmp

Download

memory/2380-1207-0x0000000004200000-0x00000000058F8000-memory.dmp

Download

memory/2380-1465-0x0000000004200000-0x00000000058F8000-memory.dmp

Download

memory/2380-1463-0x0000000073940000-0x0000000073947000-memory.dmp

Download

memory/2640-364-0x0000000071280000-0x0000000071831000-memory.dmp

Download

memory/2640-365-0x0000000000AA0000-0x0000000000AB0000-memory.dmp

Download

memory/2640-361-0x00000000726E0000-0x0000000073934000-memory.dmp

Download

memory/2640-354-0x0000000076F25000-0x0000000076F26000-memory.dmp

Download

memory/2640-353-0x0000000076F08000-0x0000000076F09000-memory.dmp

Download

memory/2640-363-0x0000000071280000-0x0000000071831000-memory.dmp

Download

memory/2640-349-0x0000000000B10000-0x0000000002208000-memory.dmp

Download

memory/2640-374-0x0000000000B10000-0x0000000002208000-memory.dmp

Download

memory/2640-373-0x0000000071280000-0x0000000071831000-memory.dmp

Download

memory/2640-375-0x0000000076E81000-0x0000000076FA1000-memory.dmp

Download

memory/2816-921-0x0000000004200000-0x00000000058F8000-memory.dmp

Download

memory/2816-919-0x0000000073940000-0x0000000073947000-memory.dmp

Download

memory/2816-650-0x0000000004200000-0x00000000058F8000-memory.dmp

Download

memory/4468-918-0x0000000004200000-0x00000000058F8000-memory.dmp

Download