8fb20f24c3fb44abc4d88278fae943595bb5cf3937cb0e983ec51e8c52ca3e6d

Analysis

user interaction
yes
max time kernel
869s
max time network
805s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OrangeLoader.exe
Size 77KB
Sample260828-env65asxd1
SHA256 8fb20f24c3fb44abc4d88278fae943595bb5cf3937cb0e983ec51e8c52ca3e6d
MD5 c2f5b2f5f14ea8cef92877848a581275
SHA1 7359dd9ec0916bb1ac3f7f317a5dd2482eb99341
SHA512 c77ebfffed66dea82d26282cc0a9c000fb6aed26c03d4505e922c4ef7c4e85c51e49470e075e987705b12e222dada2801e7669ad3c204978ae85db80aa703788
SSDEEP 1536:Zq4OVgCUb1BgnyypLyYcPM/xR46YeLLtAi1sSFtni39XsSenOumSEYc:uSb10yypLyrEf418R+
TLSH
T10573194066EC4626FABB4BBCDD7681410B397957A43ECB0E30BE98DC64D139245C37AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMxSEfzIjebmOHXxffRZx\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\SMxSEfzIjebmOHXxffRZx"	mapper.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vICGXkjWrVMbqWfn\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\vICGXkjWrVMbqWfn"	mapper.exe

Executes dropped EXE 4 IoCs

pid	Process
4308	mapper.exe
6084	OrangeExtenal.exe
5820	mapper.exe
4876	OrangeExtenal.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3756	powershell.exe
6488	powershell.exe
6488	powershell.exe
3756	powershell.exe
6880	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
7	raw.githubusercontent.com
8	raw.githubusercontent.com
9	raw.githubusercontent.com
13	raw.githubusercontent.com
14	raw.githubusercontent.com
16	raw.githubusercontent.com

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4816	sc.exe
3220	sc.exe
6328	sc.exe
200	sc.exe
3288	sc.exe
2520	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6820	cmd.exe
3972	cmd.exe
2452	cmd.exe
4752	cmd.exe
4536	cmd.exe
6020	cmd.exe
6604	cmd.exe
5976	cmd.exe
4236	cmd.exe
3512	cmd.exe
5824	cmd.exe
4368	cmd.exe
1732	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6880	powershell.exe
6880	powershell.exe
4308	mapper.exe
4308	mapper.exe
3756	powershell.exe
3756	powershell.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
5820	mapper.exe
5820	mapper.exe
6860	OrangeLoader.exe
6488	powershell.exe
6488	powershell.exe
6488	powershell.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe
6860	OrangeLoader.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4308	mapper.exe
5820	mapper.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	OrangeLoader.exe
Token: SeDebugPrivilege	6880	powershell.exe
Token: SeDebugPrivilege	6860	OrangeLoader.exe
Token: SeDebugPrivilege	4308	mapper.exe
Token: SeLoadDriverPrivilege	4308	mapper.exe
Token: SeDebugPrivilege	3756	powershell.exe
Token: SeDebugPrivilege	5820	mapper.exe
Token: SeLoadDriverPrivilege	5820	mapper.exe
Token: SeDebugPrivilege	6488	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 6604	4420	OrangeLoader.exe	90
PID 6604 wrote to memory of 4784	6604	cmd.exe	92
PID 4420 wrote to memory of 6820	4420	OrangeLoader.exe	97
PID 6820 wrote to memory of 6880	6820	cmd.exe	99
PID 6860 wrote to memory of 5976	6860	OrangeLoader.exe	101
PID 5976 wrote to memory of 3944	5976	cmd.exe	103
PID 6860 wrote to memory of 3972	6860	OrangeLoader.exe	104
PID 3972 wrote to memory of 2520	3972	cmd.exe	106
PID 6860 wrote to memory of 2452	6860	OrangeLoader.exe	107
PID 2452 wrote to memory of 4816	2452	cmd.exe	109
PID 6860 wrote to memory of 4308	6860	OrangeLoader.exe	110
PID 6860 wrote to memory of 4752	6860	OrangeLoader.exe	112
PID 4752 wrote to memory of 3220	4752	cmd.exe	114
PID 6860 wrote to memory of 3756	6860	OrangeLoader.exe	115
PID 3756 wrote to memory of 6084	3756	powershell.exe	117
PID 6084 wrote to memory of 4236	6084	OrangeExtenal.exe	119
PID 6084 wrote to memory of 3512	6084	OrangeExtenal.exe	120
PID 6860 wrote to memory of 4536	6860	OrangeLoader.exe	124
PID 4536 wrote to memory of 6328	4536	cmd.exe	126
PID 6860 wrote to memory of 6020	6860	OrangeLoader.exe	127
PID 6020 wrote to memory of 200	6020	cmd.exe	129
PID 6860 wrote to memory of 5820	6860	OrangeLoader.exe	130
PID 6860 wrote to memory of 5824	6860	OrangeLoader.exe	132
PID 5824 wrote to memory of 3288	5824	cmd.exe	134
PID 6860 wrote to memory of 6488	6860	OrangeLoader.exe	135
PID 6488 wrote to memory of 4876	6488	powershell.exe	137
PID 4876 wrote to memory of 4368	4876	OrangeExtenal.exe	139
PID 4876 wrote to memory of 1732	4876	OrangeExtenal.exe	140

C:\Users\Admin\AppData\Local\Temp\OrangeLoader.exe
"C:\Users\Admin\AppData\Local\Temp\OrangeLoader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6604
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled
    3⤵
    PID:4784
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -command "Expand-Archive -Path "C:\Users\Admin\AppData\Local\Temp\Orange.zip" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\Orange_Update" -Force"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -command "Expand-Archive -Path "C:\Users\Admin\AppData\Local\Temp\Orange.zip" -DestinationPath "C:\Users\Admin\AppData\Local\Temp\Orange_Update" -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6880

C:\Users\Admin\AppData\Local\Temp\OrangeLoader.exe
"C:\Users\Admin\AppData\Local\Temp\OrangeLoader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6860
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled
    3⤵
    PID:3944
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc stop OrangeDriver
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\system32\sc.exe
    sc stop OrangeDriver
    3⤵
    - Launches sc.exe
    PID:2520
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc delete OrangeDriver
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\system32\sc.exe
    sc delete OrangeDriver
    3⤵
    - Launches sc.exe
    PID:4816
- C:\Users\Admin\AppData\Local\Temp\assets\mapper.exe
  "C:\Users\Admin\AppData\Local\Temp\assets\mapper.exe" "C:\Users\Admin\AppData\Local\Temp\assets\driver.sys"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc query OrangeDriver
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\system32\sc.exe
    sc query OrangeDriver
    3⤵
    - Launches sc.exe
    PID:3220
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process "C:\Users\Admin\AppData\Local\Temp\assets\OrangeExtenal.exe" -Verb RunAs
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Users\Admin\AppData\Local\Temp\assets\OrangeExtenal.exe
    "C:\Users\Admin\AppData\Local\Temp\assets\OrangeExtenal.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:4236
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      4⤵
      Executes a command shell one-liner
      PID:3512
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc stop OrangeDriver
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\system32\sc.exe
    sc stop OrangeDriver
    3⤵
    - Launches sc.exe
    PID:6328
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc delete OrangeDriver
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Windows\system32\sc.exe
    sc delete OrangeDriver
    3⤵
    - Launches sc.exe
    PID:200
- C:\Users\Admin\AppData\Local\Temp\assets\mapper.exe
  "C:\Users\Admin\AppData\Local\Temp\assets\mapper.exe" "C:\Users\Admin\AppData\Local\Temp\assets\driver.sys"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:5820
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c sc query OrangeDriver
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\system32\sc.exe
    sc query OrangeDriver
    3⤵
    - Launches sc.exe
    PID:3288
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process "C:\Users\Admin\AppData\Local\Temp\assets\OrangeExtenal.exe" -Verb RunAs
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6488
- - C:\Users\Admin\AppData\Local\Temp\assets\OrangeExtenal.exe
    "C:\Users\Admin\AppData\Local\Temp\assets\OrangeExtenal.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      4⤵
      Executes a command shell one-liner
      PID:4368
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      4⤵
      Executes a command shell one-liner
      PID:1732

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3880

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 39cd28811df3b0ae5ddbca83f28b5b5394efa229cfb1cb7159de1f32a9bb4ba3
MD5 19aea8b9d0299e9065c9d7844a509968
SHA1 4a1c7e49f287987ac9b0b0c2224f0141cfccbdb5
SHA512 ff8695d9ae0436e07956a70299a34aeb90dfbc5c18e269a8c49a946624900dea38a13e666e2a5aeb377e9a8e21e30b6c3ee8fd93fb372824c4d20e25a0421a81
TLSH
T1DA31C99F4EB135907F806E8336CDD537ADA256D16CBE0045923A90D52F103D52796459
MD5 SHA1 SHA512 TLSH

Submit Download

8ACEC8747D37D5B985991505B117E8E9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8ACEC8747D37D5B985991505B117E8E9
Size 38KB
SHA256 8f892f5bce98f912d76697867e51c77aeb9d7480bf058883739099a3073e6631
MD5 feedb4ce682a8f270726838fb0b35fe2
SHA1 2f2408526cd170e29e1388281727156b9c909bdd
SHA512 4c92e511c292fb82fa1825e5b8af6ccc83667230f72de94730447c8b716aa026034de193bc6ca2dffd7d1b87b792ecb35695066a777ddd71e7b321e2654224ab
SSDEEP 768:7nvFcm/pHtgYgLM5WY+iM2mXLtaEGtYmYfEAL843C:bvFBvj2JaENo/
TLSH
T1B60340585858B6739586AF31CDCA8E97ADF5A3811BD5C01E92712E014420FEF9FE32E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 78350d92efca9e0446e4eb034da1d089add9cb4cf59172c2c2d4360afefa13a7
MD5 4ec75c730d31bbdef4618b2f1c31a6b0
SHA1 76fb9c8ff49c8c21e685f1c694f7602a5bd333c4
SHA512 865bb3ae52c79d94ea8174ebbfebb8b25f0fe3fae1dd03102012efad800884f99cf423501ccea8d7b237b46d7081737440b7c946895da3caac11e94fc6b35261
TLSH
T1DBE0260869B9913DF431D9394BCEB9A7076FE226344942F01AA44708BB4AE512D97DB8
MD5 SHA1 SHA512 TLSH

Submit Download

8ACEC8747D37D5B985991505B117E8E9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8ACEC8747D37D5B985991505B117E8E9
Size 192B
SHA256 a0761a9a1d6936e11a40e1ae52280acd13e069c7a2dc1d65f7e088a5ff45a63a
MD5 0a2e0e05e7a9edcf232e7cfdf656b7f5
SHA1 0bfddcc3eefe3b7300276e2f51091022cdb62081
SHA512 62f464c4d1340fe01f6305172505c6695b3276317690b627e8236fbc75ad775352a0afc3600260ff1d1281b136a76e9c3751f0ee27afe0597edb255057ae2fb7
TLSH
T121C08C8032A21284E01C117E6DA0AB0213F46A19C98183462BF46A1958ACA889CB0E47
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 712e532df307cd5adca7d3f0083e360b76bb7a4f77b2dc0b37b70088736d6c65
MD5 158484f2a0f8ee2e115185013758d8d0
SHA1 903c3b10545d406698f34054d9d2acf4ba52a542
SHA512 df65ae25dcd83936aa877864d53240c96b688f56fd81d68e92fdb072aa874b9c2997fd14d9b4f93e71fc137122132db6cbd6a982b295440c5052841e6454ae57
TLSH
T14A317933B3DC86E8D899413A00CAAD1037B693D790DECED77B84D249B53F298DE60690
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d07c02828085acdfb893cdde6c453993383a1a0ba5c3ce47ad59e66d6e65c60d
MD5 781571199a86821004c430d6f51f7772
SHA1 c269022d2c18b8ad582e06b6b1fdd8f6ab01cb53
SHA512 3444d46d55b14eb1cec59e95d5ade24a2a2ecc2c7384e6a57c07dd1310a570d6e59eb090e2c195ce4bd02628ca7afb157df57c9a0ac84de36c72bdc450ef24bf
TLSH
T122115733F3CC8624C89A403650CEAC1036B587DB50DECE6BBB84D154B43F599CE61660
MD5 SHA1 SHA512 TLSH

Submit Download

Orange.zip

Path C:\Users\Admin\AppData\Local\Temp\Orange.zip
Size 473KB
SHA256 fc599a7f594e37ffd5c6ae0abfb2d570b2ca483e0eecbb728f04e36ca9158871
MD5 f2187ef6632439e332ed123aa45eaa80
SHA1 b5ba134255c31a97ac4da27df2d4f407d0a51bf5
SHA512 bac950ede2b4eb25abc203bad4147eecb037a58bb4c4e8c1a09d5fdfa255e7166d415e8d5abaad3f894b87fad3266666f4d949048c8e666e3318e7666e90bccc
SSDEEP 12288:jwH20MJ/ljL9LniV0uZIuEvuADDpn99HcJRLhX3cUV7rTwvW25UV:jrFdlFimuYd99CLhXsUV7lYUV
TLSH
T140A43389D645AC9EF06714F6BB000358B39084A30D7A5A09436F78E856E7F7E39BCC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OrangeExtenal.exe

Path C:\Users\Admin\AppData\Local\Temp\Orange_Update\OrangeExtenal.exe
Size 803KB
SHA256 123068095ef1ee5dee487522feff97d5196e9fcce08a46bbfbd97700f0d07529
MD5 e654fccfc6e04627b568db4fe77d37ab
SHA1 f9e335d09d287bca158cf91c44eb274a5c8e15e7
SHA512 5bf69366fe68d6c0b54c9f8f0bcda58b16f3365f11de61c0b36c1c32075aec4056e8cfd8a40f4a4824be482e9baf37cb590e79d7176f53f5b11223cd8a12d962
SSDEEP 24576:hEDVZG8p34yxfr8ipXqh0lhSMXlRiansZvm:hyBbXngan
TLSH
T16005BF45F1A841FCD06B91759987A61FEE323849032056DB23F495A83FB3BF16B7A702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

driver.sys

Path C:\Users\Admin\AppData\Local\Temp\Orange_Update\driver.sys
Size 10KB
SHA256 4ddfd1461f178434c877d98e6b6f24982224898a50a19c66b278ddf22848ed28
MD5 2ca4d4995922753f2973f7bfbbfac319
SHA1 7e11f39bd894a06fdead7fb87c2691d2f4149d29
SHA512 96e514b295a182615b3ff2d0136155d02b78dbfeb294afd477560bd2d62b436731435e11daacb49e790f29feb248876664f5512f6d38c510c86c3bc4dbe030af
SSDEEP 192:H7UWD7DHIUNmKaYcHEOzDHB1rD4aeFV7F:4WDocFa5pB9CF
TLSH
T1EF321AB0A25B9AD1E52E343AE1C61929F164F00513628BEFDAB0C93D4F93DC52C3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mapper.exe

Path C:\Users\Admin\AppData\Local\Temp\Orange_Update\mapper.exe
Size 150KB
SHA256 07000932db266d4a1442f2ff4347d319e38fc531fa3f8bc2e6e3eaa72f5864b1
MD5 939dc4a5e02b22c93308f3e35b001de9
SHA1 c84c71c94a462d10273e5d3e4c56829b760056f1
SHA512 786cd6ed4971134c82ecff592a6a43cb206b3a2878ea0b4032943c4d8432e26901a3802c04a044e7eb17d27ecb188e11d572c535e61250d326f8cbbb9e140b82
SSDEEP 3072:xNgVrsyfheksDQFqOMkwZmJTQSaMm5/6yGLCQ:0++hedQ/VFWlluC
TLSH
T1D3E32A179BA5102DE1B7D6B9CAB20911EB717C550B74E6CF135048BA0E72BD0BE3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_vuwf1qjz.blk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vuwf1qjz.blk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 08bc05e4cba29e88bff6724c00cb7689a105eb19f4b475e874c7cc611e018e9d
MD5 b1c96d11e72908ed8647ba646541b85e
SHA1 132d7296ee1ca71646af84679ff0dd41955deb30
SHA512 9ffce85e556d299bd9207079f5c0ffb6cc023dcaf1aa932494109f94f8b02d2a7467d078f0eea40e354deb083dbc8d9b04a65bb7ff40538fa82d496db16a0916
SSDEEP 48:NQo8/5EsWGHyCbTUN5PaJFnukvhkvklCywMord15AWXJhSogZotdPdV5AWDJhSoy:Ni5yCcDcFukvhkvCCtv5AWQH05AaQHX
TLSH
T17ED1AC1017F6561AF1B74F7A6C75B721A235FD019F1AEBCE0240925D9C31615E83872B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 6KB
SHA256 de3450b54346946bbec315b6a5412f9e2708d3970d581221a04f8eb357752a60
MD5 4f82e90b35b5f978cb420736b7651fed
SHA1 53f77afaaaacd94a3aa2fc6ea5c0a1942cd15aa6
SHA512 a7a26f8b6c5688ccd730c23f39044b546d2bf4c252312fb51384d2fa0f2f3f5ef3768386b19d28c3859846fc52e424932820826f92e9518cca477154235b0069
SSDEEP 48:NQo8D5EsWGHyCbTUNxsJFnukvhkvklCywMord15AWDJhSogZotdPdV5AWDJhSogB:Na5yCcTGFukvhkvCCtv5AaQH05AaQHX
TLSH
T198D1CD1017F6561AF1B78F7AACB5B721A235FD019F1AEBCE0240925E9C31615E83872F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Roaming\orange\data.txt
Size 132B
SHA256 1b8ad5a55eeabe0b00f04629e724ee3fa98e903a3cfb26fc91c76346dab512ea
MD5 47ea02f64dca2677c6adfba2c87eb107
SHA1 4d9762501c0f0a03a2f72bb6c9c401b86fcb8b21
SHA512 041b65a4d6dcbec637d14733935095352341f1ebac0f502237c37a861be1acd9a4deafd84ab351370b76ffc57b54d0caa7076b6794c63012be43eaa88b6bd8d6
TLSH
T14CC09B714500F0D735D00A7DC3584B034775CDD59D0146DEC55B36557707404595A45A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4420-42-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-8-0x00000230E7FA0000-0x00000230E7FA8000-memory.dmp

Download

memory/4420-17-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-1-0x00000230C8450000-0x00000230C8468000-memory.dmp

Download

memory/4420-2-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-3-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-4-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-5-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-6-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-15-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-14-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-13-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-11-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-0-0x00007FF96012F000-0x00007FF960130000-memory.dmp

Download

memory/4420-9-0x00000230E7720000-0x00000230E775E000-memory.dmp

Download

memory/4420-10-0x00000230E76F0000-0x00000230E76FE000-memory.dmp

Download

memory/4420-16-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/4420-7-0x00007FF95FFA0000-0x00007FF960944000-memory.dmp

Download

memory/6880-28-0x00000233A8400000-0x00000233A840A000-memory.dmp

Download

memory/6880-27-0x00000233A84E0000-0x00000233A84F2000-memory.dmp

Download

memory/6880-26-0x00000233A84E0000-0x00000233A84EA000-memory.dmp

Download

memory/6880-25-0x00000233A8420000-0x00000233A84D2000-memory.dmp

Download

memory/6880-24-0x00000233A8400000-0x00000233A841E000-memory.dmp

Download

memory/6880-19-0x00000233900B0000-0x00000233900D2000-memory.dmp

Download