zgrat | 25ab561d014bdd7b50d5fa913d111bcb4dd3e41d22a5850764a7659aece4d33f

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240220-en
resource tags

arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system
submitted
21/02/2024, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b0936e93d834360ddfebb650d4035610.bin.exe
Size 13.6MB
Sample240221-j3tztsdg22
SHA256 25ab561d014bdd7b50d5fa913d111bcb4dd3e41d22a5850764a7659aece4d33f
MD5 b0936e93d834360ddfebb650d4035610
SHA1 f94576a242babe98f8f136066cf2fd07559e35ba
SHA512 708ac11bcf7089212dc2d0aa84d0625006d8dfea92771b8f056c0ac269f778986f2fd923b428273f65e8829c2b9b5fce6eeadc3935e50007184d9f5511d36e6a
SSDEEP 49152:IBJ+66j8SXHRiMggPhX4XJDpo8klHtqDrbwzLRukj9sqZE+v3DEu2m21ql:yU6k8kZbh0VRU0DX642zE+PD32m2gl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 4 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023216-10.dat	family_zgrat_v1
behavioral2/files/0x0007000000023216-11.dat	family_zgrat_v1
behavioral2/memory/4880-12-0x0000000000830000-0x0000000000B3C000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000800000002321f-84.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Speech\\Engines\\TTS\\en-US\\StartMenuExperienceHost.exe\", \"C:\\Windows\\L2Schemas\\taskhostw.exe\", \"C:\\ChainSvc\\csrss.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Speech\\Engines\\TTS\\en-US\\StartMenuExperienceHost.exe\", \"C:\\Windows\\L2Schemas\\taskhostw.exe\", \"C:\\ChainSvc\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\dllhost.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Speech\\Engines\\TTS\\en-US\\StartMenuExperienceHost.exe\", \"C:\\Windows\\L2Schemas\\taskhostw.exe\", \"C:\\ChainSvc\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\services.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Speech\\Engines\\TTS\\en-US\\StartMenuExperienceHost.exe\", \"C:\\Windows\\L2Schemas\\taskhostw.exe\", \"C:\\ChainSvc\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\dllhost.exe\", \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\services.exe\", \"C:\\ChainSvc\\bridgeproviderperfdllSvc.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Speech\\Engines\\TTS\\en-US\\StartMenuExperienceHost.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\Speech\\Engines\\TTS\\en-US\\StartMenuExperienceHost.exe\", \"C:\\Windows\\L2Schemas\\taskhostw.exe\""	bridgeproviderperfdllSvc.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000\Control Panel\International\Geo\Nation	b0936e93d834360ddfebb650d4035610.bin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000\Control Panel\International\Geo\Nation	bridgeproviderperfdllSvc.exe

Executes dropped EXE 2 IoCs

pid	Process
4880	bridgeproviderperfdllSvc.exe
2036	taskhostw.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\dllhost.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\dllhost.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\Speech\\Engines\\TTS\\en-US\\StartMenuExperienceHost.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\Speech\\Engines\\TTS\\en-US\\StartMenuExperienceHost.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\L2Schemas\\taskhostw.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ChainSvc\\csrss.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bridgeproviderperfdllSvc = "\"C:\\ChainSvc\\bridgeproviderperfdllSvc.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bridgeproviderperfdllSvc = "\"C:\\ChainSvc\\bridgeproviderperfdllSvc.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Windows\\L2Schemas\\taskhostw.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\ChainSvc\\csrss.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\services.exe\""	bridgeproviderperfdllSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\services.exe\""	bridgeproviderperfdllSvc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\services.exe	bridgeproviderperfdllSvc.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\c5b4cb5e9653cc	bridgeproviderperfdllSvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe	bridgeproviderperfdllSvc.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\5940a34987c991	bridgeproviderperfdllSvc.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\SppExtComObj.exe	bridgeproviderperfdllSvc.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\services.exe	bridgeproviderperfdllSvc.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Speech\Engines\TTS\en-US\StartMenuExperienceHost.exe	bridgeproviderperfdllSvc.exe
File created	C:\Windows\Speech\Engines\TTS\en-US\55b276f4edf653	bridgeproviderperfdllSvc.exe
File created	C:\Windows\servicing\csrss.exe	bridgeproviderperfdllSvc.exe
File created	C:\Windows\L2Schemas\taskhostw.exe	bridgeproviderperfdllSvc.exe
File created	C:\Windows\L2Schemas\ea9f0e6c9e2dcd	bridgeproviderperfdllSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000_Classes\Local Settings	b0936e93d834360ddfebb650d4035610.bin.exe
Key created	\REGISTRY\USER\S-1-5-21-2097088205-1470669305-146258644-1000_Classes\Local Settings	bridgeproviderperfdllSvc.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
676	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe
4880	bridgeproviderperfdllSvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2036	taskhostw.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	bridgeproviderperfdllSvc.exe
Token: SeDebugPrivilege	1124	powershell.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe
Token: SeDebugPrivilege	1472	powershell.exe
Token: SeDebugPrivilege	2232	powershell.exe
Token: SeDebugPrivilege	2036	taskhostw.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 2016	1296	b0936e93d834360ddfebb650d4035610.bin.exe	88
PID 1296 wrote to memory of 2016	1296	b0936e93d834360ddfebb650d4035610.bin.exe	88
PID 1296 wrote to memory of 2016	1296	b0936e93d834360ddfebb650d4035610.bin.exe	88
PID 2016 wrote to memory of 4300	2016	WScript.exe	90
PID 2016 wrote to memory of 4300	2016	WScript.exe	90
PID 2016 wrote to memory of 4300	2016	WScript.exe	90
PID 4300 wrote to memory of 676	4300	cmd.exe	92
PID 4300 wrote to memory of 676	4300	cmd.exe	92
PID 4300 wrote to memory of 676	4300	cmd.exe	92
PID 4300 wrote to memory of 4880	4300	cmd.exe	93
PID 4300 wrote to memory of 4880	4300	cmd.exe	93
PID 4880 wrote to memory of 2232	4880	bridgeproviderperfdllSvc.exe	94
PID 4880 wrote to memory of 2232	4880	bridgeproviderperfdllSvc.exe	94
PID 4880 wrote to memory of 3376	4880	bridgeproviderperfdllSvc.exe	104
PID 4880 wrote to memory of 3376	4880	bridgeproviderperfdllSvc.exe	104
PID 4880 wrote to memory of 728	4880	bridgeproviderperfdllSvc.exe	103
PID 4880 wrote to memory of 728	4880	bridgeproviderperfdllSvc.exe	103
PID 4880 wrote to memory of 1124	4880	bridgeproviderperfdllSvc.exe	102
PID 4880 wrote to memory of 1124	4880	bridgeproviderperfdllSvc.exe	102
PID 4880 wrote to memory of 1472	4880	bridgeproviderperfdllSvc.exe	101
PID 4880 wrote to memory of 1472	4880	bridgeproviderperfdllSvc.exe	101
PID 4880 wrote to memory of 5100	4880	bridgeproviderperfdllSvc.exe	95
PID 4880 wrote to memory of 5100	4880	bridgeproviderperfdllSvc.exe	95
PID 4880 wrote to memory of 2192	4880	bridgeproviderperfdllSvc.exe	105
PID 4880 wrote to memory of 2192	4880	bridgeproviderperfdllSvc.exe	105
PID 2192 wrote to memory of 2788	2192	cmd.exe	108
PID 2192 wrote to memory of 2788	2192	cmd.exe	108
PID 2192 wrote to memory of 1868	2192	cmd.exe	109
PID 2192 wrote to memory of 1868	2192	cmd.exe	109
PID 2192 wrote to memory of 2036	2192	cmd.exe	110
PID 2192 wrote to memory of 2036	2192	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\b0936e93d834360ddfebb650d4035610.bin.exe
"C:\Users\Admin\AppData\Local\Temp\b0936e93d834360ddfebb650d4035610.bin.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ChainSvc\g986S2DJRFwkuFLbfVPToFIAe3OCxGC9eK.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\ChainSvc\9nNXu3RQ4ZhwJL.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4300
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:676
  - - C:\ChainSvc\bridgeproviderperfdllSvc.exe
      "C:\ChainSvc/bridgeproviderperfdllSvc.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Speech\Engines\TTS\en-US\StartMenuExperienceHost.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2232
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ChainSvc\bridgeproviderperfdllSvc.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5100
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft\Edge\Application\services.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1124
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ChainSvc\csrss.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:728
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\taskhostw.exe'
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3376
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3Hr0k0UEKw.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2192
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2788
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:1868
      - C:\Windows\L2Schemas\taskhostw.exe
        
        "C:\Windows\L2Schemas\taskhostw.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9nNXu3RQ4ZhwJL.bat

Path C:\ChainSvc\9nNXu3RQ4ZhwJL.bat
Size 196B
SHA256 e5cd02abba14b40c6139cdafc1045bd276ece853a51d05c29a0c08bca9f55c52
MD5 df7894bbabe3d171fdb1f8acc7e148cc
SHA1 21d3c100cba5460e467ff9894a2f1d5c9e39db71
SHA512 9a86cef386b0912076dd28fe4db08f0ff41c756442e2e7e00b6f58a63693af7a73eec2ac883f4a8bc9869c4cd1b0f899a5bc8b48bef187d3af11955adc6759a2
MD5 SHA1 SHA512

Submit Download

bridgeproviderperfdllSvc.exe

Path C:\ChainSvc\bridgeproviderperfdllSvc.exe
Size 7.1MB
SHA256 b26aae159bec2399494fdb82d9f0982d78f4e8ecf1258c0e7ad52b8d63d1480f
MD5 11edcd331238173fbd551b85a927c486
SHA1 b17d9df57d72189f933c22d2930792aec3732203
SHA512 dff447150a3d8c667631812e0ef24cf2dcf1c4b0f5c95ef65e50d9c971be7139540d1e84713f4e2df21998a8276ceea53f10786ac5cbb88112e2e893c8f4be56
SSDEEP 49152:c66j8SXHRiMggPhX4XJDpo8klHtqDrbwzLRukj9sqZE+v3DEu2m21q:c6k8kZbh0VRU0DX642zE+PD32m2g
MD5 SHA1 SHA512 SSDEEP

Submit Download

bridgeproviderperfdllSvc.exe

Path C:\ChainSvc\bridgeproviderperfdllSvc.exe
Size 7.3MB
SHA256 4817891f3f06e3ff5c5a7b9bc850d9fd381f0daf2e088f7e95cf5a98a71fa92d
MD5 282fff58b74266bce173a3db99128b22
SHA1 bb4836fdfb78efd8ef2bbe7a84cf244c755205e1
SHA512 599c46d721f0b44af685de2e012377f65ce169ef253e0527cda811ad2ad82e0b9b3ab06721635d458dc22e40db3704677f190fa4b3988786f1ac2e9d82ca6c0e
SSDEEP 49152:c66j8SXHRiMggPhX4XJDpo8klHtqDrbwzLRukj9sqZE+v3DEu2m21q:c6k8kZbh0VRU0DX642zE+PD32m2g
MD5 SHA1 SHA512 SSDEEP

Submit Download

g986S2DJRFwkuFLbfVPToFIAe3OCxGC9eK.vbe

Path C:\ChainSvc\g986S2DJRFwkuFLbfVPToFIAe3OCxGC9eK.vbe
Size 200B
SHA256 9dd3196b42656cc84a0c8983d9c18ffdd6334aebb1fea8edce366469a399f3b4
MD5 77fd73c49d73b73f9f502236f569df8c
SHA1 21fdcbb7f363ba3c6e21119f9e5b7870f75863fc
SHA512 9e0f03b7ce84951aef9dfc4a08cf9d3f2ec9edb2431caaa026f8e6881ec6c7f4b3cd836d2ab5f1eb32448baf9b2ab78c598a22903ce0f76eeba122f27a732061
MD5 SHA1 SHA512

Submit Download

dllhost.exe

Path C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe
Size 13.3MB
SHA256 61f3daba79f29eb7f1b19af17d4b63fd980d15d91e72e6f7396a5bb07bce0924
MD5 ea7319e3e217c92aac39752356752325
SHA1 f97a5518d02bea7f57e4cb12721d7a9b12b96cd4
SHA512 ab3da0c19256edd5cd1adfb441c09f40c0478c153eca5e06f9e68783dbf6999a460af74e3d09469dc4616b03eae3065af38b764dd7d4d780fcf27b468c4c1527
SSDEEP 49152:c66j8SXHRiMggPhX4XJDpo8klHtqDrbwzLRukj9sqZE+v3DEu2m21q:c6k8kZbh0VRU0DX642zE+PD32m2g
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d
MD5 59d97011e091004eaffb9816aa0b9abd
SHA1 1602a56b01dd4b7c577ca27d3117e4bcc1aa657b
SHA512 d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2d2f364c75bd2897504249f42cdf1d19374f5230aad68fa9154ea3d03e3031a6
MD5 bd5940f08d0be56e65e5f2aaf47c538e
SHA1 d7e31b87866e5e383ab5499da64aba50f03e8443
SHA512 c34d10c7e07da44a180fae9889b61f08903aa84e8ddfa80c31c272b1ef9d491b8cec6b8a4c836c3cb1583fe8f4955c6a8db872515de3a9e10eae09610c959406
MD5 SHA1 SHA512

Submit Download

3Hr0k0UEKw.bat

Path C:\Users\Admin\AppData\Local\Temp\3Hr0k0UEKw.bat
Size 210B
SHA256 b839cf43c086bbaa08b25c9b6281daf289b855092eca3e48caacc6904ff64e61
MD5 f9732cb92d3d1e2e568ea9afba2fafe3
SHA1 fcfd055d4c69ed7edc9f78e51f5cf913e4842d8c
SHA512 dc16a8e26b37dc77867175bc31b2fa9ca75532d4657f920348965025f5932c12c17bf47e89b292f3ef011660423c45e5d8ef7f0df1ef584a0e1e2a90aa0317a4
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_mdv3v2b2.enu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mdv3v2b2.enu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/728-144-0x0000019E9B900000-0x0000019E9B910000-memory.dmp

Download

memory/728-143-0x00007FFB8B7E0000-0x00007FFB8C2A1000-memory.dmp

Download

memory/728-196-0x0000019E9BAB0000-0x0000019E9BBFE000-memory.dmp

Download

memory/1124-101-0x00007FFB8B7E0000-0x00007FFB8C2A1000-memory.dmp

Download

memory/1124-114-0x0000024D756D0000-0x0000024D756F2000-memory.dmp

Download

memory/1124-104-0x0000024D75580000-0x0000024D75590000-memory.dmp

Download

memory/1124-187-0x0000024D75740000-0x0000024D7588E000-memory.dmp

Download

memory/1124-102-0x0000024D75580000-0x0000024D75590000-memory.dmp

Download

memory/1472-199-0x00000197DA490000-0x00000197DA5DE000-memory.dmp

Download

memory/1472-154-0x00007FFB8B7E0000-0x00007FFB8C2A1000-memory.dmp

Download

memory/1472-155-0x00000197C1FF0000-0x00000197C2000000-memory.dmp

Download

memory/2036-257-0x000000001CEC0000-0x000000001CF8D000-memory.dmp

Download

memory/2036-258-0x000000001D090000-0x000000001D0FB000-memory.dmp

Download

memory/2232-166-0x00007FFB8B7E0000-0x00007FFB8C2A1000-memory.dmp

Download

memory/2232-182-0x0000023F259C0000-0x0000023F25B0E000-memory.dmp

Download

memory/3376-179-0x000002B774A40000-0x000002B774B8E000-memory.dmp

Download

memory/3376-98-0x000002B75C260000-0x000002B75C270000-memory.dmp

Download

memory/3376-96-0x00007FFB8B7E0000-0x00007FFB8C2A1000-memory.dmp

Download

memory/4880-32-0x00007FFBA8F30000-0x00007FFBA8F31000-memory.dmp

Download

memory/4880-42-0x000000001B890000-0x000000001B8A0000-memory.dmp

Download

memory/4880-46-0x00007FFBA8B90000-0x00007FFBA8B91000-memory.dmp

Download

memory/4880-45-0x000000001B8A0000-0x000000001B8AC000-memory.dmp

Download

memory/4880-48-0x000000001CD50000-0x000000001CD62000-memory.dmp

Download

memory/4880-49-0x00007FFBA8B80000-0x00007FFBA8B81000-memory.dmp

Download

memory/4880-51-0x000000001CCD0000-0x000000001CCDC000-memory.dmp

Download

memory/4880-52-0x00007FFBA8B70000-0x00007FFBA8B71000-memory.dmp

Download

memory/4880-54-0x000000001CCE0000-0x000000001CCF0000-memory.dmp

Download

memory/4880-55-0x00007FFBA8B60000-0x00007FFBA8B61000-memory.dmp

Download

memory/4880-57-0x000000001CD90000-0x000000001CDA6000-memory.dmp

Download

memory/4880-58-0x00007FFBA8B50000-0x00007FFBA8B51000-memory.dmp

Download

memory/4880-60-0x000000001CCF0000-0x000000001CCFC000-memory.dmp

Download

memory/4880-61-0x00007FFBA8B40000-0x00007FFBA8B41000-memory.dmp

Download

memory/4880-62-0x00007FFBA8B30000-0x00007FFBA8B31000-memory.dmp

Download

memory/4880-63-0x000000001B770000-0x000000001B780000-memory.dmp

Download

memory/4880-65-0x000000001CD70000-0x000000001CD80000-memory.dmp

Download

memory/4880-66-0x00007FFBA8B20000-0x00007FFBA8B21000-memory.dmp

Download

memory/4880-68-0x000000001CD80000-0x000000001CD90000-memory.dmp

Download

memory/4880-69-0x00007FFBA8B10000-0x00007FFBA8B11000-memory.dmp

Download

memory/4880-71-0x000000001CE10000-0x000000001CE6A000-memory.dmp

Download

memory/4880-73-0x000000001CDB0000-0x000000001CDBE000-memory.dmp

Download

memory/4880-74-0x00007FFBA8B00000-0x00007FFBA8B01000-memory.dmp

Download

memory/4880-76-0x000000001CDE0000-0x000000001CDF8000-memory.dmp

Download

memory/4880-77-0x00007FFBA8AF0000-0x00007FFBA8AF1000-memory.dmp

Download

memory/4880-79-0x000000001CDC0000-0x000000001CDCC000-memory.dmp

Download

memory/4880-80-0x00007FFBA8AE0000-0x00007FFBA8AE1000-memory.dmp

Download

memory/4880-43-0x000000001B770000-0x000000001B780000-memory.dmp

Download

memory/4880-40-0x00007FFBA8F00000-0x00007FFBA8F01000-memory.dmp

Download

memory/4880-39-0x000000001B880000-0x000000001B890000-memory.dmp

Download

memory/4880-99-0x000000001D1B0000-0x000000001D27D000-memory.dmp

Download

memory/4880-100-0x00007FFBA8FA0000-0x00007FFBA905E000-memory.dmp

Download

memory/4880-37-0x00007FFBA8F10000-0x00007FFBA8F11000-memory.dmp

Download

memory/4880-36-0x000000001B770000-0x000000001B780000-memory.dmp

Download

memory/4880-33-0x00007FFBA8F20000-0x00007FFBA8F21000-memory.dmp

Download

memory/4880-12-0x0000000000830000-0x0000000000B3C000-memory.dmp

Download

memory/4880-35-0x000000001CCB0000-0x000000001CCC8000-memory.dmp

Download

memory/4880-31-0x00007FFBA8F40000-0x00007FFBA8F41000-memory.dmp

Download

memory/4880-103-0x00007FFB8B7E0000-0x00007FFB8C2A1000-memory.dmp

Download

memory/4880-30-0x00007FFB8B7E0000-0x00007FFB8C2A1000-memory.dmp

Download

memory/4880-29-0x000000001B760000-0x000000001B770000-memory.dmp

Download

memory/4880-27-0x000000001CD00000-0x000000001CD50000-memory.dmp

Download

memory/4880-26-0x000000001CC90000-0x000000001CCAC000-memory.dmp

Download

memory/4880-24-0x0000000002CD0000-0x0000000002CDE000-memory.dmp

Download

memory/4880-23-0x00007FFBA8F50000-0x00007FFBA8F51000-memory.dmp

Download

memory/4880-21-0x00007FFBA8FA0000-0x00007FFBA905E000-memory.dmp

Download

memory/4880-20-0x00007FFBA8F60000-0x00007FFBA8F61000-memory.dmp

Download

memory/4880-19-0x00007FFBA8FA0000-0x00007FFBA905E000-memory.dmp

Download

memory/4880-18-0x000000001B8B0000-0x000000001B8D6000-memory.dmp

Download

memory/4880-13-0x00007FFB8B7E0000-0x00007FFB8C2A1000-memory.dmp

Download

memory/4880-16-0x000000001B770000-0x000000001B780000-memory.dmp

Download

memory/4880-15-0x0000000002C80000-0x0000000002C81000-memory.dmp

Download

memory/4880-14-0x000000001B770000-0x000000001B780000-memory.dmp

Download

memory/5100-192-0x00000157FF260000-0x00000157FF3AE000-memory.dmp

Download

memory/5100-115-0x00000157FF110000-0x00000157FF120000-memory.dmp

Download