xloader | 0cb70c2842d361eff4d971e809911969086a71824cc422f98cbc8b924713463f

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
Size 398KB
Sample240409-ta714aeh2x
SHA256 0cb70c2842d361eff4d971e809911969086a71824cc422f98cbc8b924713463f
MD5 ea5a7ad0dcd55d7835d3649b9dfcd51e
SHA1 cf6feba3fd6e5f0cf7cee84f4a216f33960e45db
SHA512 bff9e57c2344cf7e84e2545d8b5d82d16374eee9be5a705c0a6cb69979dbcb7c9a583b09799363f61362afa673d2c5a1180900222c84aaf2f5bca6f982218759
SSDEEP 12288:5TIl1db2YCs2vycBplnjzafiyr3uLWgbROehqa:5Kbh1uVyr3bgACB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xloader zgrat nins loader persistence rat

Malware Config

Extracted

Family

xloader

Version

Campaign

nins

Decoy

wingsmh.com
honeyconstructionmanagement.com
aizaibali.com
twelve11transportsllc.com
aadetermatology.com
sarahdewald.com
si-kap.online
imperiummetal.site
srysyoga.com
fbirelationship.com
drtracielashley.academy
jrgsestates.com
affordableseo.club
triggerfingerboards.com
halalmine.com
shopdogwoodhill.com
qad.info
nocraphere.com
misskarennglishteacher.com
march.wtf
carbontechco.com
pairtty.com
empossibility.com
modernish.net
casastortarestaurant.com
clemence-pierre.com
saniahreese.com
dragueuse.com
antiqueson3rd.com
lavarmy.club
best20bloggingplatorms.com
casadecarrico.com
ksfbx.com
linuxtechusa.com
iararueda.com
kjfashionstore.com
privatefuels.com
dentalmentalwellness.com
glowupistanbul.com
moremeafrica.com
the4relationships.com
baincot.com
sv8jlc.com
officecleanaustin.com
markscrystalclearwindows.com
madeleinesplacereviews.com
quietflyte.com
zwelopa.com
highticketfunnelhacks.com
zarrinkarimi.com
sonofmanbusiness.com
haliluyar.xyz
cailingji.com
quirkyowlstore.com
ikeedojoja.net
doublejdesigns.net
changingworldchallenge.com
narcadia.com
zhjinchina.com
houselfcontorl.com
gibdoz.com
glynisfloral.com
bumper-magnets.com
truckup.tech
sugene-proloser.icu

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/1744-52-0x0000000007510000-0x000000000757E000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-53-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-54-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-56-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-58-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-60-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-62-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-64-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-66-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-68-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-70-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-72-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-74-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-76-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-78-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-80-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-82-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-84-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-86-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-88-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-90-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-92-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-94-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-96-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-98-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-100-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-102-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-104-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-106-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-108-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-110-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-112-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-114-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1
behavioral2/memory/1744-116-0x0000000007510000-0x0000000007578000-memory.dmp	family_zgrat_v1

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Xloader payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/400-2180-0x0000000000400000-0x000000000042E000-memory.dmp	xloader
behavioral2/files/0x0008000000023205-2184.dat	xloader
behavioral2/memory/4616-2197-0x0000000000050000-0x0000000000079000-memory.dmp	xloader
behavioral2/memory/2508-2203-0x0000000000B10000-0x0000000000B39000-memory.dmp	xloader
behavioral2/memory/2508-2210-0x0000000000B10000-0x0000000000B39000-memory.dmp	xloader

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
4616	FB_D0D8.tmp.exe
804	FB_D388.tmp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\paint = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\paint\\paint.exe\""	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 4616 set thread context of 3464	4616	FB_D0D8.tmp.exe	56
PID 2508 set thread context of 3464	2508	colorcpl.exe	56

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3320	powershell.exe
3320	powershell.exe
1596	powershell.exe
1596	powershell.exe
1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
4616	FB_D0D8.tmp.exe
4616	FB_D0D8.tmp.exe
4616	FB_D0D8.tmp.exe
4616	FB_D0D8.tmp.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe
2508	colorcpl.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4616	FB_D0D8.tmp.exe
4616	FB_D0D8.tmp.exe
4616	FB_D0D8.tmp.exe
2508	colorcpl.exe
2508	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeIncreaseQuotaPrivilege	3320	powershell.exe
Token: SeSecurityPrivilege	3320	powershell.exe
Token: SeTakeOwnershipPrivilege	3320	powershell.exe
Token: SeLoadDriverPrivilege	3320	powershell.exe
Token: SeSystemProfilePrivilege	3320	powershell.exe
Token: SeSystemtimePrivilege	3320	powershell.exe
Token: SeProfSingleProcessPrivilege	3320	powershell.exe
Token: SeIncBasePriorityPrivilege	3320	powershell.exe
Token: SeCreatePagefilePrivilege	3320	powershell.exe
Token: SeBackupPrivilege	3320	powershell.exe
Token: SeRestorePrivilege	3320	powershell.exe
Token: SeShutdownPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeSystemEnvironmentPrivilege	3320	powershell.exe
Token: SeRemoteShutdownPrivilege	3320	powershell.exe
Token: SeUndockPrivilege	3320	powershell.exe
Token: SeManageVolumePrivilege	3320	powershell.exe
Token: 33	3320	powershell.exe
Token: 34	3320	powershell.exe
Token: 35	3320	powershell.exe
Token: 36	3320	powershell.exe
Token: SeIncreaseQuotaPrivilege	3320	powershell.exe
Token: SeSecurityPrivilege	3320	powershell.exe
Token: SeTakeOwnershipPrivilege	3320	powershell.exe
Token: SeLoadDriverPrivilege	3320	powershell.exe
Token: SeSystemProfilePrivilege	3320	powershell.exe
Token: SeSystemtimePrivilege	3320	powershell.exe
Token: SeProfSingleProcessPrivilege	3320	powershell.exe
Token: SeIncBasePriorityPrivilege	3320	powershell.exe
Token: SeCreatePagefilePrivilege	3320	powershell.exe
Token: SeBackupPrivilege	3320	powershell.exe
Token: SeRestorePrivilege	3320	powershell.exe
Token: SeShutdownPrivilege	3320	powershell.exe
Token: SeDebugPrivilege	3320	powershell.exe
Token: SeSystemEnvironmentPrivilege	3320	powershell.exe
Token: SeRemoteShutdownPrivilege	3320	powershell.exe
Token: SeUndockPrivilege	3320	powershell.exe
Token: SeManageVolumePrivilege	3320	powershell.exe
Token: 33	3320	powershell.exe
Token: 34	3320	powershell.exe
Token: 35	3320	powershell.exe
Token: 36	3320	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeIncreaseQuotaPrivilege	1596	powershell.exe
Token: SeSecurityPrivilege	1596	powershell.exe
Token: SeTakeOwnershipPrivilege	1596	powershell.exe
Token: SeLoadDriverPrivilege	1596	powershell.exe
Token: SeSystemProfilePrivilege	1596	powershell.exe
Token: SeSystemtimePrivilege	1596	powershell.exe
Token: SeProfSingleProcessPrivilege	1596	powershell.exe
Token: SeIncBasePriorityPrivilege	1596	powershell.exe
Token: SeCreatePagefilePrivilege	1596	powershell.exe
Token: SeBackupPrivilege	1596	powershell.exe
Token: SeRestorePrivilege	1596	powershell.exe
Token: SeShutdownPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeSystemEnvironmentPrivilege	1596	powershell.exe
Token: SeRemoteShutdownPrivilege	1596	powershell.exe
Token: SeUndockPrivilege	1596	powershell.exe
Token: SeManageVolumePrivilege	1596	powershell.exe
Token: 33	1596	powershell.exe
Token: 34	1596	powershell.exe
Token: 35	1596	powershell.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3464	Explorer.EXE

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3320	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	88
PID 1744 wrote to memory of 3320	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	88
PID 1744 wrote to memory of 3320	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	88
PID 1744 wrote to memory of 1596	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	97
PID 1744 wrote to memory of 1596	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	97
PID 1744 wrote to memory of 1596	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	97
PID 1744 wrote to memory of 1044	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	100
PID 1744 wrote to memory of 1044	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	100
PID 1744 wrote to memory of 1044	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	100
PID 1744 wrote to memory of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 1744 wrote to memory of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 1744 wrote to memory of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 1744 wrote to memory of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 1744 wrote to memory of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 1744 wrote to memory of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 1744 wrote to memory of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 1744 wrote to memory of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 1744 wrote to memory of 400	1744	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	101
PID 400 wrote to memory of 4616	400	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	102
PID 400 wrote to memory of 4616	400	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	102
PID 400 wrote to memory of 4616	400	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	102
PID 400 wrote to memory of 804	400	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	103
PID 400 wrote to memory of 804	400	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	103
PID 400 wrote to memory of 804	400	ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe	103
PID 3464 wrote to memory of 2508	3464	Explorer.EXE	104
PID 3464 wrote to memory of 2508	3464	Explorer.EXE	104
PID 3464 wrote to memory of 2508	3464	Explorer.EXE	104
PID 2508 wrote to memory of 3012	2508	colorcpl.exe	105
PID 2508 wrote to memory of 3012	2508	colorcpl.exe	105
PID 2508 wrote to memory of 3012	2508	colorcpl.exe	105

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
    3⤵
    PID:1044
- - C:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
    C:\Users\Admin\AppData\Local\Temp\ea5a7ad0dcd55d7835d3649b9dfcd51e_JaffaCakes118.exe
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\FB_D0D8.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\FB_D0D8.tmp.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\FB_D388.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\FB_D388.tmp.exe"
      4⤵
      Executes dropped EXE
      PID:804
- C:\Windows\SysWOW64\colorcpl.exe
  "C:\Windows\SysWOW64\colorcpl.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\FB_D0D8.tmp.exe"
    3⤵
    PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4
MD5 0774a05ce5ee4c1af7097353c9296c62
SHA1 658ff96b111c21c39d7ad5f510fb72f9762114bb
SHA512 104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 ec6cf8f6f6916b235833296b14063a4fc8507cd6de2718d2122ebf9146db4ddb
MD5 407f1e5406e15e5fae9ee447bcc8940e
SHA1 962058ca325bc44b9c809b452501cee31bff56f5
SHA512 6129cbb2a03bbef85856e8666f597d4deda0a82dc3c11e52db7544a1455936145d3beb371a67f3c45086b3f74ec60a662dc16339b1c8417373de696d407d2a99
SSDEEP 384:prfnaWk9i+1vBBi5SNBSjLstYwTHDK6seYosE/gi3SoZ5fYS6rjEKswBPfh/YPdn:hf5IpoMSvGLTHDNPLXS4UfEKfq9
MD5 SHA1 SHA512 SSDEEP

Submit Download

FB_D0D8.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\FB_D0D8.tmp.exe
Size 161KB
SHA256 f4d07db78b426427dd3ac873017a6d4be76d42d50ff082a2a9bc09948037a75e
MD5 16ee58ea30c5d2fe3e6cf3d92dcdfca4
SHA1 bcd3bc4aa0a78b174237399d1f700316f7fc7ccc
SHA512 1a658c869cd7be561a7d245a887461a877b8ff06664a5518579f5346c8297935aa5bd4d7217c952aa0644fdf2b54321179903ae4f917bd32f213f77f728faa7c
SSDEEP 3072:yBvyQz60is97WaoAyNEhFTNWBjOktKNSGX6Wt0S2Td2:WydEtoAKmZNW9OktKNVXzt0S28
MD5 SHA1 SHA512 SSDEEP

Submit Download

FB_D388.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\FB_D388.tmp.exe
Size 3KB
SHA256 129450ba06ad589cf6846a455a5b6b5f55e164ee4906e409eb692ab465269689
MD5 74bafb3e707c7b0c63938ac200f99c7f
SHA1 10c5506337845ed9bf25c73d2506f9c15ab8e608
SHA512 5b24dc5acd14f812658e832b587b60695fb16954fca006c2c3a7382ef0ec65c3bd1aaf699425c49ff3cceef16869e75dd6f00ec189b9f673f08f7e1b80cf7781
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_e0la33gv.xsz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e0la33gv.xsz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/400-2180-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1596-49-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/1596-46-0x0000000005F10000-0x0000000006264000-memory.dmp

Download

memory/1596-35-0x0000000004E70000-0x0000000004E80000-memory.dmp

Download

memory/1596-34-0x0000000004E70000-0x0000000004E80000-memory.dmp

Download

memory/1596-33-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/1744-106-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-78-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-1-0x0000000000D70000-0x0000000000DDA000-memory.dmp

Download

memory/1744-2-0x0000000005DB0000-0x0000000006354000-memory.dmp

Download

memory/1744-3-0x0000000005800000-0x0000000005892000-memory.dmp

Download

memory/1744-2178-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/1744-116-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-114-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-112-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-110-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-108-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-0-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/1744-104-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-102-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-100-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-36-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/1744-98-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-5-0x0000000005790000-0x000000000579A000-memory.dmp

Download

memory/1744-4-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/1744-50-0x0000000005A00000-0x0000000005A10000-memory.dmp

Download

memory/1744-51-0x0000000006AB0000-0x0000000006B10000-memory.dmp

Download

memory/1744-52-0x0000000007510000-0x000000000757E000-memory.dmp

Download

memory/1744-53-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-54-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-56-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-58-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-60-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-62-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-64-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-66-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-68-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-70-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-72-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-74-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-76-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-96-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-80-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-82-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-84-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-86-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-88-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-90-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-92-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/1744-94-0x0000000007510000-0x0000000007578000-memory.dmp

Download

memory/2508-2203-0x0000000000B10000-0x0000000000B39000-memory.dmp

Download

memory/2508-2210-0x0000000000B10000-0x0000000000B39000-memory.dmp

Download

memory/2508-2207-0x0000000002A50000-0x0000000002AE0000-memory.dmp

Download

memory/2508-2204-0x0000000002BD0000-0x0000000002F1A000-memory.dmp

Download

memory/2508-2202-0x0000000000160000-0x0000000000179000-memory.dmp

Download

memory/3320-23-0x0000000005DE0000-0x0000000005DFE000-memory.dmp

Download

memory/3320-8-0x0000000004800000-0x0000000004836000-memory.dmp

Download

memory/3320-28-0x0000000008080000-0x00000000086FA000-memory.dmp

Download

memory/3320-27-0x0000000006320000-0x0000000006342000-memory.dmp

Download

memory/3320-26-0x00000000062D0000-0x00000000062EA000-memory.dmp

Download

memory/3320-25-0x0000000006E00000-0x0000000006E96000-memory.dmp

Download

memory/3320-24-0x0000000005E40000-0x0000000005E8C000-memory.dmp

Download

memory/3320-11-0x00000000056D0000-0x0000000005736000-memory.dmp

Download

memory/3320-22-0x0000000005920000-0x0000000005C74000-memory.dmp

Download

memory/3320-17-0x00000000057B0000-0x0000000005816000-memory.dmp

Download

memory/3320-6-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/3320-7-0x00000000048F0000-0x0000000004900000-memory.dmp

Download

memory/3320-31-0x0000000074BF0000-0x00000000753A0000-memory.dmp

Download

memory/3320-9-0x0000000004F30000-0x0000000005558000-memory.dmp

Download

memory/3320-10-0x0000000004F00000-0x0000000004F22000-memory.dmp

Download

memory/3464-2199-0x0000000002DB0000-0x0000000002EF1000-memory.dmp

Download

memory/3464-2208-0x0000000002DB0000-0x0000000002EF1000-memory.dmp

Download

memory/3464-2212-0x0000000008610000-0x00000000086AC000-memory.dmp

Download

memory/3464-2216-0x0000000008610000-0x00000000086AC000-memory.dmp

Download

memory/4616-2198-0x00000000009F0000-0x0000000000A01000-memory.dmp

Download

memory/4616-2197-0x0000000000050000-0x0000000000079000-memory.dmp

Download

memory/4616-2196-0x0000000000A30000-0x0000000000D7A000-memory.dmp

Download