stealerium | c886e938dd26ca17bd29feea36d4c487483bb05d86b3c382e045b88925b27149

Analysis

max time kernel
151s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/01/2024, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac15ae1e49f4272e8d38b5fd5573ce35.exe
Size 81KB
Sample240130-ej9hyshcgn
SHA256 c886e938dd26ca17bd29feea36d4c487483bb05d86b3c382e045b88925b27149
MD5 ac15ae1e49f4272e8d38b5fd5573ce35
SHA1 93a70b449926995d458b9513b8b36e988f73dc8a
SHA512 23d7977aeac5a2f1856861519b34dbbd4aa52ed003d4001b73435024266d258d765613a3be8a1e2ae67548f9eb69f662925d663f8321f1610f200af6258025f8
SSDEEP 1536:D7Vs/tSdQLcSjAA0C0rEr2ofgNTX0g/+PmN/10BmglZqiqazVkP5tJCFPzRUR2lX:D5MmQLcxAarEDINTD/+Pmn0BmgnpzmcP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealerium zgrat collection rat spyware stealer

Malware Config

Extracted

Family

stealerium

https://discordapp.com/api/webhooks/1197850806213431377/-zU9uA2NeaYEk4-ozdhgmNljI6NS_w_qcT_cbtxYxZdkUD3JeaKChZp4GXdod-MX3D1Q

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/2588-5-0x0000000006EA0000-0x000000000740A000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-6-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-7-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-9-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-11-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-13-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-15-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-17-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-19-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-21-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-23-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-25-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-27-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-29-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-31-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-33-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-35-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-37-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-39-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-41-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-43-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-45-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-47-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-49-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-51-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-53-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-55-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-57-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-59-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-61-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-63-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-65-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-67-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1
behavioral2/memory/2588-69-0x0000000006EA0000-0x0000000007404000-memory.dmp	family_zgrat_v1

Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	ac15ae1e49f4272e8d38b5fd5573ce35.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	@dr@[email protected]

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Update.exe	@dr@[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Windows Update.exe	@dr@[email protected]

Executes dropped EXE 3 IoCs

pid	Process
2668	@dr@[email protected]
5080	build.exe
4872	CamSnap.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
47	ip-api.com
59	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2588 set thread context of 2492	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	build.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	build.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe
2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe
5080	build.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe
Token: SeDebugPrivilege	2668	@dr@[email protected]
Token: SeDebugPrivilege	5080	build.exe
Token: SeSecurityPrivilege	4596	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5080	build.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 4972	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	88
PID 2588 wrote to memory of 4972	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	88
PID 2588 wrote to memory of 4972	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	88
PID 2588 wrote to memory of 4032	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2588 wrote to memory of 4032	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2588 wrote to memory of 4032	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	89
PID 2588 wrote to memory of 4484	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	90
PID 2588 wrote to memory of 4484	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	90
PID 2588 wrote to memory of 4484	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	90
PID 2588 wrote to memory of 2808	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	91
PID 2588 wrote to memory of 2808	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	91
PID 2588 wrote to memory of 2808	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	91
PID 2588 wrote to memory of 2492	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2588 wrote to memory of 2492	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2588 wrote to memory of 2492	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2588 wrote to memory of 2492	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2588 wrote to memory of 2492	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2588 wrote to memory of 2492	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2588 wrote to memory of 2492	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2588 wrote to memory of 2492	2588	ac15ae1e49f4272e8d38b5fd5573ce35.exe	92
PID 2492 wrote to memory of 2668	2492	ac15ae1e49f4272e8d38b5fd5573ce35.exe	95
PID 2492 wrote to memory of 2668	2492	ac15ae1e49f4272e8d38b5fd5573ce35.exe	95
PID 2492 wrote to memory of 5080	2492	ac15ae1e49f4272e8d38b5fd5573ce35.exe	96
PID 2492 wrote to memory of 5080	2492	ac15ae1e49f4272e8d38b5fd5573ce35.exe	96
PID 2492 wrote to memory of 5080	2492	ac15ae1e49f4272e8d38b5fd5573ce35.exe	96
PID 2668 wrote to memory of 4872	2668	@dr@[email protected]	99
PID 2668 wrote to memory of 4872	2668	@dr@[email protected]	99
PID 5080 wrote to memory of 1196	5080	build.exe	103
PID 5080 wrote to memory of 1196	5080	build.exe	103
PID 5080 wrote to memory of 1196	5080	build.exe	103
PID 1196 wrote to memory of 2224	1196	cmd.exe	105
PID 1196 wrote to memory of 2224	1196	cmd.exe	105
PID 1196 wrote to memory of 2224	1196	cmd.exe	105
PID 1196 wrote to memory of 3132	1196	cmd.exe	106
PID 1196 wrote to memory of 3132	1196	cmd.exe	106
PID 1196 wrote to memory of 3132	1196	cmd.exe	106
PID 1196 wrote to memory of 4604	1196	cmd.exe	107
PID 1196 wrote to memory of 4604	1196	cmd.exe	107
PID 1196 wrote to memory of 4604	1196	cmd.exe	107
PID 5080 wrote to memory of 1268	5080	build.exe	110
PID 5080 wrote to memory of 1268	5080	build.exe	110
PID 5080 wrote to memory of 1268	5080	build.exe	110
PID 1268 wrote to memory of 2136	1268	cmd.exe	112
PID 1268 wrote to memory of 2136	1268	cmd.exe	112
PID 1268 wrote to memory of 2136	1268	cmd.exe	112
PID 1268 wrote to memory of 4696	1268	cmd.exe	113
PID 1268 wrote to memory of 4696	1268	cmd.exe	113
PID 1268 wrote to memory of 4696	1268	cmd.exe	113

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	build.exe

C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
"C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:4972
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:4484
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  PID:2808
- C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  C:\Users\Admin\AppData\Local\Temp\ac15ae1e49f4272e8d38b5fd5573ce35.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]
    "C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]"
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
      "C:\Users\Admin\AppData\Local\Temp\CamSnap.exe"
      4⤵
      Executes dropped EXE
      PID:4872
- - C:\Users\Admin\AppData\Local\Temp\build.exe
    "C:\Users\Admin\AppData\Local\Temp\build.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:5080
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1196
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2224
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show profile
        5⤵
        
        PID:3132
    - - C:\Windows\SysWOW64\findstr.exe
        
        findstr All
        5⤵
        
        PID:4604
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2136
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        
        PID:4696

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Bookmarks.txt

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\Admin@NUPNSVML_en-US\Browsers\Firefox\Bookmarks.txt
Size 105B
SHA256 c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
MD5 2e9d094dda5cdc3ce6519f75943a4ff4
SHA1 5d989b4ac8b699781681fe75ed9ef98191a5096c
SHA512 d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
MD5 SHA1 SHA512

Submit Download

OneDrive.txt

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\Admin@NUPNSVML_en-US\Directories\OneDrive.txt
Size 25B
SHA256 8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e
MD5 966247eb3ee749e21597d73c4176bd52
SHA1 1e9e63c2872cef8f015d4b888eb9f81b00a35c79
SHA512 bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa
MD5 SHA1 SHA512

Submit Download

Videos.txt

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\Admin@NUPNSVML_en-US\Directories\Videos.txt
Size 23B
SHA256 a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733
MD5 1fddbf1169b6c75898b86e7e24bc7c1f
SHA1 d2091060cb5191ff70eb99c0088c182e80c20f8c
SHA512 20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d
MD5 SHA1 SHA512

Submit Download

Apps.txt

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\Admin@NUPNSVML_en-US\System\Apps.txt
Size 3KB
SHA256 a46a3e56883deeb76a2eb8a9ec2d9deb6909fb7a41c6ce3daeec7ba424c72756
MD5 dbc368c49211270a837ea901dddaeb2a
SHA1 86aabb6250af097dcf40f4c9e159fb4d19c5a8c1
SHA512 8943ec0b3e0163c32cfe21038e90650024b2f3a8bd6376b5b662dd879c4be91dce1fc84a7bc6f28ab99fcaf4640bc8fd6c216d79031ab42450396481ed055107
MD5 SHA1 SHA512

Submit Download

Apps.txt

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\Admin@NUPNSVML_en-US\System\Apps.txt
Size 3KB
SHA256 b686e65e742889dc1070905d0af9c5bbb3863c3655f0d2b23e69972bfbc80334
MD5 8fe51a9d800511dff171ac3173c201ba
SHA1 c68b2bd2fda630ff5302bcdbe6a2f4154ab122b6
SHA512 dfbf76e632f97b18361f92c9dad71af560e8b683156ff79a1d895b603d5303d6e85bdeb8d93040ed1ee117bb364ac1a3d8879e5564a20ed4eabc14ff8af362c2
MD5 SHA1 SHA512

Submit Download

Apps.txt

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\Admin@NUPNSVML_en-US\System\Apps.txt
Size 5KB
SHA256 464943501c3413d695b38a23e9c9469dcbfd5f6c6b707e5f24ff4cbd804e7e0b
MD5 109200e0ebbbb8555161615ac6f7b282
SHA1 4a128739efbf0eaed157f68eda5d505690dc643b
SHA512 dd70f3a0be9746169a0c8b2b6a9769bdadd9cb2d4f6fc63daf4fddc289bd872874dc3f969d1b69cb1d33b22c74afbea622ec59041ef8cc767f329b990eefacae
SSDEEP 96:OfpNX3fpNXPfpNmFfvmQNpJfOQWEfkpKEfkDzfvtvufObfFwSfFwaiRpqffRtrhm:wpN/pN3pNivTOn2kw2kXvyO7esekRLR0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Debug.txt

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\Admin@NUPNSVML_en-US\System\Debug.txt
Size 320B
SHA256 7bcff6f69534bcf8ee4f21fbc9c8fcac81a45ccd3e133509acde637c98688d2b
MD5 c33307319bb6d20b20f14ba7df29b16d
SHA1 4874f7f72e6a3e811841ece7788d1dc6a2fb8cbc
SHA512 bb7e44f63b496fb09db76fcb9ee02c5ea687ca56c4773c30f4c6b27e7ee06b851f400481536068c5a930d4c7f2ed82f838b33ed8434eeaccb6da99d3d728f47d
MD5 SHA1 SHA512

Submit Download

Process.txt

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\Admin@NUPNSVML_en-US\System\Process.txt
Size 4KB
SHA256 d22b973c3772c28a503341a6f77a6c642fa4b69253b5eea172ba8286b60c43f4
MD5 b4e0c650e1bcf7383a5873f9022d94ae
SHA1 0dba0baf3c10d3277599077c7d6d3ea05ca727dd
SHA512 1d74a62db29bb63e9cfd3d5d0ee76d063ef298a8adf9b22acb4b2c50233292ab45c39d3aa11fd4967828be938dd3bc6ba5f2ae4f6b76ea603981629d39ec4893
SSDEEP 48:4xFFNFvBoPb1uwk2fAxz8hbcGXdlK1IQFMb:4/FNFvB+BK+wGX/KVqb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProductKey.txt

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\Admin@NUPNSVML_en-US\System\ProductKey.txt
Size 29B
SHA256 f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3
MD5 71eb5479298c7afc6d126fa04d2a9bde
SHA1 a9b3d5505cf9f84bb6c2be2acece53cb40075113
SHA512 7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd
MD5 SHA1 SHA512

Submit Download

msgid.dat

Path C:\Users\Admin\AppData\Local\65cfec66b6790d6c9bc71e6d41a10c45\msgid.dat
Size 19B
SHA256 e235e40e2fa2b83dc49634e773149985214ec962c69990df9a01823fc768f597
MD5 0cabe91bbbf11d0e2fef503842262641
SHA1 8794e21843e29cd29f6d966f5dbe71f95958d95e
SHA512 9575297edd670d6fd923e58728254cc77082627c21134bde3fb88cb61daba737c5485133ed7ada7cd3366aa5b11c961d2a7ccd5ff240b162e62d09e6de0356c8
MD5 SHA1 SHA512

Submit Download

ac15ae1e49f4272e8d38b5fd5573ce35.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ac15ae1e49f4272e8d38b5fd5573ce35.exe.log
Size 1KB
SHA256 f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256
MD5 c3941d9fa38f1717d5cecd7a2ca71667
SHA1 33b5362675383b58b4166ed9f9a61e5aa6768d2e
SHA512 98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45
MD5 SHA1 SHA512

Submit Download

@dr@[email protected]

Path C:\Users\Admin\AppData\Local\Temp\@dr@[email protected]
Size 1.4MB
SHA256 217b622f49899705746c44ec149f3d6f307d294646790dc6e3d5a8abd1dd73ff
MD5 462376d1bf177c136a307f0da9da7b8c
SHA1 8d8f94b8fc9f574275471c1ead20f589130e4ef2
SHA512 b40f61b684d6e1d6d18421b76124d84e471f7285308cb76d649132aea37c5f607a058a79677da5babe8e13bdad6f1493eee66fd585ae21743f5cc74afc638a22
SSDEEP 12288:+rEm8aa8IPonn01LwmgM4+BhzKDAP8NUMnLuVY2hTFAkkWWkk6G8vvRRPPdqggyu:9VjKPLqF0/S4KBF/Yrx2fjCeY2FW
MD5 SHA1 SHA512 SSDEEP

Submit Download

CamSnap.exe

Path C:\Users\Admin\AppData\Local\Temp\CamSnap.exe
Size 94KB
SHA256 09d95d73ac6828138201142cc519ac46a0456db2ea71240c3fa51d569b0242aa
MD5 550628b16ef8c4e27c4081950cf8fd66
SHA1 ab11427c02cb53b70816b06d5a950b5f52c935eb
SHA512 e74009391d29a1c305edf099ed506c0d573e6b3bc1ea7230545af2d0fbefb02122a99b9810cdf3686634fe61cc560cc61a1939da1913167941b755dceda5ed01
SSDEEP 1536:yZkkWWkk6nG3MvvRRPPdqggyyAAuBH2XbObiPUA7bf2OpzQw+gyuiHiuLCAGo4Df:KkkWWkk6nG8vvRRPPdqggyyAAux2XbOW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autofills.txt

Path C:\Users\Admin\AppData\Local\Temp\Data\Autofills.txt
Size 234B
SHA256 5bc3a7ced261f235f4a30797ad96f803c9e022a95ad6bc7fedc06d0fd2a0abeb
MD5 6be6fdca0cfa94635b8689b2b0bf2bee
SHA1 379c61029b5443c3d3df7c770423e40618b36d15
SHA512 7955fb48977c971563b10420e379ebea01e42582a8dfe2719ec756dda7e757168031a58a3c9fef061c0abb6c799579f7c8b46de4fc5b4ab3519d735092848cd8
MD5 SHA1 SHA512

Submit Download

CreditCards.txt

Path C:\Users\Admin\AppData\Local\Temp\Data\CreditCards.txt
Size 238B
SHA256 39059fc9bf3844dacbe329b623ca7a06f72656216dd4e52dc9b938b3d95289dc
MD5 0f5f7a38759e578c92bcf62c45d80b8a
SHA1 211e70ede55cce5bf67f685d85cbd030a8517d2b
SHA512 8130466f8ee346c0b931a34e63e2e9dc6f4070b85faaa58efdddd4d165fa605457d3137472c5fd09da87b0135a4beb660ee39cb390d78be6f0786950036b205d
MD5 SHA1 SHA512

Submit Download

Downloads.txt

Path C:\Users\Admin\AppData\Local\Temp\Data\Downloads.txt
Size 234B
SHA256 832ff6318e2c78ac1907c74f3911f8815b545c16449cbce6753e21fb723cb657
MD5 ae0f7fab163139c661e576fe0af08651
SHA1 7545ab94360fd93f2209021b4cecabb92592be27
SHA512 a3e342a3c72c079db96a8d6bb108830c3a772b926be0cf4e5d09ebb09e1babbc7602959bf1f82c8df8764f45479f318c3205114f23c96fd663efa792cff86b8b
MD5 SHA1 SHA512

Submit Download

Histories.txt

Path C:\Users\Admin\AppData\Local\Temp\Data\Histories.txt
Size 234B
SHA256 eaff9c24df526e9c884832130bf6de9182fd96f3dcdba33e8e5e7a4ed37f1bbe
MD5 412ec159e4b14be1ca93db473e80acc2
SHA1 8909b6f7fc8715a749270b6ceb8f05f823f59fd3
SHA512 a90524333fd34d44f5784a90ada19904ea7379de26cae08ffdfd2ee25b3fd5b36c2cbcf7a7e6fc4ff734680ca1ff177ed42df1d4f5583d6a1a89d622c183f0b4
MD5 SHA1 SHA512

Submit Download

Passwords.txt

Path C:\Users\Admin\AppData\Local\Temp\Data\Passwords.txt
Size 234B
SHA256 8a947e0921f9cfada15c19a72f0ff31b38ad4602106c6ee95685d61c223c9a35
MD5 36f6acc2229073f5bb4074cee73d1d5b
SHA1 b2adbb44350d984dff40c15fcbbeb3379c7ec0e5
SHA512 da8b627bd674ceb0da7e30ba543ab82ab694d3f6e0474b48ca343ee74e20147440d2205b6ce66f5caa2a39061dedd2ca4146e263fac9f146a228c5b5cba4aaad
MD5 SHA1 SHA512

Submit Download

build.exe

Path C:\Users\Admin\AppData\Local\Temp\build.exe
Size 1.6MB
SHA256 e8dd4e7a66f895aff9ba9616f4352af14135fe95be6594ed1d572c84a3e827e3
MD5 ffdc39b9c3609b4b6d8c543c078ff7cf
SHA1 7e34f503c51353bf53be8fc5441573d74a97ce3a
SHA512 a68f1648d9785fb8e64d2bb756e7e58c1217361b0b57f659f83c4d7a57993acda1a9161c8ce471ff2c3fe582a7a0f7997b9cab59d034f28b40a7da04b75010b5
SSDEEP 49152:JkTq24GjdGSiqkqXfd+/9AqYanieKdsC:J1EjdGSiqkqXf0FLYW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2492-947-0x0000000000400000-0x0000000000C0A000-memory.dmp

Download

memory/2492-946-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/2492-984-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/2492-950-0x00000000057D0000-0x00000000057DA000-memory.dmp

Download

memory/2492-949-0x0000000005710000-0x00000000057A2000-memory.dmp

Download

memory/2588-61-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-4-0x0000000005230000-0x0000000005236000-memory.dmp

Download

memory/2588-45-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-47-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-49-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-51-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-53-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-55-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-57-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-59-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-13-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-63-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-65-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-67-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-69-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-938-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/2588-939-0x0000000004C70000-0x0000000004C71000-memory.dmp

Download

memory/2588-940-0x0000000008AD0000-0x0000000008FD2000-memory.dmp

Download

memory/2588-941-0x0000000006C70000-0x0000000006CBC000-memory.dmp

Download

memory/2588-942-0x0000000007E30000-0x00000000083D4000-memory.dmp

Download

memory/2588-31-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-11-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-0-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/2588-948-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/2588-39-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-37-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-43-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-29-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-41-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-1-0x0000000000880000-0x000000000089A000-memory.dmp

Download

memory/2588-9-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-33-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-2-0x00000000052A0000-0x00000000052B0000-memory.dmp

Download

memory/2588-35-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-7-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-25-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-6-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-5-0x0000000006EA0000-0x000000000740A000-memory.dmp

Download

memory/2588-3-0x00000000012B0000-0x00000000012B6000-memory.dmp

Download

memory/2588-27-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-15-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-23-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-21-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-19-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2588-17-0x0000000006EA0000-0x0000000007404000-memory.dmp

Download

memory/2668-1002-0x000001CEEAE20000-0x000001CEEAE70000-memory.dmp

Download

memory/2668-1046-0x00007FFCD1DC0000-0x00007FFCD2881000-memory.dmp

Download

memory/2668-985-0x000001CEE8C90000-0x000001CEE8CA0000-memory.dmp

Download

memory/2668-981-0x00007FFCD1DC0000-0x00007FFCD2881000-memory.dmp

Download

memory/2668-979-0x000001CECE3F0000-0x000001CECE568000-memory.dmp

Download

memory/4872-1001-0x00007FFCD1DC0000-0x00007FFCD2881000-memory.dmp

Download

memory/4872-999-0x00007FFCD1DC0000-0x00007FFCD2881000-memory.dmp

Download

memory/4872-998-0x0000019F72CD0000-0x0000019F72CEE000-memory.dmp

Download

memory/5080-982-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/5080-1052-0x0000000006FC0000-0x0000000006FDE000-memory.dmp

Download

memory/5080-1051-0x0000000006FA0000-0x0000000006FA8000-memory.dmp

Download

memory/5080-1187-0x00000000748F0000-0x00000000750A0000-memory.dmp

Download

memory/5080-1205-0x0000000005920000-0x0000000005930000-memory.dmp

Download

memory/5080-1050-0x0000000006F90000-0x0000000006F9A000-memory.dmp

Download

memory/5080-1049-0x0000000006170000-0x0000000006178000-memory.dmp

Download

memory/5080-1048-0x0000000006140000-0x0000000006166000-memory.dmp

Download

memory/5080-1240-0x0000000007160000-0x00000000071DA000-memory.dmp

Download

memory/5080-1241-0x0000000005920000-0x0000000005930000-memory.dmp

Download

memory/5080-1047-0x00000000060B0000-0x0000000006142000-memory.dmp

Download

memory/5080-1000-0x0000000005920000-0x0000000005930000-memory.dmp

Download

memory/5080-983-0x0000000005820000-0x0000000005886000-memory.dmp

Download

memory/5080-1313-0x0000000007510000-0x00000000075C2000-memory.dmp

Download

memory/5080-1315-0x0000000007610000-0x0000000007632000-memory.dmp

Download

memory/5080-1316-0x0000000007E80000-0x00000000081D4000-memory.dmp

Download

memory/5080-980-0x0000000000E40000-0x0000000000FD2000-memory.dmp

Download

memory/5080-1328-0x0000000005920000-0x0000000005930000-memory.dmp

Download