5c494fdb91eea252c509c8443b76764379d5ec91689e770fd627238d23ec85c2

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ZipRipper.cmd
Size 55KB
Sample260415-emn2eshw8x
SHA256 5c494fdb91eea252c509c8443b76764379d5ec91689e770fd627238d23ec85c2
MD5 5d2fc050bb45075f6e0c244114590cda
SHA1 0804297bb25e35d011084ad3f60effd01e9e786f
SHA512 2dfba72f4a656482d93c77b02472e7b305b674fa0f270e8c1dc2297d6758987aae5343bf3f84598e697be095a9b7bb7a230f03cdde9e6131b4389aaddca797f7
SSDEEP 1536:ShJ6WUpefX3zTwisL9zdRTtfHwedIM7hews0/+AcVpa:PpefX3zTwisL9zdRTtPfdIjws0/+AcVg
TLSH
T19B431938FB495D9C436247B2953B0D54D51FECAB204DAD94BDACCD0EEE882484276AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution privilege_escalation

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://raw.githubusercontent.com/illsk1lls/ZipRipper/main/.resources/zipripper.png

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4228	powershell.exe
3	5632	powershell.exe
4	2412	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
828	powershell.exe
2412	powershell.exe
2556	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
4	raw.githubusercontent.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3548	tasklist.exe
5952	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2556	powershell.exe

Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
1140	reg.exe
3368	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.ZipRipper\shell\runas	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.ZipRipper\shell\runas\command\ = "CMD /x /d /r SET \"f0=1\"&CALL \"%2\" %3"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.ZipRipper\shell\runas\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.ZipRipper\shell\runas\command\ = "CMD /x /d /r SET \"f0=1\"&CALL \"%2\" %3"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.ZipRipper\shell\runas\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.ZipRipper	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\.ZipRipper\shell	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
1140	reg.exe
3368	reg.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
3548	tasklist.exe
3548	tasklist.exe
4228	powershell.exe
4228	powershell.exe
5952	tasklist.exe
5952	tasklist.exe
5632	powershell.exe
5632	powershell.exe
3672	powershell.exe
3672	powershell.exe
828	powershell.exe
828	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2412	powershell.exe
2556	powershell.exe
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 29 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	tasklist.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	5952	tasklist.exe
Token: SeDebugPrivilege	5632	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeIncreaseQuotaPrivilege	3672	powershell.exe
Token: SeSecurityPrivilege	3672	powershell.exe
Token: SeTakeOwnershipPrivilege	3672	powershell.exe
Token: SeLoadDriverPrivilege	3672	powershell.exe
Token: SeSystemProfilePrivilege	3672	powershell.exe
Token: SeSystemtimePrivilege	3672	powershell.exe
Token: SeProfSingleProcessPrivilege	3672	powershell.exe
Token: SeIncBasePriorityPrivilege	3672	powershell.exe
Token: SeCreatePagefilePrivilege	3672	powershell.exe
Token: SeBackupPrivilege	3672	powershell.exe
Token: SeRestorePrivilege	3672	powershell.exe
Token: SeShutdownPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeSystemEnvironmentPrivilege	3672	powershell.exe
Token: SeRemoteShutdownPrivilege	3672	powershell.exe
Token: SeUndockPrivilege	3672	powershell.exe
Token: SeManageVolumePrivilege	3672	powershell.exe
Token: 33	3672	powershell.exe
Token: 34	3672	powershell.exe
Token: 35	3672	powershell.exe
Token: 36	3672	powershell.exe
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 3548	5056	cmd.exe	79
PID 5056 wrote to memory of 2052	5056	cmd.exe	80
PID 5056 wrote to memory of 5008	5056	cmd.exe	82
PID 5008 wrote to memory of 4228	5008	cmd.exe	83
PID 5056 wrote to memory of 1140	5056	cmd.exe	84
PID 5056 wrote to memory of 2196	5056	cmd.exe	85
PID 5056 wrote to memory of 3840	5056	cmd.exe	86
PID 5056 wrote to memory of 2620	5056	cmd.exe	87
PID 5056 wrote to memory of 5864	5056	cmd.exe	88
PID 5864 wrote to memory of 5952	5864	CMD.exe	90
PID 5864 wrote to memory of 4208	5864	CMD.exe	91
PID 5864 wrote to memory of 5884	5864	CMD.exe	92
PID 5884 wrote to memory of 5632	5884	cmd.exe	93
PID 5864 wrote to memory of 3368	5864	CMD.exe	94
PID 5864 wrote to memory of 2380	5864	CMD.exe	95
PID 2380 wrote to memory of 5136	2380	cmd.exe	96
PID 5864 wrote to memory of 5472	5864	CMD.exe	97
PID 5472 wrote to memory of 3672	5472	cmd.exe	98
PID 5864 wrote to memory of 5084	5864	CMD.exe	99
PID 5864 wrote to memory of 828	5864	CMD.exe	100
PID 828 wrote to memory of 5656	828	powershell.exe	101
PID 5656 wrote to memory of 5416	5656	csc.exe	102
PID 5864 wrote to memory of 2412	5864	CMD.exe	103
PID 5864 wrote to memory of 2608	5864	CMD.exe	104
PID 2608 wrote to memory of 2556	2608	cmd.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5084	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ZipRipper.cmd"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\system32\tasklist.exe
  TASKLIST /V /NH /FI "imagename eq cmd.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\system32\findstr.exe
  FINDSTR /I /C:"ZIP-Ripper"
  2⤵
  PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c POWERSHELL -nop -c "$ProgressPreference='SilentlyContinue';irm http://www.msftncsi.com/ncsi.txt;$ProgressPreference='Continue'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL -nop -c "$ProgressPreference='SilentlyContinue';irm http://www.msftncsi.com/ncsi.txt;$ProgressPreference='Continue'"
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- C:\Windows\system32\reg.exe
  REG ADD HKCU\Software\classes\.ZipRipper\shell\runas\command /f /ve /d "CMD /x /d /r SET \"f0=1\"&CALL \"%2\" %3"
  2⤵
  - Access Token Manipulation: Create Process with Token
  - Modifies registry class
  - Modifies registry key
  PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" ECHO"
  2⤵
  PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" 1>"C:\ProgramData\launcher.ZipRipper" ( SET /p="C:\Users\Admin\AppData\Local\Temp\" )"
  2⤵
  PID:3840
- C:\Windows\system32\fltMC.exe
  FLTMC
  2⤵
  PID:2620
- C:\Windows\system32\CMD.exe
  "CMD.exe" /x /d /r SET "f0=1"&CALL "C:\ProgramData\ZipRipper.cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\system32\tasklist.exe
    TASKLIST /V /NH /FI "imagename eq cmd.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
- - C:\Windows\system32\findstr.exe
    FINDSTR /I /C:"ZIP-Ripper"
    3⤵
    PID:4208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c POWERSHELL -nop -c "$ProgressPreference='SilentlyContinue';irm http://www.msftncsi.com/ncsi.txt;$ProgressPreference='Continue'"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      POWERSHELL -nop -c "$ProgressPreference='SilentlyContinue';irm http://www.msftncsi.com/ncsi.txt;$ProgressPreference='Continue'"
      4⤵
      Badlisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5632
- - C:\Windows\system32\reg.exe
    REG ADD HKCU\Software\classes\.ZipRipper\shell\runas\command /f /ve /d "CMD /x /d /r SET \"f0=1\"&CALL \"%2\" %3"
    3⤵
    - Access Token Manipulation: Create Process with Token
    - Modifies registry class
    - Modifies registry key
    PID:3368
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2>nul
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2380
  - - C:\Windows\system32\reg.exe
      REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName
      4⤵
      PID:5136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c POWERSHELL -nop -c "Get-CIMInstance -query 'select * from Win32_VideoController' | ft Name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5472
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      POWERSHELL -nop -c "Get-CIMInstance -query 'select * from Win32_VideoController' | ft Name"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3672
- - C:\Windows\system32\attrib.exe
    ATTRIB -h "C:\ProgramData\BIT*.tmp"
    3⤵
    - Views/modifies file attributes
    PID:5084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL -nop -c "$w=Add-Type -Name WAPI -PassThru -MemberDefinition '[DllImport("""user32.dll""")]public static extern void SetProcessDPIAware();[DllImport("""shcore.dll""")]public static extern void SetProcessDpiAwareness(int value);[DllImport("""kernel32.dll""")]public static extern IntPtr GetConsoleWindow();[DllImport("""user32.dll""")]public static extern void GetWindowRect(IntPtr hwnd,int[] rect);[DllImport("""user32.dll""")]public static extern void GetClientRect(IntPtr hwnd, int[] rect);[DllImport("""user32.dll""")]public static extern void GetMonitorInfoW(IntPtr hMonitor, int[] lpmi);[DllImport("""user32.dll""")]public static extern IntPtr MonitorFromWindow(IntPtr hwnd, int dwFlags);[DllImport("""user32.dll""")]public static extern int SetWindowPos(IntPtr hwnd,IntPtr hwndAfterZ,int x,int y,int w,int h,int flags);';$PROCESS_PER_MONITOR_DPI_AWARE=2;try{$w::SetProcessDpiAwareness($PROCESS_PER_MONITOR_DPI_AWARE)}catch{$w::SetProcessDPIAware()}$hwnd=$w::GetConsoleWindow();$moninf=[int[]]::new(10);$moninf[0]=40;$MONITOR_DEFAULTTONEAREST=2;$w::GetMonitorInfoW($w::MonitorFromWindow($hwnd, $MONITOR_DEFAULTTONEAREST), $moninf);$monwidth=$moninf[7]-$moninf[5];$monheight=$moninf[8]-$moninf[6];$wrect=[int[]]::new(4);$w::GetWindowRect($hwnd, $wrect);$winwidth=$wrect[2]-$wrect[0];$winheight=$wrect[3]-$wrect[1];$x=[int][math]::Round($moninf[5]+$monwidth/2-$winwidth/2);$y=[int][math]::Round($moninf[6]+$monheight/2-$winheight/2);$SWP_NOSIZE=0x0001;$SWP_NOZORDER=0x0004;exit [int]($w::SetWindowPos($hwnd,[IntPtr]::Zero,$x,$y,0,0,$SWP_NOSIZE -bOr $SWP_NOZORDER) -eq 0)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gmmnh2ob\gmmnh2ob.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5656
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1807.tmp" "c:\Users\Admin\AppData\Local\Temp\gmmnh2ob\CSCC055DA20E1A942939512C41EFB94C5E3.TMP"
        5⤵
        
        PID:5416
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    POWERSHELL -nop -c "Add-Type -AssemblyName PresentationFramework, System.Drawing, System.Windows.Forms, WindowsFormsIntegration;[xml]$xaml='<Window xmlns="""http://schemas.microsoft.com/winfx/2006/xaml/presentation""" xmlns:x="""http://schemas.microsoft.com/winfx/2006/xaml""" Title=""" Initializing...""" Height="""37""" Width="""210""" WindowStartupLocation="""CenterScreen""" WindowStyle="""None""" Topmost="""True""" Background="""#333333""" AllowsTransparency="""True"""><Canvas><TextBlock Name="""Info""" Canvas.Top="""3""" Text=""" Initializing...""" Foreground="""#eeeeee""" FontWeight="""Bold"""/><ProgressBar Canvas.Left="""5""" Canvas.Top="""28""" Width="""200""" Height="""3""" Name="""Progress""" Foreground="""#FF0000"""/></Canvas></Window>';$reader=(New-Object System.Xml.XmlNodeReader $xaml);$form=[Windows.Markup.XamlReader]::Load($reader);$form.Add_Closing({[System.Windows.Forms.Application]::Exit();Stop-Process $pid});$progressBar=$form.FindName("""Progress""");function Update-Gui (){$form.Dispatcher.Invoke([Windows.Threading.DispatcherPriority]::Background, [action]{})};function DownloadFile($url,$targetFile){$uri=New-Object """System.Uri""" """$url""";$request=[System.Net.HttpWebRequest]::Create($uri);$request.set_Timeout(15000);$response=$request.GetResponse();$totalLength=[System.Math]::Floor($response.get_ContentLength()/1024);$responseStream=$response.GetResponseStream();$targetStream=New-Object -TypeName System.IO.FileStream -ArgumentList $targetFile, Create;$buffer=new-object byte[] 10KB;$count=$responseStream.Read($buffer,0,$buffer.length);$downloadedBytes=$count;while ($count -gt 0){$targetStream.Write($buffer,0,$count);$count=$responseStream.Read($buffer,0,$buffer.length);$downloadedBytes=$downloadedBytes+$count;$roundedPercent=[int]((([System.Math]::Floor($downloadedBytes/1024))/$totalLength)*100);$progressBar.Value=$roundedPercent;if($progressBar.Value -ne $lastpercent){$lastpercent=$progressBar.Value;Update-Gui}};$targetStream.Flush();$targetStream.Close();$targetStream.Dispose();$responseStream.Dispose()};$form.Add_ContentRendered({downloadFile 'https://raw.githubusercontent.com/illsk1lls/ZipRipper/main/.resources/zipripper.png' 'C:\ProgramData\zipripper.png';Sleep 1;$form.Close()});$form.Show();$appContext=New-Object System.Windows.Forms.ApplicationContext;[void][System.Windows.Forms.Application]::Run($appContext)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c POWERSHELL -nop -c "Add-Type -AssemblyName PresentationFramework, System.Drawing, System.Windows.Forms, WindowsFormsIntegration;function wlist(){Switch($showL){0{$D.Visibility="""Visible""";$R.Visibility="""Visible""";$C.Visibility="""Visible""";$global:showL="""1"""}1{$D.Visibility="""Collapsed""";$R.Visibility="""Collapsed""";$C.Visibility="""Collapsed""";$global:showL="""0"""}}};[xml]$xaml='<Window xmlns="""http://schemas.microsoft.com/winfx/2006/xaml/presentation""" xmlns:x="""http://schemas.microsoft.com/winfx/2006/xaml""" WindowStartupLocation="""CenterScreen""" WindowStyle="""None""" Background="""Transparent""" AllowsTransparency="""True""" Width="""285""" Height="""324"""><Window.Resources><ControlTemplate x:Key="""nM""" TargetType="""Button"""><Border Background="""{TemplateBinding Background}""" BorderBrush="""{TemplateBinding BorderBrush}""" BorderThickness="""{TemplateBinding BorderThickness}"""><ContentPresenter HorizontalAlignment="""{TemplateBinding HorizontalContentAlignment}""" VerticalAlignment="""{TemplateBinding VerticalContentAlignment}"""/></Border><ControlTemplate.Triggers><Trigger Property="""IsEnabled""" Value="""False"""><Setter Property="""Background""" Value="""{x:Static SystemColors.ControlLightBrush}"""/><Setter Property="""Foreground""" Value="""{x:Static SystemColors.GrayTextBrush}"""/></Trigger></ControlTemplate.Triggers></ControlTemplate></Window.Resources><Grid><Grid.RowDefinitions><RowDefinition Height="""298"""/><RowDefinition Height="""*"""/></Grid.RowDefinitions><Grid.Background><ImageBrush ImageSource="""C:\ProgramData\zipripper.png"""/></Grid.Background><Grid.Triggers><EventTrigger RoutedEvent="""Loaded"""><BeginStoryboard><Storyboard><DoubleAnimation Storyboard.TargetProperty="""Background.Opacity""" From="""0""" To="""1""" Duration="""0:0:1"""/></Storyboard></BeginStoryboard></EventTrigger></Grid.Triggers><Canvas Grid.Row="""0"""><Button x:Name="""Offline""" Canvas.Left="""141""" Canvas.Top="""56""" Height="""16""" Width="""26""" ToolTip="""Create [zr-offline.txt]""" Template="""{StaticResource nM}"""/><Button x:Name="""Cleanup""" Canvas.Left="""138""" Canvas.Top="""154""" Height="""20""" Width="""20""" ToolTip="""Clear Resume Cache""" Template="""{StaticResource nM}"""/><Button Name="""List""" Canvas.Left="""143""" Canvas.Top="""116""" Height="""10""" Width="""15""" ToolTip="""Select Wordlist""" Template="""{StaticResource nM}""" Opacity="""0"""></Button><Button Name="""Default""" Canvas.Left="""123""" Canvas.Top="""130""" FontSize="""11""" Foreground="""#eeeeee""" Background="""#333333""" Height="""18""" Width="""55""" Visibility="""Collapsed""" HorizontalContentAlignment="""Left""" Template="""{StaticResource nM}""" Opacity="""0.9""">Default</Button><Button Name="""WL""" Canvas.Left="""123""" Canvas.Top="""147""" FontSize="""11""" Foreground="""#eeeeee""" Background="""#333333""" Height="""18""" Width="""55""" Visibility="""Collapsed""" HorizontalContentAlignment="""Left""" Template="""{StaticResource nM}""" Opacity="""0.9""">Cyclone</Button><Button Name="""Custom""" Canvas.Left="""123""" Canvas.Top="""164""" FontSize="""11""" Foreground="""#eeeeee""" Background="""#333333""" Height="""18""" Width="""55""" Visibility="""Collapsed""" HorizontalContentAlignment="""Left""" Template="""{StaticResource nM}""" Opacity="""0.9""">Custom</Button></Canvas><Canvas Grid.Row="""1"""><Button x:Name="""Start""" Height="""22""" Width="""65""" Content="""Start""" ToolTip="""Click to Begin...""" Template="""{StaticResource nM}"""><Button.Triggers><EventTrigger RoutedEvent="""Loaded"""><BeginStoryboard><Storyboard><DoubleAnimation From="""40""" To="""65""" Duration="""0:0:1""" Storyboard.TargetProperty="""(Canvas.Left)""" AutoReverse="""False"""/><DoubleAnimation Storyboard.TargetProperty="""Opacity""" From="""0""" To="""1""" Duration="""0:0:2"""/></Storyboard></BeginStoryboard></EventTrigger></Button.Triggers></Button></Canvas><Canvas Grid.Row="""1"""><Button x:Name="""Quit""" Height="""22""" Width="""65""" Content="""Quit""" ToolTip="""Click to Exit""" Template="""{StaticResource nM}"""><Button.Triggers><EventTrigger RoutedEvent="""Loaded"""><BeginStoryboard><Storyboard><DoubleAnimation From="""40""" To="""65""" Duration="""0:0:1""" Storyboard.TargetProperty="""(Canvas.Right)""" AutoReverse="""False"""/><DoubleAnimation Storyboard.TargetProperty="""Opacity""" From="""0""" To="""1""" Duration="""0:0:2"""/></Storyboard></BeginStoryboard></EventTrigger></Button.Triggers></Button></Canvas></Grid><Window.TaskbarItemInfo><TaskbarItemInfo/></Window.TaskbarItemInfo></Window>';$reader=(New-Object System.Xml.XmlNodeReader $xaml);$window=[Windows.Markup.XamlReader]::Load($reader);$window.Title='ZipRipper';$bitmap=New-Object System.Windows.Media.Imaging.BitmapImage;$bitmap='C:\ProgramData\zipripper.png';$window.Icon=$bitmap;$window.TaskbarItemInfo.Overlay=$bitmap;$window.TaskbarItemInfo.Description=$window.Title;$window.Add_Closing({[System.Windows.Forms.Application]::Exit();Stop-Process $pid});$L=$Window.FindName("""List""");$D=$Window.FindName("""Default""");$R=$Window.FindName("""WL""");$C=$Window.FindName("""Custom""");$L.Add_Click({wlist});$D.Add_MouseEnter({$D.Background="""#eeeeee""";$D.Foreground="""#333333"""});$D.Add_MouseLeave({$D.Background="""#333333""";$D.Foreground="""#eeeeee"""});$D.Add_Click({$global:list='0';wlist});$R.Add_MouseEnter({$R.Background="""#eeeeee""";$R.Foreground="""#333333"""});$R.Add_MouseLeave({$R.Background="""#333333""";$R.Foreground="""#eeeeee"""});$R.Add_Click({$global:list='1';wlist});$C.Add_MouseEnter({$C.Background="""#eeeeee""";$C.Foreground="""#333333"""});$C.Add_MouseLeave({$C.Background="""#333333""";$C.Foreground="""#eeeeee"""});$C.Add_Click({$global:list='2';wlist});$b=$Window.FindName("""Start""");$b.Background = """#333333""";$b.Foreground="""#eeeeee""";$b.FontSize="""12""";$b.FontWeight="""Bold""";$b.Add_MouseEnter({$b.Background="""#eeeeee""";$b.Foreground="""#333333"""});$b.Add_MouseLeave({$b.Background="""#333333""";$b.Foreground="""#eeeeee"""});$b.Add_Click({write-host """Start,$list""";Exit});$b2=$Window.FindName("""Quit""");$b2.Background="""#333333""";$b2.Foreground="""#eeeeee""";$b2.FontSize="""12""";$b2.FontWeight="""Bold""";$b2.Add_MouseEnter({$b2.Background="""#eeeeee""";$b2.Foreground="""#333333"""});$b2.Add_MouseLeave({$b2.Background="""#333333""";$b2.Foreground="""#eeeeee"""});$b2.Add_Click({write-host 'Quit';Exit});$b3=$Window.FindName("""Offline""");$b3.Opacity="""0""";$b3.Add_Click({$b3m=New-Object -ComObject Wscript.Shell;$b3a=$b3m.Popup('Create [zr-offline.txt] for Offline Mode?',0,'Offline Mode Builder',0x1);if($b3a -eq 1){write-host 'Offline';Exit}});$b4=$Window.FindName("""Cleanup""");$b4.Opacity="""0""";$b4.Add_Click({$b4m=New-Object -ComObject Wscript.Shell;$b4a=$b4m.Popup('Cleanup ALL resume data?',0,'Clear InProgress Jobs',0x1);if($b4a -eq 1){if(Test-Path -Path 'C:\Users\Admin\AppData\Roaming\ZR-InProgress'){Remove-Item 'C:\Users\Admin\AppData\Roaming\ZR-InProgress' -Recurse -force -ErrorAction SilentlyContinue;$b4m2=New-Object -ComObject Wscript.Shell;$b4m2.Popup('ALL Jobs Cleared',0,'Clear InProgress Jobs',0x0)} else {$b4m3=New-Object -ComObject Wscript.Shell;$b4m3.Popup('There are no jobs to clear',0,'Clear InProgress Jobs',0x0)}}});$list='0';$showL='0';$window.add_MouseLeftButtonDown({if($showL -eq 1){wlist};$window.DragMove()});$window.Show();$appContext=New-Object System.Windows.Forms.ApplicationContext;[void][System.Windows.Forms.Application]::Run($appContext)"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      POWERSHELL -nop -c "Add-Type -AssemblyName PresentationFramework, System.Drawing, System.Windows.Forms, WindowsFormsIntegration;function wlist(){Switch($showL){0{$D.Visibility="""Visible""";$R.Visibility="""Visible""";$C.Visibility="""Visible""";$global:showL="""1"""}1{$D.Visibility="""Collapsed""";$R.Visibility="""Collapsed""";$C.Visibility="""Collapsed""";$global:showL="""0"""}}};[xml]$xaml='<Window xmlns="""http://schemas.microsoft.com/winfx/2006/xaml/presentation""" xmlns:x="""http://schemas.microsoft.com/winfx/2006/xaml""" WindowStartupLocation="""CenterScreen""" WindowStyle="""None""" Background="""Transparent""" AllowsTransparency="""True""" Width="""285""" Height="""324"""><Window.Resources><ControlTemplate x:Key="""nM""" TargetType="""Button"""><Border Background="""{TemplateBinding Background}""" BorderBrush="""{TemplateBinding BorderBrush}""" BorderThickness="""{TemplateBinding BorderThickness}"""><ContentPresenter HorizontalAlignment="""{TemplateBinding HorizontalContentAlignment}""" VerticalAlignment="""{TemplateBinding VerticalContentAlignment}"""/></Border><ControlTemplate.Triggers><Trigger Property="""IsEnabled""" Value="""False"""><Setter Property="""Background""" Value="""{x:Static SystemColors.ControlLightBrush}"""/><Setter Property="""Foreground""" Value="""{x:Static SystemColors.GrayTextBrush}"""/></Trigger></ControlTemplate.Triggers></ControlTemplate></Window.Resources><Grid><Grid.RowDefinitions><RowDefinition Height="""298"""/><RowDefinition Height="""*"""/></Grid.RowDefinitions><Grid.Background><ImageBrush ImageSource="""C:\ProgramData\zipripper.png"""/></Grid.Background><Grid.Triggers><EventTrigger RoutedEvent="""Loaded"""><BeginStoryboard><Storyboard><DoubleAnimation Storyboard.TargetProperty="""Background.Opacity""" From="""0""" To="""1""" Duration="""0:0:1"""/></Storyboard></BeginStoryboard></EventTrigger></Grid.Triggers><Canvas Grid.Row="""0"""><Button x:Name="""Offline""" Canvas.Left="""141""" Canvas.Top="""56""" Height="""16""" Width="""26""" ToolTip="""Create [zr-offline.txt]""" Template="""{StaticResource nM}"""/><Button x:Name="""Cleanup""" Canvas.Left="""138""" Canvas.Top="""154""" Height="""20""" Width="""20""" ToolTip="""Clear Resume Cache""" Template="""{StaticResource nM}"""/><Button Name="""List""" Canvas.Left="""143""" Canvas.Top="""116""" Height="""10""" Width="""15""" ToolTip="""Select Wordlist""" Template="""{StaticResource nM}""" Opacity="""0"""></Button><Button Name="""Default""" Canvas.Left="""123""" Canvas.Top="""130""" FontSize="""11""" Foreground="""#eeeeee""" Background="""#333333""" Height="""18""" Width="""55""" Visibility="""Collapsed""" HorizontalContentAlignment="""Left""" Template="""{StaticResource nM}""" Opacity="""0.9""">Default</Button><Button Name="""WL""" Canvas.Left="""123""" Canvas.Top="""147""" FontSize="""11""" Foreground="""#eeeeee""" Background="""#333333""" Height="""18""" Width="""55""" Visibility="""Collapsed""" HorizontalContentAlignment="""Left""" Template="""{StaticResource nM}""" Opacity="""0.9""">Cyclone</Button><Button Name="""Custom""" Canvas.Left="""123""" Canvas.Top="""164""" FontSize="""11""" Foreground="""#eeeeee""" Background="""#333333""" Height="""18""" Width="""55""" Visibility="""Collapsed""" HorizontalContentAlignment="""Left""" Template="""{StaticResource nM}""" Opacity="""0.9""">Custom</Button></Canvas><Canvas Grid.Row="""1"""><Button x:Name="""Start""" Height="""22""" Width="""65""" Content="""Start""" ToolTip="""Click to Begin...""" Template="""{StaticResource nM}"""><Button.Triggers><EventTrigger RoutedEvent="""Loaded"""><BeginStoryboard><Storyboard><DoubleAnimation From="""40""" To="""65""" Duration="""0:0:1""" Storyboard.TargetProperty="""(Canvas.Left)""" AutoReverse="""False"""/><DoubleAnimation Storyboard.TargetProperty="""Opacity""" From="""0""" To="""1""" Duration="""0:0:2"""/></Storyboard></BeginStoryboard></EventTrigger></Button.Triggers></Button></Canvas><Canvas Grid.Row="""1"""><Button x:Name="""Quit""" Height="""22""" Width="""65""" Content="""Quit""" ToolTip="""Click to Exit""" Template="""{StaticResource nM}"""><Button.Triggers><EventTrigger RoutedEvent="""Loaded"""><BeginStoryboard><Storyboard><DoubleAnimation From="""40""" To="""65""" Duration="""0:0:1""" Storyboard.TargetProperty="""(Canvas.Right)""" AutoReverse="""False"""/><DoubleAnimation Storyboard.TargetProperty="""Opacity""" From="""0""" To="""1""" Duration="""0:0:2"""/></Storyboard></BeginStoryboard></EventTrigger></Button.Triggers></Button></Canvas></Grid><Window.TaskbarItemInfo><TaskbarItemInfo/></Window.TaskbarItemInfo></Window>';$reader=(New-Object System.Xml.XmlNodeReader $xaml);$window=[Windows.Markup.XamlReader]::Load($reader);$window.Title='ZipRipper';$bitmap=New-Object System.Windows.Media.Imaging.BitmapImage;$bitmap='C:\ProgramData\zipripper.png';$window.Icon=$bitmap;$window.TaskbarItemInfo.Overlay=$bitmap;$window.TaskbarItemInfo.Description=$window.Title;$window.Add_Closing({[System.Windows.Forms.Application]::Exit();Stop-Process $pid});$L=$Window.FindName("""List""");$D=$Window.FindName("""Default""");$R=$Window.FindName("""WL""");$C=$Window.FindName("""Custom""");$L.Add_Click({wlist});$D.Add_MouseEnter({$D.Background="""#eeeeee""";$D.Foreground="""#333333"""});$D.Add_MouseLeave({$D.Background="""#333333""";$D.Foreground="""#eeeeee"""});$D.Add_Click({$global:list='0';wlist});$R.Add_MouseEnter({$R.Background="""#eeeeee""";$R.Foreground="""#333333"""});$R.Add_MouseLeave({$R.Background="""#333333""";$R.Foreground="""#eeeeee"""});$R.Add_Click({$global:list='1';wlist});$C.Add_MouseEnter({$C.Background="""#eeeeee""";$C.Foreground="""#333333"""});$C.Add_MouseLeave({$C.Background="""#333333""";$C.Foreground="""#eeeeee"""});$C.Add_Click({$global:list='2';wlist});$b=$Window.FindName("""Start""");$b.Background = """#333333""";$b.Foreground="""#eeeeee""";$b.FontSize="""12""";$b.FontWeight="""Bold""";$b.Add_MouseEnter({$b.Background="""#eeeeee""";$b.Foreground="""#333333"""});$b.Add_MouseLeave({$b.Background="""#333333""";$b.Foreground="""#eeeeee"""});$b.Add_Click({write-host """Start,$list""";Exit});$b2=$Window.FindName("""Quit""");$b2.Background="""#333333""";$b2.Foreground="""#eeeeee""";$b2.FontSize="""12""";$b2.FontWeight="""Bold""";$b2.Add_MouseEnter({$b2.Background="""#eeeeee""";$b2.Foreground="""#333333"""});$b2.Add_MouseLeave({$b2.Background="""#333333""";$b2.Foreground="""#eeeeee"""});$b2.Add_Click({write-host 'Quit';Exit});$b3=$Window.FindName("""Offline""");$b3.Opacity="""0""";$b3.Add_Click({$b3m=New-Object -ComObject Wscript.Shell;$b3a=$b3m.Popup('Create [zr-offline.txt] for Offline Mode?',0,'Offline Mode Builder',0x1);if($b3a -eq 1){write-host 'Offline';Exit}});$b4=$Window.FindName("""Cleanup""");$b4.Opacity="""0""";$b4.Add_Click({$b4m=New-Object -ComObject Wscript.Shell;$b4a=$b4m.Popup('Cleanup ALL resume data?',0,'Clear InProgress Jobs',0x1);if($b4a -eq 1){if(Test-Path -Path 'C:\Users\Admin\AppData\Roaming\ZR-InProgress'){Remove-Item 'C:\Users\Admin\AppData\Roaming\ZR-InProgress' -Recurse -force -ErrorAction SilentlyContinue;$b4m2=New-Object -ComObject Wscript.Shell;$b4m2.Popup('ALL Jobs Cleared',0,'Clear InProgress Jobs',0x0)} else {$b4m3=New-Object -ComObject Wscript.Shell;$b4m3.Popup('There are no jobs to clear',0,'Clear InProgress Jobs',0x0)}}});$list='0';$showL='0';$window.add_MouseLeftButtonDown({if($showL -eq 1){wlist};$window.DragMove()});$window.Show();$appContext=New-Object System.Windows.Forms.ApplicationContext;[void][System.Windows.Forms.Application]::Run($appContext)"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Hide Artifacts: Ignore Process Interrupts
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZipRipper.cmd

Path C:\ProgramData\ZipRipper.cmd
Size 55KB
SHA256 5c494fdb91eea252c509c8443b76764379d5ec91689e770fd627238d23ec85c2
MD5 5d2fc050bb45075f6e0c244114590cda
SHA1 0804297bb25e35d011084ad3f60effd01e9e786f
SHA512 2dfba72f4a656482d93c77b02472e7b305b674fa0f270e8c1dc2297d6758987aae5343bf3f84598e697be095a9b7bb7a230f03cdde9e6131b4389aaddca797f7
SSDEEP 1536:ShJ6WUpefX3zTwisL9zdRTtfHwedIM7hews0/+AcVpa:PpefX3zTwisL9zdRTtPfdIjws0/+AcVg
TLSH
T19B431938FB495D9C436247B2953B0D54D51FECAB204DAD94BDACCD0EEE882484276AF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.ZipRipper

Path C:\ProgramData\launcher.ZipRipper
Size 34B
SHA256 dbf5f44e1b84a298dbbcad3c31a617d2f6cfa08eb5d16e05a5c28726c574d4eb
MD5 0e2184f1c7464b6617329fb18f107b4f
SHA1 6f22f98471e33c9db10d6f6f1728e98852e25b8f
SHA512 8e745c0215d52e15702551f29efb882a5eba97b5f279ccc29293b1a9b1b8661bf71b548569f9a99fa35c35a15d1b6b288d3c381c1292418c36dc89e2fa0b3a37
MD5 SHA1 SHA512

Submit Download

zipripper.png

Path C:\ProgramData\zipripper.png
Size 48KB
SHA256 4a3e0c493cfc848aeb836623d754417888d218f0177337cdbf0318cfc239cb96
MD5 b0db69f0967354264d6716bd1f15f7f9
SHA1 5de99168e791b5deaaa8d0523b14ba5ccaf43ac7
SHA512 e720f6485fc198ac4339680684b94ecb2dfacb3580167e940b754bda3f05fd5da2bc491593f2be319139eb2a2e0df7e3f7db95c7ca49cba57821331731e7c404
SSDEEP 768:03MXJn5W9Tw9gJGpHPYZB4Nd1D+v1DDNgbJ79GZK9UuyNnRjpvXDFSOU2VU0px:0iJn5W9gmZiHt+vBDNgby5t9U5ex
TLSH
T14D2312947C7EB0A4CB2ED78ED0D6E99C8B6A0D287AF09D2D5810D6C2F0ED2C35B78554
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 eb8e99e59a78efe2b90663fdfca03f6664fed69cfa7a807e88047ffc6d674c31
MD5 c314cc5917d5a78a4e88f66d7114878c
SHA1 f4b714a9e5ac21fd60022a65818557e5ed192cf5
SHA512 c02db5c81d2a55ef6b960b7b60b8bc7ad57ae250c1fe8709c40cab7acdcbfcf1fc0675682ea01ffe85cbd4146f67e1c90132d75e014d30403683e856615a4058
TLSH
T1DE51CD323375B1D889167F07192C59C463BF8355FA94AF4CB698624ED92B00B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b9ddc26f59292b69c509c821568ca887a91f024080b2251138abb867948a6616
MD5 ec08d99860df7984022033a587af73b7
SHA1 0d87569e22ca341cb117484ceefcda0cf3080ac5
SHA512 fe7668a303340eae53150864651b86f7af26ba79fde6753f6692ad1ab46bb2d06c72a229bcb9ce1588ecf0b1b5e181cd744f3d3376359f20046a76d44976152b
TLSH
T1BC216633B79CC235C8D9057A538CAD00B1B4C3C7C49EDE8B7A84C504A57F98ADBAC5A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 76bba150396a4ffedbd2a6d5a4920aa47abb22729083cc498d7280d83963bdbf
MD5 0a22760c494df432b3c57cf31bb738f5
SHA1 3bf7efc0402b42497c6300ef71cb2349aeb598ce
SHA512 4fe175a000efbbb5e59a92c8d9a48793963a5b6964cea24f0df986cbc58398da73366f6c470cac80560fd03bc48d026cab6e4da792628b9adf9c8cf544a11eb5
TLSH
T1E3218933B79CC234C8D9057A538DAD00B1B4C3C7C09EDE8B7A84C504A67F98ADBAC5A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f5e0a0052c901caea414ae2c0d3b2f69d49c5ec42fe566f653e44fc47bec1982
MD5 85bdd9fd131a901590bd97c1e9777792
SHA1 d671cfb9c8d998be68bebdcb6e187df61d72454c
SHA512 e686ad3e7d8c117a6480ea1dd832481d3576630ea6a7952859b55c2b74a996caa0dae1371d127ac7840c24c8e601c7a23ff3491d59a1f5908b7fc014e0a5a6cc
TLSH
T141218B33B79DC165C8D9117A208C9D00B275C3C740DECF8B7A84C228A97F5DADB945A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 875235a198f641d2626d3cb2d84825c5f34ac98f309d46d437c822e3b2b4cce1
MD5 a07c9e1f37c0e0072d7c30862c701e8d
SHA1 80609ead923e4e74698be94189cf25cd3f625423
SHA512 b449fd2ba1fa8089cbf9b82d24d6a2a2ba59357e05b330dbaf45a082b256643c2f01db47a7eb699f55a8dfaa542ce71193fb227a2df764da618bf7949e7f3aac
TLSH
T16B115733B79CC134C899117A1089AD01B2B5C3CB049EDE8B6A88C518E57F58ADFA41E4
MD5 SHA1 SHA512 TLSH

Submit Download

RES1807.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1807.tmp
Size 1KB
SHA256 55b7d5c7675ffede9e924103e5afe2c04d9871b838569c2d9ec834cb2fba1100
MD5 257a4ea7de61e80fc99e3fc8b2af6a85
SHA1 c8fdc62f4241bab0a12f4c0152de35ddb8e892ef
SHA512 4eb3cabbfb572fc66473c2fe48e443fe6644d7a960c5574a538d74a0095653de15e026b8b6cbf77a9e0d0b1b636a30f0966314033c9172694e78fac864bf027f
TLSH
T11E21890583E84B1EF073573269F6176FA274FD95EFA2975B8480422C1C51604EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lq1mlqj1.pns.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lq1mlqj1.pns.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

gmmnh2ob.dll

Path C:\Users\Admin\AppData\Local\Temp\gmmnh2ob\gmmnh2ob.dll
Size 3KB
SHA256 46006a9cbfd54e08965e50a5537c0bdaa582a120357c8e7e9e573a28b00af849
MD5 911fc93c23caabe1519ce0f9ba67a787
SHA1 01e7bf48c4c676661cb428b7b7e07d8541711033
SHA512 4e6576c7a3106eb390c0b9c7757f9f7fffed1cd023334cd0c6f47016465018e608232e1ab0b88a497613b25ad54dde9470f40aff110fb21395329707fe7a3f51
TLSH
T1F271031693E84567E4B2033AADF3430A33B4F8989B73575B59E4421DBCA22241D35BF1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCC055DA20E1A942939512C41EFB94C5E3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gmmnh2ob\CSCC055DA20E1A942939512C41EFB94C5E3.TMP
Size 652B
SHA256 3ab331389e4f7846b9dadd79efa406ff61b66ff73cf1151d086a823008bc4fef
MD5 94604450454d34fc3ecd7131a74e089d
SHA1 2911eef3084f931a7c9b2d0ded867d4b2a20ee52
SHA512 f341b34f26650722ad6793cb4ca37fd7b25510472937e140d5a52b3f2e40a42fedb5a629858ef9e57d108fd815e771c6df432fe185bd6ee82b24b668295f3495
TLSH
T1AEF05E09A3FC020EF0F34B30BDF643A395B8BC65DE3293ED5480131928749109A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gmmnh2ob.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gmmnh2ob\gmmnh2ob.0.cs
Size 899B
SHA256 0aed36513811d5a2a36ec7e4aa2fc98ff931cf27d6f7e5394515b8aafae9b252
MD5 2243cf02366045a3304a61b0d91b4aaa
SHA1 9f2b912895e713abb703dd183c85e78336bcb37d
SHA512 8ae2c8d8bef884fafa220d4c3bc75417a5aae3b5f2f6b928963c4c78d5aedb0abfd0a4ec2ffd4201cf30c9615d1ca31cbee7e57545a3123632d9f4a95c056db5
TLSH
T171115C20A722EF342442C41DCC94997EF31B707173BE1B06557DAB128F5B04A16BA7A6
MD5 SHA1 SHA512 TLSH

Submit Download

gmmnh2ob.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gmmnh2ob\gmmnh2ob.cmdline
Size 369B
SHA256 a4839abcbf6116a5d6a843f3301aed73e104121d54429305447f6190bdcb6123
MD5 c3b7f9f7a7251c664d1b13c435ba413c
SHA1 a7bf1d0345e05f60590da5ec00f53b459260d1fe
SHA512 6ee2897045b2e4f674c4d60505a7d38086879045f48faeb0a6b90507a3f5c1401403909c34e97a92d77373f131f7a9fc707a5c0fdeca4e8978f57d7d94a5b5b8
TLSH
T18AE0C63E4346C2BD09ED200B227AC9ECC27207833992BFE4B8C0840DE4672042BD6789
MD5 SHA1 SHA512 TLSH

Submit Download

memory/828-74-0x000001E338320000-0x000001E338328000-memory.dmp

Download

memory/828-77-0x000001E337FC0000-0x000001E337FD2000-memory.dmp

Download

memory/828-76-0x000001E31F990000-0x000001E31F99C000-memory.dmp

Download

memory/2412-85-0x00000242ACAE0000-0x00000242ACAFC000-memory.dmp

Download

memory/2412-86-0x00000242B1680000-0x00000242B16B8000-memory.dmp

Download

memory/2412-87-0x00000242B1010000-0x00000242B101E000-memory.dmp

Download

memory/2412-89-0x0000024292B20000-0x0000024292B2C000-memory.dmp

Download

memory/2412-90-0x0000024294940000-0x0000024294952000-memory.dmp

Download

memory/2556-99-0x00000146B87C0000-0x00000146B87CC000-memory.dmp

Download

memory/2556-100-0x00000146B8C70000-0x00000146B8C82000-memory.dmp

Download

memory/2556-98-0x00000146D54E0000-0x00000146D54E8000-memory.dmp

Download

memory/3672-51-0x000001F144590000-0x000001F14459C000-memory.dmp

Download

memory/3672-52-0x000001F146210000-0x000001F146222000-memory.dmp

Download

memory/3672-49-0x000001F15E6B0000-0x000001F15E6D4000-memory.dmp

Download

memory/3672-48-0x000001F15E6B0000-0x000001F15E6DA000-memory.dmp

Download

memory/3672-45-0x000001F15E650000-0x000001F15E66C000-memory.dmp

Download

memory/3672-47-0x000001F15E670000-0x000001F15E67A000-memory.dmp

Download

memory/3672-46-0x000001F15E910000-0x000001F15E9C3000-memory.dmp

Download

memory/4228-9-0x00000181B8EF0000-0x00000181B8F00000-memory.dmp

Download

memory/4228-8-0x00000181D15C0000-0x00000181D15E2000-memory.dmp

Download

memory/4228-0-0x00000181B8EF0000-0x00000181B8F00000-memory.dmp

Download

memory/4228-10-0x00000181D1CB0000-0x00000181D1E72000-memory.dmp

Download

memory/4228-14-0x00000181B8F00000-0x00000181B8F12000-memory.dmp

Download

memory/4228-1-0x00000181B8EF0000-0x00000181B8F00000-memory.dmp

Download

memory/4228-13-0x00000181B8E20000-0x00000181B8E2C000-memory.dmp

Download

memory/5416-69-0x000002ACB32D0000-0x000002ACB32DC000-memory.dmp

Download

memory/5632-31-0x000001D372310000-0x000001D372322000-memory.dmp

Download

memory/5632-30-0x000001D359D30000-0x000001D359D3C000-memory.dmp

Download

memory/5656-72-0x0000021A6E7F0000-0x0000021A6E7FC000-memory.dmp

Download