Malware Analysis Report

2024-10-19 02:06

Sample ID 220706-w5rnpsfghm
Target ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.zip
SHA256 7513d19dab3fc25a8276ec33132b9114856e01c67c90dbd0318c7aa6dc2b3561
Tags
colibri build1 loader persistence suricata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7513d19dab3fc25a8276ec33132b9114856e01c67c90dbd0318c7aa6dc2b3561

Threat Level: Known bad

The file ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.zip was found to be: Known bad.

Malicious Activity Summary

colibri build1 loader persistence suricata

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

suricata: ET MALWARE Generic gate .php GET with minimal headers

Colibri Loader

suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

suricata: ET MALWARE Win32/Colibri Loader Activity M2

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Win32/Colibri Loader Activity

suricata: ET MALWARE Win32/Colibri Loader Activity M3

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-06 18:30

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-06 18:30

Reported

2022-07-06 18:33

Platform

win7-20220414-en

Max time kernel

36s

Max time network

40s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe

"C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe"

Network

N/A

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-06 18:30

Reported

2022-07-06 18:33

Platform

win10v2004-20220414-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe"

Signatures

Colibri Loader

loader colibri

suricata: ET MALWARE Generic gate .php GET with minimal headers

suricata

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata

suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

suricata

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

suricata

suricata: ET MALWARE Win32/Colibri Loader Activity

suricata

suricata: ET MALWARE Win32/Colibri Loader Activity M2

suricata

suricata: ET MALWARE Win32/Colibri Loader Activity M3

suricata

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Service = "C:\\ProgramData\\MsDrvSrvc.exe" C:\Users\Admin\AppData\Local\Temp\signed.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cloudwindrar-System-API = "C:\\ProgramData\\sfsxzipper\\cloudwindrar.exe" C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Users\Admin\AppData\Local\Temp\signed.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\signed.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\signed.exe N/A
N/A N/A C:\ProgramData\MsDrvSrvc.exe N/A
N/A N/A C:\ProgramData\MsDrvSrvc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\sfsxzipper\cloudwindrar.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\sfsxzipper\cloudwindrar.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3116 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe C:\Windows\SysWOW64\schtasks.exe
PID 3116 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe C:\Windows\SysWOW64\schtasks.exe
PID 3116 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe C:\Windows\SysWOW64\schtasks.exe
PID 3116 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
PID 3116 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
PID 3116 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
PID 2708 wrote to memory of 4816 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
PID 2708 wrote to memory of 4816 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
PID 2708 wrote to memory of 4816 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe
PID 4396 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe C:\Users\Admin\AppData\Local\Temp\signed.exe
PID 4396 wrote to memory of 2260 N/A C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe C:\Users\Admin\AppData\Local\Temp\signed.exe
PID 2260 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\signed.exe C:\ProgramData\MsDrvSrvc.exe
PID 2260 wrote to memory of 4436 N/A C:\Users\Admin\AppData\Local\Temp\signed.exe C:\ProgramData\MsDrvSrvc.exe
PID 4396 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe C:\Users\Admin\AppData\Local\Temp\mnr.exe
PID 4396 wrote to memory of 4520 N/A C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe C:\Users\Admin\AppData\Local\Temp\mnr.exe
PID 4520 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4520 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe C:\Windows\SYSTEM32\schtasks.exe
PID 4520 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe C:\ProgramData\sfsxzipper\cloudwindrar.exe
PID 4520 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe C:\ProgramData\sfsxzipper\cloudwindrar.exe
PID 4520 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe C:\Windows\system32\cmd.exe
PID 4520 wrote to memory of 3436 N/A C:\Users\Admin\AppData\Local\Temp\mnr.exe C:\Windows\system32\cmd.exe
PID 3436 wrote to memory of 2908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe
PID 3436 wrote to memory of 2908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe

"C:\Users\Admin\AppData\Local\Temp\ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae.exe"

C:\Windows\SysWOW64\schtasks.exe

/create /tn COMSurrogate /st 00:00 /du 9999:59 /sc once /ri 1 /f /tr "powershell.exe -windowstyle hidden"

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe

"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -windowstyle hidden

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe

"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe" Name host ValueOnly True

C:\Users\Admin\AppData\Local\Temp\signed.exe

"C:\Users\Admin\AppData\Local\Temp\signed.exe"

C:\ProgramData\MsDrvSrvc.exe

"C:\ProgramData\MsDrvSrvc.exe"

C:\Users\Admin\AppData\Local\Temp\mnr.exe

"C:\Users\Admin\AppData\Local\Temp\mnr.exe"

C:\Windows\SYSTEM32\schtasks.exe

"schtasks.exe" /create /tn cloudwindrar-System-API /tr "C:\ProgramData\sfsxzipper\cloudwindrar.exe" /st 20:37 /du 23:59 /sc daily /ri 1 /f

C:\ProgramData\sfsxzipper\cloudwindrar.exe

"C:\ProgramData\sfsxzipper\cloudwindrar.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9441.tmp.bat""

C:\Windows\system32\timeout.exe

timeout 6

Network

Country Destination Domain Proto
US 8.8.8.8:53 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc udp
FI 65.108.213.210:80 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc tcp
FI 65.108.213.210:80 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc tcp
RU 176.124.204.171:8000 176.124.204.171 tcp
US 8.248.21.254:80 tcp
US 8.248.21.254:80 tcp
IE 13.69.239.72:443 tcp
US 8.248.21.254:80 tcp
US 8.248.21.254:80 tcp
US 8.248.21.254:80 tcp
FI 65.108.213.210:80 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc tcp
RU 176.124.204.171:8000 176.124.204.171 tcp
US 8.8.8.8:53 servergame00000ytty.serveminecraft.net udp
FI 65.108.213.210:80 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc tcp
FI 65.108.213.210:80 zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc tcp

Files

memory/3116-130-0x000000007FE20000-0x000000007FE27000-memory.dmp

memory/1956-131-0x0000000000000000-mapping.dmp

memory/4396-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe

MD5 5a8bc676cf03b77f3d81a2907119d4d5
SHA1 2114152d909c30d68af23c8526df2599c94d87cc
SHA256 ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae
SHA512 ee500b493c0062e69b2fa9d90ed0e5e64049aecddd37fdec19f36e6d5d8562dd6f5f2d5c32216061da640e09bf943a9f1c94777869dc7db260276becbed711db

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe

MD5 5a8bc676cf03b77f3d81a2907119d4d5
SHA1 2114152d909c30d68af23c8526df2599c94d87cc
SHA256 ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae
SHA512 ee500b493c0062e69b2fa9d90ed0e5e64049aecddd37fdec19f36e6d5d8562dd6f5f2d5c32216061da640e09bf943a9f1c94777869dc7db260276becbed711db

memory/3116-135-0x000000007FE20000-0x000000007FE27000-memory.dmp

memory/4396-136-0x000000007FAB0000-0x000000007FAB7000-memory.dmp

memory/2708-137-0x0000028055820000-0x0000028055842000-memory.dmp

memory/2708-138-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp

memory/2708-139-0x000002806F2C0000-0x000002806F304000-memory.dmp

memory/2708-140-0x000002806F5A0000-0x000002806F616000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Get-Variable.exe

MD5 5a8bc676cf03b77f3d81a2907119d4d5
SHA1 2114152d909c30d68af23c8526df2599c94d87cc
SHA256 ebd5e6832c0730fecf0e2aac1e13981601c5d089e75ad0833d95cc4b8dc04fae
SHA512 ee500b493c0062e69b2fa9d90ed0e5e64049aecddd37fdec19f36e6d5d8562dd6f5f2d5c32216061da640e09bf943a9f1c94777869dc7db260276becbed711db

memory/4816-141-0x0000000000000000-mapping.dmp

memory/4816-143-0x000000007EE80000-0x000000007EE87000-memory.dmp

memory/2708-144-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp

memory/2260-145-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\signed.exe

MD5 9216f18d38d88e8693c23522e5599233
SHA1 efa9f4a1f3bac7d47f1f87a7979cdbc041a24541
SHA256 73631825f61c5f3c30c79e2edbc164e378e38c82ee0047c3de4be4f979227701
SHA512 569cc6d1cf58932427e24f70a48f718e1ae00e9673ba3b206c4dc5cf22a727fd33ba1228fa97dd9ceed89212350c0125c112539e5c44506cc642a878150daed3

C:\Users\Admin\AppData\Local\Temp\signed.exe

MD5 9216f18d38d88e8693c23522e5599233
SHA1 efa9f4a1f3bac7d47f1f87a7979cdbc041a24541
SHA256 73631825f61c5f3c30c79e2edbc164e378e38c82ee0047c3de4be4f979227701
SHA512 569cc6d1cf58932427e24f70a48f718e1ae00e9673ba3b206c4dc5cf22a727fd33ba1228fa97dd9ceed89212350c0125c112539e5c44506cc642a878150daed3

memory/4436-148-0x0000000000000000-mapping.dmp

C:\ProgramData\MsDrvSrvc.exe

MD5 9216f18d38d88e8693c23522e5599233
SHA1 efa9f4a1f3bac7d47f1f87a7979cdbc041a24541
SHA256 73631825f61c5f3c30c79e2edbc164e378e38c82ee0047c3de4be4f979227701
SHA512 569cc6d1cf58932427e24f70a48f718e1ae00e9673ba3b206c4dc5cf22a727fd33ba1228fa97dd9ceed89212350c0125c112539e5c44506cc642a878150daed3

C:\ProgramData\MsDrvSrvc.exe

MD5 9216f18d38d88e8693c23522e5599233
SHA1 efa9f4a1f3bac7d47f1f87a7979cdbc041a24541
SHA256 73631825f61c5f3c30c79e2edbc164e378e38c82ee0047c3de4be4f979227701
SHA512 569cc6d1cf58932427e24f70a48f718e1ae00e9673ba3b206c4dc5cf22a727fd33ba1228fa97dd9ceed89212350c0125c112539e5c44506cc642a878150daed3

memory/4520-151-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\mnr.exe

MD5 1809e89d7914b9da7071b04d6aca57f3
SHA1 d005795761e1b53fa2495f290f64b699b3e8c189
SHA256 d5d3b50be1f0ba6f790adb1ca36f46133bd6878774bc6eac441be4db1b1c29c5
SHA512 0faa90d69699cf9bc54f269e40086c09ba745324e77975c715ea6be84e33b3bf4f2afe4b26a22c9c721fc1592974d0084484743daf09683ac65a80207c2b8554

C:\Users\Admin\AppData\Local\Temp\mnr.exe

MD5 1809e89d7914b9da7071b04d6aca57f3
SHA1 d005795761e1b53fa2495f290f64b699b3e8c189
SHA256 d5d3b50be1f0ba6f790adb1ca36f46133bd6878774bc6eac441be4db1b1c29c5
SHA512 0faa90d69699cf9bc54f269e40086c09ba745324e77975c715ea6be84e33b3bf4f2afe4b26a22c9c721fc1592974d0084484743daf09683ac65a80207c2b8554

memory/4520-154-0x00000000007B0000-0x00000000007E0000-memory.dmp

memory/4520-155-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp

memory/4756-156-0x0000000000000000-mapping.dmp

memory/3340-157-0x0000000000000000-mapping.dmp

C:\ProgramData\sfsxzipper\cloudwindrar.exe

MD5 1809e89d7914b9da7071b04d6aca57f3
SHA1 d005795761e1b53fa2495f290f64b699b3e8c189
SHA256 d5d3b50be1f0ba6f790adb1ca36f46133bd6878774bc6eac441be4db1b1c29c5
SHA512 0faa90d69699cf9bc54f269e40086c09ba745324e77975c715ea6be84e33b3bf4f2afe4b26a22c9c721fc1592974d0084484743daf09683ac65a80207c2b8554

C:\ProgramData\sfsxzipper\cloudwindrar.exe

MD5 1809e89d7914b9da7071b04d6aca57f3
SHA1 d005795761e1b53fa2495f290f64b699b3e8c189
SHA256 d5d3b50be1f0ba6f790adb1ca36f46133bd6878774bc6eac441be4db1b1c29c5
SHA512 0faa90d69699cf9bc54f269e40086c09ba745324e77975c715ea6be84e33b3bf4f2afe4b26a22c9c721fc1592974d0084484743daf09683ac65a80207c2b8554

memory/3436-160-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\tmp9441.tmp.bat

MD5 58c5d6c11263d0e6075d44d02c066e34
SHA1 f2cfc86fe0c2c59f4528e46a95df7826cf02f1c3
SHA256 7855783aa02e1db6b66681f58d2d02b525470f177040948336f14471a36f9ad4
SHA512 a85fd095b6c3bbce2391e96d766698caaf3773c11c4935bd86bbd47ba13c5cd97724e3b4a68f4504d65a24e8b5c2073420ced93b99717a28f0b5f81c14645e01

memory/2908-162-0x0000000000000000-mapping.dmp

memory/4520-163-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp

memory/3340-164-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp

memory/3340-165-0x00007FFDCF720000-0x00007FFDD01E1000-memory.dmp