48845030f7171d18d82990a179ea6cb2ab433a8c152fccd570584da16c0ffe83

Analysis

max time kernel
608s
max time network
500s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
23-06-2023 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PBCCRCPassGuardEdge.exe
Size

2.7MB
MD5

c0568331b9984599f57d7bbe11e17cd9
SHA1

4860334bc492832586a10f28aaa4c1e9c59ed847
SHA256

57a1929e2863a92d4e1dfdc5c0f34edfd28e7b7a8995a5afb5da3653d1ca4856
SHA512

cb58825cef114ca73eac6bbf5995077c5b34a627a36b5557c1be591aec5312b2ce1708b01cfe7db665f8586e3e5181e2ff455a487a2ea6718784ae8cbbd226f6
SSDEEP

49152:FtXXx7d5hSa3sWgOAhnvpAyw0rqMjdomso+NMnCPFLesr8xEZgCCDPLpGrpWBATJ:h7d5IalgOAjyaqM59sbNMnyezxEZ87LS

Score

8^/10

discovery spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\PassGuard_x64.sys	PBCCRCPassGuardX.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	PBCCRCPassGuardXInputService.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	PBCCRCPassGuardXInputService.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-508929744-1894537824-211734425-1000\Control Panel\International\Geo\Nation	PBCCRCPassGuardEdge.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\PBCCRCNew\uninst.exe	PBCCRCPassGuardEdge.exe
File created	C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardX.exe	PBCCRCPassGuardEdge.exe
File created	C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe	PBCCRCPassGuardEdge.exe
File created	C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInput.exe	PBCCRCPassGuardEdge.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
220	PBCCRCPassGuardXInputService.exe
4680	PBCCRCPassGuardXInputService.exe
4144	PBCCRCPassGuardXInput.exe
1964	PBCCRCPassGuardXInputService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 6 IoCs

pid	Process
220	PBCCRCPassGuardXInputService.exe
1064	PBCCRCPassGuardX.exe
4144	PBCCRCPassGuardXInput.exe
4680	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
5000	certmgr.exe

Loads dropped DLL 10 IoCs

pid	Process
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3436	schtasks.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7C2106C955C997C65E5770A3326A12D304BCBB88	certmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7C2106C955C997C65E5770A3326A12D304BCBB88\Blob = 0300000001000000140000007c2106c955c997c65e5770a3326a12d304bcbb882000000001000000fb030000308203f7308202dfa0030201020209008213409bd214e854300d06092a864886f70d01010b0500308191310b300906035504061302434e3110300e06035504080c074265694a696e673110300e06035504070c074265694a696e6731123010060355040a0c094d6963726f646f6e65310d300b060355040b0c04746563683114301206035504030c0b4d6963726f646f6e6543413125302306092a864886f70d01090116167765626d6173746572406d6963726f646f6e652e636e301e170d3138303132393037303933395a170d3338303132343037303933395a308191310b300906035504061302434e3110300e06035504080c074265694a696e673110300e06035504070c074265694a696e6731123010060355040a0c094d6963726f646f6e65310d300b060355040b0c04746563683114301206035504030c0b4d6963726f646f6e6543413125302306092a864886f70d01090116167765626d6173746572406d6963726f646f6e652e636e30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae670d30f0026938c96e266d114feb2b3b745ac04ad30fd9b1a87afbb5a6592a292641917b18a1f9df5cd18f56c82d07b227e1eb8becf8ce6df7a024f31655e69ad074c36fb7042659c3243cb76ed17e52685d0b1edc92a943ad9b4d6b45bcc308ffc5215a0786ae87fe225dd3215de8f434756adc826cf244adb69e93f60dfec5741530c2c36fdb4cf43c87eb6c16fbe2c5af0110c6ab2abdfdd1e83dbbc168ba1eae8d1ddfb0a6dc3c7dd7ffb415dcdd9ee1c6afcbd805926f05da20ed4bda774a8a13f300eb1d3661a807a15ffaa178e95c65f08eb7cfdfd3dbc82b3201b30c5683c07a176d41e6eb499b6adabc8ca87e8b8c324d7e46fddc08a97eeee3190203010001a350304e301d0603551d0e041604140aa0ee79a030c6168d18612b68553c00a24230bb301f0603551d230418301680140aa0ee79a030c6168d18612b68553c00a24230bb300c0603551d13040530030101ff300d06092a864886f70d01010b050003820101004fc56121fbdbe7061938954896508c14d58f1e0d226f1155e38a3f7a68cc4a99c1fd91ff45522f5bcef0bf88549b7be40cd663e80f47e26b0ca4fc1d77e93037a75ebe2b197c180468ac0694f3cb2add0c4505f35a5ccbecd0e1ebb10c440e568175f28120cc266b044f684e68a2fc646bbe19a9d2987d110b57ce91a15d9c5b754c20eddeb9778587257c150b6586ae8922acd4cee10509134c22eee09138441f186018a96267d52df7c267ae01fd41312e00df0a7ff9323b67ccd618b3e17dfdc2cdde7dfa320634c1faf88736a1ae2ed5908cf1c0b4d978f02acf0223dd18dfcd29475c549fb11b6106dfc8c334fb7e125b560a3fdfba70bce1f382b08f4b	certmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
4164	PBCCRCPassGuardEdge.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
4144	PBCCRCPassGuardXInput.exe
4144	PBCCRCPassGuardXInput.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe
1964	PBCCRCPassGuardXInputService.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	PBCCRCPassGuardEdge.exe
Token: SeDebugPrivilege	4164	PBCCRCPassGuardEdge.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe
Token: SeDebugPrivilege	1964	PBCCRCPassGuardXInputService.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 736	4164	PBCCRCPassGuardEdge.exe	80
PID 4164 wrote to memory of 736	4164	PBCCRCPassGuardEdge.exe	80
PID 4164 wrote to memory of 736	4164	PBCCRCPassGuardEdge.exe	80
PID 4164 wrote to memory of 220	4164	PBCCRCPassGuardEdge.exe	82
PID 4164 wrote to memory of 220	4164	PBCCRCPassGuardEdge.exe	82
PID 4164 wrote to memory of 220	4164	PBCCRCPassGuardEdge.exe	82
PID 4164 wrote to memory of 1064	4164	PBCCRCPassGuardEdge.exe	83
PID 4164 wrote to memory of 1064	4164	PBCCRCPassGuardEdge.exe	83
PID 4164 wrote to memory of 1064	4164	PBCCRCPassGuardEdge.exe	83
PID 4164 wrote to memory of 4144	4164	PBCCRCPassGuardEdge.exe	84
PID 4164 wrote to memory of 4144	4164	PBCCRCPassGuardEdge.exe	84
PID 4164 wrote to memory of 4144	4164	PBCCRCPassGuardEdge.exe	84
PID 4164 wrote to memory of 4680	4164	PBCCRCPassGuardEdge.exe	85
PID 4164 wrote to memory of 4680	4164	PBCCRCPassGuardEdge.exe	85
PID 4164 wrote to memory of 4680	4164	PBCCRCPassGuardEdge.exe	85
PID 4144 wrote to memory of 3636	4144	PBCCRCPassGuardXInput.exe	86
PID 4144 wrote to memory of 3636	4144	PBCCRCPassGuardXInput.exe	86
PID 4144 wrote to memory of 3636	4144	PBCCRCPassGuardXInput.exe	86
PID 4144 wrote to memory of 3436	4144	PBCCRCPassGuardXInput.exe	90
PID 4144 wrote to memory of 3436	4144	PBCCRCPassGuardXInput.exe	90
PID 4144 wrote to memory of 3436	4144	PBCCRCPassGuardXInput.exe	90
PID 4164 wrote to memory of 5000	4164	PBCCRCPassGuardEdge.exe	91
PID 4164 wrote to memory of 5000	4164	PBCCRCPassGuardEdge.exe	91
PID 4164 wrote to memory of 5000	4164	PBCCRCPassGuardEdge.exe	91

C:\Users\Admin\AppData\Local\Temp\PBCCRCPassGuardEdge.exe
"C:\Users\Admin\AppData\Local\Temp\PBCCRCPassGuardEdge.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\SysWOW64\CheckNetIsolation.exe
  CheckNetIsolation LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
  2⤵
  PID:736
- C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe
  "C:\Windows\system32\PBCCRCNew\PBCCRCPassGuardXInputService.exe" "-install"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  PID:220
- C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardX.exe
  "C:\Windows\system32\PBCCRCNew\PBCCRCPassGuardX.exe" "-s"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  PID:1064
- C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInput.exe
  C:\Windows\system32\PBCCRCNew\PBCCRCPassGuardXInput.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\system32\schtasks.exe /delete /tn "ÈËÐÐÕ÷ÐÅ°²È«¿Ø¼þ°²È«ÊäÈë³ÌÐò" /f
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\system32\schtasks.exe /create /tn "ÈËÐÐÕ÷ÐÅ°²È«¿Ø¼þ°²È«ÊäÈë³ÌÐò" /tr "C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInput.exe" /sc onlogon
    3⤵
    - Creates scheduled task(s)
    PID:3436
- C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe
  "C:\Windows\system32\PBCCRCNew\PBCCRCPassGuardXInputService.exe" "-control" "PBCCRCPassGuardXInputService" "start"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Executes dropped EXE
  PID:4680
- C:\Users\Admin\AppData\Local\Temp\certmgr.exe
  "C:\Users\Admin\AppData\Local\Temp\certmgr.exe" -add "C:\Users\Admin\AppData\Local\Temp\wosign.cer" -c -s -r localMachine Root
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:5000

C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe
1⤵
- Drops file in Drivers directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\certmgr.exe

Filesize
77KB

MD5
ec58a1586ad70953d48e3c393163348f

SHA1
f18eebaea4460b057f5b49e8239779f1c0c05bb9

SHA256
a097cc322fa68e1ff500d79598f657d9c211e86e632c3c3b896e566852cea991

SHA512
05615c1ee6aeaf82a1d52e31f18c4174ae4d44e96fcd4466643f01ef431d4ad5022f3b4eb07e9f472ea43b59e8de5f3b5c10328e7109dafa4c3f3b9ff41b2da2

Download Submit
C:\Users\Admin\AppData\Local\Temp\certmgr.exe

Filesize
77KB

MD5
ec58a1586ad70953d48e3c393163348f

SHA1
f18eebaea4460b057f5b49e8239779f1c0c05bb9

SHA256
a097cc322fa68e1ff500d79598f657d9c211e86e632c3c3b896e566852cea991

SHA512
05615c1ee6aeaf82a1d52e31f18c4174ae4d44e96fcd4466643f01ef431d4ad5022f3b4eb07e9f472ea43b59e8de5f3b5c10328e7109dafa4c3f3b9ff41b2da2

Download Submit
C:\Users\Admin\AppData\Local\Temp\certmgr.exe

Filesize
77KB

MD5
ec58a1586ad70953d48e3c393163348f

SHA1
f18eebaea4460b057f5b49e8239779f1c0c05bb9

SHA256
a097cc322fa68e1ff500d79598f657d9c211e86e632c3c3b896e566852cea991

SHA512
05615c1ee6aeaf82a1d52e31f18c4174ae4d44e96fcd4466643f01ef431d4ad5022f3b4eb07e9f472ea43b59e8de5f3b5c10328e7109dafa4c3f3b9ff41b2da2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\KillProcDLL.dll

Filesize
4KB

MD5
99f345cf51b6c3c317d20a81acb11012

SHA1
b3d0355f527c536ea14a8ff51741c8739d66f727

SHA256
c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93

SHA512
937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\System.dll

Filesize
11KB

MD5
a436db0c473a087eb61ff5c53c34ba27

SHA1
65ea67e424e75f5065132b539c8b2eda88aa0506

SHA256
75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49

SHA512
908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\killer.dll

Filesize
6KB

MD5
16205cd992d3b3827573f93ab8923e4e

SHA1
4eece7a206ee619264d686ca1b3021b9f482866b

SHA256
967d66f23cf3d9d3e5a4d6a9c6e366e792a98cc8a293196095b10cd82da9a695

SHA512
257b2047b8e9303457bb050a760b8d2577da55642e4fb02933e6188d0591ff8adfe0c8df2a441577466f23a8e3bff2e94e9cfcfc381c4d255935123996c06d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\killer.dll

Filesize
6KB

MD5
16205cd992d3b3827573f93ab8923e4e

SHA1
4eece7a206ee619264d686ca1b3021b9f482866b

SHA256
967d66f23cf3d9d3e5a4d6a9c6e366e792a98cc8a293196095b10cd82da9a695

SHA512
257b2047b8e9303457bb050a760b8d2577da55642e4fb02933e6188d0591ff8adfe0c8df2a441577466f23a8e3bff2e94e9cfcfc381c4d255935123996c06d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\modern-wizard.bmp

Filesize
50KB

MD5
6b3a3f14e5e5e53ddcc884ec12d1cb3a

SHA1
70a0157b03568bd67b6b346fba30b1154d18eae0

SHA256
5e3496961d0c3d97b3667b9cabd366acc29e6c2e53ff1c0780af0242f89a1155

SHA512
424c1aab1348e3405d54ca1bef8d3325b845bba31ae7ccc24beff528fac33cfbf469c6127f918a6c02ba94982e7536d0b7dd8dfb3732f9206e340da2214c7cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\nsDialogs.dll

Filesize
9KB

MD5
e75ae7cfe06ff9692d98a934f6aa2d3c

SHA1
d5fd4a59a39630c4693ce656bbbc0a55ede0a500

SHA256
1f861aeb145ebbb9a2628414e6dca6b06d0bfb252f2de624b86814cfec8097d0

SHA512
ab4998f8f6bbb60321d0c2aa941d4e85319901960297059bf0832cf84b18dfbb120c3aa71963b46d3be3b7c9602434cb23f9a961c00de02403b3f266b294d41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstDEEC.tmp\nsDialogs.dll

Filesize
9KB

MD5
e75ae7cfe06ff9692d98a934f6aa2d3c

SHA1
d5fd4a59a39630c4693ce656bbbc0a55ede0a500

SHA256
1f861aeb145ebbb9a2628414e6dca6b06d0bfb252f2de624b86814cfec8097d0

SHA512
ab4998f8f6bbb60321d0c2aa941d4e85319901960297059bf0832cf84b18dfbb120c3aa71963b46d3be3b7c9602434cb23f9a961c00de02403b3f266b294d41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\wosign.cer

Filesize
1019B

MD5
252b7527e109b7320981a6fba6cd1084

SHA1
7c2106c955c997c65e5770a3326a12d304bcbb88

SHA256
fb64c2459b8ae9851dbffe57d03f9a5dff98cdc0ad231391e4476868dddfff2f

SHA512
d596172592128938f797ac1eba1b8b95c167d5abff6c8a4f5f37fd6c95c12621b8e7f20a2807a0f032ee695e5a7fc896580f194d8219bfa8b1b4c3b827895c94

Download Submit
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardX.exe

Filesize
1.0MB

MD5
52e22babfbfaf59f14859e175856115d

SHA1
45dc92d8fc7f3aba824be0f0519c2844506a5960

SHA256
7fa6544460b039457311bb310882c84801efa6c535e5ea360948803deb90c0e1

SHA512
796568eae06ed17a81c7a36d392b8fd03ddbd76d746564f91a6d395fc8245453c1f574fc448d3cec93710abcc6c2e113c2df62fa4facd7b6676d7036855310bf

Download Submit
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardX.exe

Filesize
1.0MB

MD5
52e22babfbfaf59f14859e175856115d

SHA1
45dc92d8fc7f3aba824be0f0519c2844506a5960

SHA256
7fa6544460b039457311bb310882c84801efa6c535e5ea360948803deb90c0e1

SHA512
796568eae06ed17a81c7a36d392b8fd03ddbd76d746564f91a6d395fc8245453c1f574fc448d3cec93710abcc6c2e113c2df62fa4facd7b6676d7036855310bf

Download Submit
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInput.exe

Filesize
2.2MB

MD5
711a4cff055438d5d09ca435f0f14711

SHA1
1cd82ddcb7f0a6c03631e8f94d137ddfa056eb6d

SHA256
e1a00202904b2606777b69c23bc6b432c68400ce2913c3e9bc480f4062957dec

SHA512
cec702983ba3d1db5a6a06a9b5265d5943a1c5c5c015e15dc0d4fb34ab9443cea8285bd6b85db2f4f2ce69c49e59752bc9c3be7081c9d1346a2e57eaae155f9a

Download Submit
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInput.exe

Filesize
2.2MB

MD5
711a4cff055438d5d09ca435f0f14711

SHA1
1cd82ddcb7f0a6c03631e8f94d137ddfa056eb6d

SHA256
e1a00202904b2606777b69c23bc6b432c68400ce2913c3e9bc480f4062957dec

SHA512
cec702983ba3d1db5a6a06a9b5265d5943a1c5c5c015e15dc0d4fb34ab9443cea8285bd6b85db2f4f2ce69c49e59752bc9c3be7081c9d1346a2e57eaae155f9a

Download Submit
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe

Filesize
325KB

MD5
dc606c1a0dc7d554fb2f3f8f1d2388a7

SHA1
3119c24f69ea3b5e595100ba8a05badb2e49fcdc

SHA256
24550160fdf34fac8895da3f8799dc284654222291803a006302a60ef5299407

SHA512
cd4246dd524821f262907721ef22231fa505afae135abe6dfe1bd100765644446a084f857ae52502ef4ab307b8f3ea3c992938b471a54c2b9482435bad823f9f

Download Submit
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe

Filesize
325KB

MD5
dc606c1a0dc7d554fb2f3f8f1d2388a7

SHA1
3119c24f69ea3b5e595100ba8a05badb2e49fcdc

SHA256
24550160fdf34fac8895da3f8799dc284654222291803a006302a60ef5299407

SHA512
cd4246dd524821f262907721ef22231fa505afae135abe6dfe1bd100765644446a084f857ae52502ef4ab307b8f3ea3c992938b471a54c2b9482435bad823f9f

Download Submit
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe

Filesize
325KB

MD5
dc606c1a0dc7d554fb2f3f8f1d2388a7

SHA1
3119c24f69ea3b5e595100ba8a05badb2e49fcdc

SHA256
24550160fdf34fac8895da3f8799dc284654222291803a006302a60ef5299407

SHA512
cd4246dd524821f262907721ef22231fa505afae135abe6dfe1bd100765644446a084f857ae52502ef4ab307b8f3ea3c992938b471a54c2b9482435bad823f9f

Download Submit
C:\Windows\SysWOW64\PBCCRCNew\PBCCRCPassGuardXInputService.exe

Filesize
325KB

MD5
dc606c1a0dc7d554fb2f3f8f1d2388a7

SHA1
3119c24f69ea3b5e595100ba8a05badb2e49fcdc

SHA256
24550160fdf34fac8895da3f8799dc284654222291803a006302a60ef5299407

SHA512
cd4246dd524821f262907721ef22231fa505afae135abe6dfe1bd100765644446a084f857ae52502ef4ab307b8f3ea3c992938b471a54c2b9482435bad823f9f

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
95ec0c46330b789a58b1b99e04677f0e

SHA1
998f0ce3f878d832b0edab2242530c6341095c32

SHA256
8d67be4af8f9de42d5d91365ccb83e8e32f9a8580fc571c8b0da177d4741e1f8

SHA512
2622999ec4ddad06c958711fa273c34e95c88abe4641530e4ead045133b7a9b9c7d0991c434785eacda4df216651690cdcacbdcae572a8d6aa21a7b7b0294cdd

Download Submit
memory/220-187-0x00000000003D0000-0x0000000000424000-memory.dmp

Filesize
336KB

Download
memory/220-186-0x00000000003D0000-0x0000000000424000-memory.dmp

Filesize
336KB

Download
memory/1964-205-0x00000000003D0000-0x0000000000424000-memory.dmp

Filesize
336KB

Download
memory/1964-200-0x00000000003D0000-0x0000000000424000-memory.dmp

Filesize
336KB

Download
memory/4144-203-0x0000000000230000-0x000000000046C000-memory.dmp

Filesize
2.2MB

Download
memory/4144-198-0x0000000000230000-0x000000000046C000-memory.dmp

Filesize
2.2MB

Download
memory/4144-236-0x0000000000230000-0x000000000046C000-memory.dmp

Filesize
2.2MB

Download
memory/4164-181-0x0000000002310000-0x0000000002313000-memory.dmp

Filesize
12KB

Download
memory/4164-180-0x0000000002310000-0x0000000002313000-memory.dmp

Filesize
12KB

Download
memory/4164-172-0x0000000002310000-0x0000000002313000-memory.dmp

Filesize
12KB

Download
memory/4164-171-0x0000000002310000-0x0000000002313000-memory.dmp

Filesize
12KB

Download
memory/4164-170-0x0000000002310000-0x0000000002313000-memory.dmp

Filesize
12KB

Download
memory/4680-204-0x00000000003D0000-0x0000000000424000-memory.dmp

Filesize
336KB

Download
memory/4680-206-0x00000000003D0000-0x0000000000424000-memory.dmp

Filesize
336KB

Download
memory/4680-197-0x00000000003D0000-0x0000000000424000-memory.dmp

Filesize
336KB

Download