bunnyloader | 9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sub_9b95dc377440.exe
Size 1.0MB
Sample260524-cg69pse19j
SHA256 9b95dc37744055c1d9cec9f4383ddb52bf0436a3ae88112b782211a02533fa88
MD5 4334e838a1ad1e35a533d8ff6d55ea3d
SHA1 cb617e4af09ee90e8918fb7488337a935750a318
SHA512 0e107f77986171d13358eb780fbb3c243f1f4afbbfe5f615172e15de2bc1948932b82e592abedb03262444c81ebc86e1e2bfe7fffb3f964289a31c2f5e863dff
SSDEEP 24576:0z28lByb3DFSo0hs6vZ0MZ0ZvJPqljO35FhAJacjuFlewy:0K8vommMtZO35FoQm
TLSH
T137351201A652613AE8B315F7CBFF642C5B3C6A110709A9D797CC19AD8B2D9E33E3015B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution bunnyloader loader persistence

Malware Config

Signatures

Family: BunnyLoader
BunnyLoader is a loader family written in C++.
loader bunnyloader

Detect BunnyLoader 3 IoCs

resource	yara_rule
behavioral1/memory/332-36-0x0000000004FE0000-0x000000000503D000-memory.dmp	family_bunnyloader
behavioral1/memory/332-37-0x0000000004FE0000-0x000000000503D000-memory.dmp	family_bunnyloader
behavioral1/memory/332-38-0x0000000004FE0000-0x000000000503D000-memory.dmp	family_bunnyloader

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 332 created 3244	332	Memo.pif	55
PID 332 created 3244	332	Memo.pif	55

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	sub_9b95dc377440.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	wscript.EXE

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
332	Memo.pif
2420	ZenPulse.pif

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	api.ipify.org

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2752	tasklist.exe
3960	tasklist.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Memo.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ZenPulse.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sub_9b95dc377440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
212	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
212	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
568	schtasks.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
332	Memo.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif

Suspicious use of AdjustPrivilegeToken 44 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	tasklist.exe
Token: SeDebugPrivilege	3960	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3608	WMIC.exe
Token: SeSecurityPrivilege	3608	WMIC.exe
Token: SeTakeOwnershipPrivilege	3608	WMIC.exe
Token: SeLoadDriverPrivilege	3608	WMIC.exe
Token: SeSystemProfilePrivilege	3608	WMIC.exe
Token: SeSystemtimePrivilege	3608	WMIC.exe
Token: SeProfSingleProcessPrivilege	3608	WMIC.exe
Token: SeIncBasePriorityPrivilege	3608	WMIC.exe
Token: SeCreatePagefilePrivilege	3608	WMIC.exe
Token: SeBackupPrivilege	3608	WMIC.exe
Token: SeRestorePrivilege	3608	WMIC.exe
Token: SeShutdownPrivilege	3608	WMIC.exe
Token: SeDebugPrivilege	3608	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3608	WMIC.exe
Token: SeRemoteShutdownPrivilege	3608	WMIC.exe
Token: SeUndockPrivilege	3608	WMIC.exe
Token: SeManageVolumePrivilege	3608	WMIC.exe
Token: 33	3608	WMIC.exe
Token: 34	3608	WMIC.exe
Token: 35	3608	WMIC.exe
Token: 36	3608	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3608	WMIC.exe
Token: SeSecurityPrivilege	3608	WMIC.exe
Token: SeTakeOwnershipPrivilege	3608	WMIC.exe
Token: SeLoadDriverPrivilege	3608	WMIC.exe
Token: SeSystemProfilePrivilege	3608	WMIC.exe
Token: SeSystemtimePrivilege	3608	WMIC.exe
Token: SeProfSingleProcessPrivilege	3608	WMIC.exe
Token: SeIncBasePriorityPrivilege	3608	WMIC.exe
Token: SeCreatePagefilePrivilege	3608	WMIC.exe
Token: SeBackupPrivilege	3608	WMIC.exe
Token: SeRestorePrivilege	3608	WMIC.exe
Token: SeShutdownPrivilege	3608	WMIC.exe
Token: SeDebugPrivilege	3608	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3608	WMIC.exe
Token: SeRemoteShutdownPrivilege	3608	WMIC.exe
Token: SeUndockPrivilege	3608	WMIC.exe
Token: SeManageVolumePrivilege	3608	WMIC.exe
Token: 33	3608	WMIC.exe
Token: 34	3608	WMIC.exe
Token: 35	3608	WMIC.exe
Token: 36	3608	WMIC.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
332	Memo.pif
332	Memo.pif
332	Memo.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
332	Memo.pif
332	Memo.pif
332	Memo.pif
2420	ZenPulse.pif
2420	ZenPulse.pif
2420	ZenPulse.pif

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 768	4880	sub_9b95dc377440.exe	91
PID 768 wrote to memory of 2752	768	cmd.exe	93
PID 768 wrote to memory of 3276	768	cmd.exe	94
PID 768 wrote to memory of 3960	768	cmd.exe	96
PID 768 wrote to memory of 880	768	cmd.exe	97
PID 768 wrote to memory of 560	768	cmd.exe	98
PID 768 wrote to memory of 2556	768	cmd.exe	99
PID 768 wrote to memory of 644	768	cmd.exe	100
PID 768 wrote to memory of 332	768	cmd.exe	101
PID 768 wrote to memory of 212	768	cmd.exe	102
PID 332 wrote to memory of 3500	332	Memo.pif	103
PID 332 wrote to memory of 4016	332	Memo.pif	104
PID 4016 wrote to memory of 568	4016	cmd.exe	107
PID 332 wrote to memory of 4640	332	Memo.pif	111
PID 4640 wrote to memory of 3608	4640	cmd.exe	115
PID 1592 wrote to memory of 2420	1592	wscript.EXE	129

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3244
- C:\Users\Admin\AppData\Local\Temp\sub_9b95dc377440.exe
  "C:\Users\Admin\AppData\Local\Temp\sub_9b95dc377440.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k move Azerbaijan Azerbaijan.bat & Azerbaijan.bat & exit
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2752
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3960
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa.exe opssvc.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:880
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 14709
      4⤵
      System Location Discovery: System Language Discovery
      PID:560
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Ap + Friend + County + Laws + Plant 14709\Memo.pif
      4⤵
      System Location Discovery: System Language Discovery
      PID:2556
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b Bring 14709\g
      4⤵
      System Location Discovery: System Language Discovery
      PID:644
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\14709\Memo.pif
      14709\Memo.pif 14709\g
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:332
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /value
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4640
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName /value
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3608
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 5 localhost
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:212
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url" & echo URL="C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZenPulse.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:3500
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Hotmail" /tr "wscript 'C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js'" /sc minute /mo 3 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Hotmail" /tr "wscript 'C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js'" /sc minute /mo 3 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:568

C:\Windows\system32\wscript.exe
wscript
1⤵
PID:3272

C:\Windows\system32\wscript.EXE
C:\Windows\system32\wscript.EXE "C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.pif
  "C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.pif" "C:\Users\Admin\AppData\Local\MindWave Technologies LLC\Y"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ZenPulse.js

Path C:\Users\Admin\AppData\Local\MindWave Technologies LLC\ZenPulse.js
Size 186B
SHA256 585d69bad9df943444bc2b787af11a0d4641a6a9a50bc08d937eebad986498c3
MD5 9e4fea19021e58c034eb119400077790
SHA1 b2a08bf0392273c044ce889f4091260822bf8f7c
SHA512 6e008662340d43cfec8184c7e4f5493b15318b73eb46ec1a0da0d0501933394ed9db5f706845b097bbabe10a6f2742a2d70deb65a16e1fa9df742cc2d09d7aee
TLSH
T168C0C965B14BFF20A828230D67329C5DC9D4048934E42381AA9090CD76A6E7C48D680A
MD5 SHA1 SHA512 TLSH

Submit Download

Memo.pif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\14709\Memo.pif
Size 924KB
SHA256 f58d3a4b2f3f7f10815c24586fae91964eeed830369e7e0701b43895b0cefbd3
MD5 848164d084384c49937f99d5b894253e
SHA1 3055ef803eeec4f175ebf120f94125717ee12444
SHA512 aabe1cf076f48f32542f49a92e4ca9f054b31d5a9949119991b897b9489fe775d8009896408ba49ac43ec431c87c0d385daead9dbbde7ef6309b0c97bbaf852a
SSDEEP 24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
TLSH
T109158C0333918062FE97A5335F5FE7265B7C6D2A0323B52F13981E79BA701B1162E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Ap
Size 259KB
SHA256 61e6fb53b7c6b26fdfbee29d63bb36c8dd33ed7fb8ed97ca488d107fbc1ba3c3
MD5 a745de26cccd7229f9b3083e0e657c51
SHA1 ee6792f27d4d5e07f0d41dbd95b0fec772a94abf
SHA512 9f1701d197b8e0fb1cd929404bfd9440c7ba5c724493a9a4831d9a885d1b6b169b67f344e73facefe18a753ebe22d78c61ea551a4820b7fb471d4b6670d9cc00
SSDEEP 6144:LQBk7JjX74cN0lrztgwU0Wyw3mFygyE4mqd12lq+:LO0z8e0lvSr0Wyw20K4mqClq+
TLSH
T12B449D11B881F1B1C45E1C300F65EA625E7CAE76032A79CBA7E81D364F748C26736F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Azerbaijan

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Azerbaijan
Size 10KB
SHA256 75978ba45715cad18f1dc9acc0eec4a1e6194cda6cfcb44daaeb851be665f52e
MD5 44c71397920468dddf7bb1dc8933259f
SHA1 fdf205c1c85f3b59dc4cf66523172fa3f37efce8
SHA512 bf8b7e54ae65e4691a7981d6af792797be90bd55554f3f3d9316d0993e421a426046ced50cc91eac0bedaadbc315326201da640190192c1d6ff2d50a3c32369a
SSDEEP 192:xIWA0T5pN0X2qf1WuVuP/oNCjBjrA+zYEnld7E1WHqmVZAWET8hDnRmqOOzE1fLT:1A2LN0mqtWuVEz9jrA+Rld7E14q4SWEP
TLSH
T1DD22A54498E0DD917F9CB7A2282DAC417D71D21D726B04F6B0843CFA353826FC9A9997
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bring

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Bring
Size 878KB
SHA256 cd82e9442c7643b70b267a68f2bbe271298e7474b8310cd50e4b6e586b7d9f44
MD5 b833ca1c2478a60371622ef394d6867d
SHA1 4278d7af0744ed090c541563cbc2792988d00cd6
SHA512 973dac96f9ecdf43b2bee02ffbc06583375c3fa6d2abe3541e8bb3697a6bee49f824954abb37b3385ddaf2c3447d8cea83e063349a8d5971ae0908f5430cfb0a
SSDEEP 12288:1sUK4IFBTy3J4Ywo6a+fgca4FBKwB2HrE1srsZV:uVTYJnofgca4cEers3
TLSH
T136157BF5B27E05C38A1067CA7CD02AF70F22077950BF0E7025A675D90AFA4E955AEC2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

County

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\County
Size 206KB
SHA256 70c40c9ca3ccfe1176875a073e911e8deb3e015b6ef2fd0051223a335dd76033
MD5 23bfb44f90ecf7e147b21aeb638be0e8
SHA1 0764403645568683a776ef34bf4eb7c7f8775e6e
SHA512 d8e8caccff81bee0f30b2c12c40a976b9d1df94c50208647959bce2ea3dd4a2989ba4bec0918a0ff8a9456f5dad217acfb03b46f3c97eebb7139ff9760e29278
SSDEEP 6144:mGfm608DsvqJX4xNAB+xHFq9O0lHPOGUWLhxjRYmFqZi:mKmNvqJWNAB+X0lHPOGNnlMZi
TLSH
T1DC248D633A4100A2EE6303B1CE6DFA26B7AC8A1B0115FB67235E0CD8FBD1456656F1D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Friend

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Friend
Size 156KB
SHA256 f70978891348d7b742c8012d05be109c5d93e05207dd0ac4d16484e496973552
MD5 8a0bdcea077716b3eefce44a2de444ab
SHA1 3724020a71d0f9cc13e5f7bd4d079c92fdb01bed
SHA512 5ea039830291f78baabc13e00cae55532cf4aa77aca03955fb080e7da1b79f55334b22198238e85f090c3f76898cacf3a476704acd53672181d349d7a624cca7
SSDEEP 3072:eEAehuqCkrwzW3Nzl8F5hPLaLWysRIO7vHZnBfzHl8Dz5YaZYvlfAT:eEAehuqN8zwNzlmhPL1b5nZ2tZ6lfAT
TLSH
T1A3F3BF9374825086C95301B05E2FFA957E7DE9370438FE4A9BD82C66FB858A1176F383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Laws

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Laws
Size 284KB
SHA256 c522ac485cfbdb75bb3f35bfe62263fb17cb64464e111d2e287b9084a85ff670
MD5 cadb4ef1a35122c6bff9f2e1774ebbe9
SHA1 b711c1429a69a8922da301606b2e19648a0fe537
SHA512 6000f5511240431a9e320c5e2351a8518642786fe1aa0a59a5d523eb7899b88bf6e3ab5629d6cbf34866974b41511fdc55a83923c56da0caa92f20f360641f7e
SSDEEP 3072:Y5A3q5eAg0Fuz08XvBNbIaAtbPf6jKj+wsxjgarB3RZgDWy4ZNogXJ3g:+EAOz04pmdV364EgarxUaBZ2mw
TLSH
T17D54940263F58517FFE3F63B2A9AD36A46797D5E4323503F12582B7AB8702704A2D631
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plant

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Plant
Size 19KB
SHA256 7d270a6900ef6385133b30e462bd157aa925543abaaf248cffe263fae0c33f4b
MD5 29d98b6cbc770d518dfbf5fd2f4fa178
SHA1 1d030e6fd228895d071c28f8e5f70676646f3734
SHA512 8e3e890523a31c0ab4ac80400215fdd860dacedd45baf25e02a61b3f52b7fad8424c632ce2996f6f0a6e69f8a29db838febdab7636e7204b50790ae0adf0e0f6
SSDEEP 384:VR0Xvwp52UW1l/hw50gFQTVaeCV1VEVFJ8ZcGwGBk7/UMQ3K6:SE2UWb/hMjFQTVat3VEV3GPkjI
TLSH
T19F927C170A3A1693EB058CBCF6DCFB0B9DFDE6D1D5DD481BA01682E8440A39576D822F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/332-33-0x0000000004FE0000-0x000000000503D000-memory.dmp

Download

memory/332-34-0x0000000004FE0000-0x000000000503D000-memory.dmp

Download

memory/332-35-0x0000000004FE0000-0x000000000503D000-memory.dmp

Download

memory/332-36-0x0000000004FE0000-0x000000000503D000-memory.dmp

Download

memory/332-37-0x0000000004FE0000-0x000000000503D000-memory.dmp

Download

memory/332-38-0x0000000004FE0000-0x000000000503D000-memory.dmp

Download