Overview

overview

10

Static

static

3

cheatchecker.exe

windows10-2004-x64

10

Resubmissions

14-10-2024 08:01

241014-jw3ndssckf 8

14-03-2024 00:52

240314-a8eyesgh33 10

Analysis

  • max time kernel
    191s
  • max time network
    194s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2024 00:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cheatchecker.exe

  • Size

    7.8MB

  • MD5

    64925f73451b96d282f4a3a6bd8d265a

  • SHA1

    3ec096d5f78b5d62b6d02b41697ff36ad1076cce

  • SHA256

    2575b49e96cf0027ea9469a23aa8ab722365f5fd614fa88c3d3ec2766a789f38

  • SHA512

    4de9dbe9f3dc7fbac5c3af20c2caae571a73cdf5026d7e1eb1b1bb5ce97db8f1df033be07966351fdfdd4e16265970dfa85cda54a05a046066f3ded177fbe16c

  • SSDEEP

    196608:7DA39sA6Lvn3QtRuQJShuxpVPoOGs2UqT9ZbWr39GSPV9p9N:PANsAG3QtRuf09oK2VVrMp

Score
10/10
zgratpersistenceratspywarestealer

Malware Config

Signatures

  • Detect ZGRat V1 5 IoCs
  • Modifies WinLogon for persistence 2 TTPs 6 IoCs
    persistence
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 11 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe
    "C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:876
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4520
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\vshost.exe'"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1620
    • C:\Users\Admin\AppData\Local\Temp\vshost.exe
      C:\Users\Admin\AppData\Local\Temp\vshost.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5080
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\S903xrp3IvxHRBfAcFsv5cxIr0gwIgb37HA0EpJISpY3XGxtgDIAkj1dpfv2.vbe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1488
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\VivgHRzCUfvKc6g2AjCmaH9rmM.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3080
          • C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\ComHostMonitor.exe
            "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf/ComHostMonitor.exe"
            5⤵
            • Modifies WinLogon for persistence
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2772
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5tcm2exn\5tcm2exn.cmdline"
              6⤵
              • Drops file in System32 directory
              • Suspicious use of WriteProcessMemory
              PID:4112
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9923.tmp" "c:\Windows\System32\CSC3D8393B3F4A54E158616112A954916AC.TMP"
                7⤵
                  PID:3796
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Defender\ja-JP\csrss.exe'
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4368
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\conhost.exe'
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3432
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\sihost.exe'
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2648
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\WmiPrvSE.exe'
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1496
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\SearchApp.exe'
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4140
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\ComHostMonitor.exe'
                6⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4172
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4TNHc0Yezl.bat"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2576
                • C:\Windows\system32\chcp.com
                  chcp 65001
                  7⤵
                    PID:4756
                  • C:\Windows\system32\w32tm.exe
                    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
                    7⤵
                      PID:4680
                    • C:\Program Files\Windows Defender\ja-JP\csrss.exe
                      "C:\Program Files\Windows Defender\ja-JP\csrss.exe"
                      7⤵
                      • Executes dropped EXE
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2232
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:2188
          • C:\Windows\system32\mmc.exe
            "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
            1⤵
            • Drops file in System32 directory
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:4496
          • C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe
            "C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe"
            1⤵
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious use of WriteProcessMemory
            PID:2012
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe'"
              2⤵
                PID:392
              • C:\Users\Admin\AppData\Local\Temp\vshost.exe
                C:\Users\Admin\AppData\Local\Temp\vshost.exe
                2⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:224
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\S903xrp3IvxHRBfAcFsv5cxIr0gwIgb37HA0EpJISpY3XGxtgDIAkj1dpfv2.vbe"
                  3⤵
                  • Checks computer location settings
                  • Suspicious use of WriteProcessMemory
                  PID:3292
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\VivgHRzCUfvKc6g2AjCmaH9rmM.bat" "
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5008
                    • C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\ComHostMonitor.exe
                      "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf/ComHostMonitor.exe"
                      5⤵
                      • Executes dropped EXE
                      PID:1104
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\vshost.exe'"
                2⤵
                  PID:4516
              • C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe
                "C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe"
                1⤵
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of WriteProcessMemory
                PID:2264
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe'"
                  2⤵
                    PID:3308
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\vshost.exe'"
                    2⤵
                      PID:5264
                    • C:\Users\Admin\AppData\Local\Temp\vshost.exe
                      C:\Users\Admin\AppData\Local\Temp\vshost.exe
                      2⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      PID:5284
                      • C:\Windows\SysWOW64\WScript.exe
                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\S903xrp3IvxHRBfAcFsv5cxIr0gwIgb37HA0EpJISpY3XGxtgDIAkj1dpfv2.vbe"
                        3⤵
                        • Checks computer location settings
                        PID:5448
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\VivgHRzCUfvKc6g2AjCmaH9rmM.bat" "
                          4⤵
                            PID:5632
                            • C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\ComHostMonitor.exe
                              "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf/ComHostMonitor.exe"
                              5⤵
                              • Executes dropped EXE
                              PID:5800
                    • C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe
                      "C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe"
                      1⤵
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:5500
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\cheatchecker.exe'"
                        2⤵
                          PID:5576
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\vshost.exe'"
                          2⤵
                            PID:6108
                          • C:\Users\Admin\AppData\Local\Temp\vshost.exe
                            C:\Users\Admin\AppData\Local\Temp\vshost.exe
                            2⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:6124
                            • C:\Windows\SysWOW64\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\S903xrp3IvxHRBfAcFsv5cxIr0gwIgb37HA0EpJISpY3XGxtgDIAkj1dpfv2.vbe"
                              3⤵
                              • Checks computer location settings
                              PID:5176
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\VivgHRzCUfvKc6g2AjCmaH9rmM.bat" "
                                4⤵
                                  PID:5552
                                  • C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\ComHostMonitor.exe
                                    "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf/ComHostMonitor.exe"
                                    5⤵
                                    • Executes dropped EXE
                                    PID:5572
                          • C:\Users\Admin\AppData\Local\Temp\vshost.exe
                            "C:\Users\Admin\AppData\Local\Temp\vshost.exe"
                            1⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            • Modifies registry class
                            PID:5952
                            • C:\Windows\SysWOW64\WScript.exe
                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\S903xrp3IvxHRBfAcFsv5cxIr0gwIgb37HA0EpJISpY3XGxtgDIAkj1dpfv2.vbe"
                              2⤵
                              • Checks computer location settings
                              PID:6000
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\VivgHRzCUfvKc6g2AjCmaH9rmM.bat" "
                                3⤵
                                  PID:232
                                  • C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\ComHostMonitor.exe
                                    "C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf/ComHostMonitor.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    PID:5436
                            • C:\Windows\system32\taskmgr.exe
                              "C:\Windows\system32\taskmgr.exe" /4
                              1⤵
                              • Checks SCSI registry key(s)
                              • Modifies registry class
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:4900
                            • C:\odt\sihost.exe
                              "C:\odt\sihost.exe"
                              1⤵
                              • Executes dropped EXE
                              PID:1492
                            • C:\Windows\system32\mmc.exe
                              "C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s
                              1⤵
                              • Drops file in System32 directory
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of SetWindowsHookEx
                              PID:5280

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                              Filesize

                              471B

                              MD5

                              c5f458e04632f12727c3d9cb1eda59ab

                              SHA1

                              2bf868e367304cfa02b52a012d2574fe0653e429

                              SHA256

                              3a2fa7214f0d5b9451a8e1fe1ac080c4281fea28ec7f384de15b365a59cfef15

                              SHA512

                              b0fe9ecb1dfdeaef8ea404645c084855297f879567671d065260fef70abcf9af8bdc3e8e31e27e2dfb14ac43285ce46818fdda04ffc7644467109043a7ce8307

                              Download Submit

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
                              Filesize

                              400B

                              MD5

                              2f9dc9aded4c074e2bfb72ba741c1540

                              SHA1

                              7a55c5a3b21bd9384f2a0a767e8852a7c4d1a999

                              SHA256

                              b5096e096dd2587ed98b03be3fa5f54858cc90fddb8d18f2fa0d926819840c86

                              SHA512

                              c809f383ce83cc7ff5d9da4692a2d9dc158f0d45fc405dacbc7ea2daa7926c291b18d513613fc100dbc78af67aee36c99f02d0f534b7e277d13c33f895d54081

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ComHostMonitor.exe.log
                              Filesize

                              1KB

                              MD5

                              af6acd95d59de87c04642509c30e81c1

                              SHA1

                              f9549ae93fdb0a5861a79a08f60aa81c4b32377b

                              SHA256

                              7521ee2d065a78efcab55a194fbd78492f84b70595f139263875f4ea92b194d6

                              SHA512

                              93ab99bcf588fde553de3240e0d2b0cbd4e4bc5ef5e99d53f45a267d7ff30103a80b5a7aa1c52d6eff1e070af0ec82d2c0b8aafb7099742aa16810edc1815c3a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mmc.exe.log
                              Filesize

                              2KB

                              MD5

                              48a42989e3f44db40ac35be1c9a9e733

                              SHA1

                              5e66d1d0c0e696b4c77bdfbf6ba0abdda0f67962

                              SHA256

                              d59b502d40f5a9b923bd8e1bc17ae4a2af83c1648fcbf687dfbe9219b16780e6

                              SHA512

                              fecf31f81aff66036f509b298d4c8bd6effecaaf1c1f42adb1ce3bd791279c141b87d8846e316246f462df4abf35942706fb82b736739494043e1636da8aa404

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              d85ba6ff808d9e5444a4b369f5bc2730

                              SHA1

                              31aa9d96590fff6981b315e0b391b575e4c0804a

                              SHA256

                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                              SHA512

                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                              Filesize

                              2KB

                              MD5

                              968cb9309758126772781b83adb8a28f

                              SHA1

                              8da30e71accf186b2ba11da1797cf67f8f78b47c

                              SHA256

                              92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                              SHA512

                              4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              18KB

                              MD5

                              b141b6a419ed6ed761ff74478488b504

                              SHA1

                              1e4278f24ff4bf05ac70a004ec1d575350e23e2c

                              SHA256

                              5773e1d6618c5e5b135352a7a8d64ddf52a73aed5d0cbbab6135ece3fc8b74f1

                              SHA512

                              206bb48bf248ff8bfabeec78f5e9e3da03ec6f8f38c697ec27cd84d315c5e367398617ad7d870178cf73625c832fe181f27facfa61554c91de4318fb750a2e9a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              944B

                              MD5

                              242864fa38cfb42f8eed89a9a80b510d

                              SHA1

                              0981832f0e0ce28fc8dc011072e9f6579d8b16de

                              SHA256

                              d409c32deeb1808a9116227000bbeb40b15a3b33bd4c2f16c97ce3b590201442

                              SHA512

                              33650c0e18790d0ee0ef772941b03728cb3aa993b79a23287fb1d3ddf17194cd7dba40539c76384d21265b64c25c38ff99ac2caa416611c6f236b0dd9634b0b5

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              18KB

                              MD5

                              367a6c8ad48720cfc4ed6768a82f27e4

                              SHA1

                              25ef25a675cafc800b2d51c66f7f8f463f7e3df8

                              SHA256

                              6f7dc9dc61d4513b460bb7be00d5921dec43672cb9a5c59229721aac454787f4

                              SHA512

                              66a7126166b068569b55130a4eaf6687213dab6f26e83fc33282ef3fd88a47ab60cb7c6ed985906d816d89fd8b777a508a324d2e69b1076607c33cbfe5e67ede

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              18KB

                              MD5

                              283b4aa799bf8875c094551ed2bb7ff3

                              SHA1

                              f970581bf987db2af57d5356f5e6523b167f93fe

                              SHA256

                              679a40cf05cf540fd1a75e6c3f8bbb09f3e2cea45933c57fadc6b533a103552a

                              SHA512

                              b0a033766ddbe7427929e015976567d6328bdb573ba774681865d624f96f46f4a18ffd0ef2aa47e9633ad086d1beb93ff0412507135b838c703f806424fb244f

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              18KB

                              MD5

                              dc1c5b4175298ea878f8132c6fdf9291

                              SHA1

                              bc81e72735900d4d35059e4877b507a4b662adc6

                              SHA256

                              d2ab5c7b7b142aef92501d077f547b192d51f8ee710ee6075fc4aba1b91999b4

                              SHA512

                              dca327bfba6480be791431f5fa919c017b40f04af01e5fbd0371a918eabf9485e96bf7972562e7dd9fefe1117992b50a48ba5f2a2b54a16dd2bdd03778960564

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              Filesize

                              18KB

                              MD5

                              971bb282ee31942763e0a703e25a5422

                              SHA1

                              31fab931363693e862a815d9636b19ed79cd9937

                              SHA256

                              0ea6a376c10ed83b00e54c24c6b5b2aedf0a1d78572ed926bd2a63c4a5c04408

                              SHA512

                              b2955c696affc6e06ba817e031c6312c5f0f1252a03c647be519a28ec6afb317dd1275539fd36f644c0a01737bf9c054845dcf9eb42f04de5cd231a120d9ba38

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\4TNHc0Yezl.bat
                              Filesize

                              225B

                              MD5

                              df61c5aeb69fee7c7296e5f16f536736

                              SHA1

                              2a2ed98d3d4dfffed9ef93f7fe2cdce7113d5584

                              SHA256

                              dc8321c9bc0f2193879bf2e05a41b4b62e53be805e6df3127a6a8ff364cb35ba

                              SHA512

                              7bcd5b5f176661ddfed15805fe0d8ebf8699e4fc1f63b5f085474e61f445997d062433d75da8d790086016668a68b96d268697b847aff23d676e607985e03148

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\RES9923.tmp
                              Filesize

                              1KB

                              MD5

                              50b1d39b4860903e52f7a85f271307f4

                              SHA1

                              322d7df644fa1647a2cdcacc0678074ffbb27904

                              SHA256

                              8aa017fd4f2f045fd011909ffd21134d39a50407b329634ef0aa58adb86ff0fb

                              SHA512

                              1513613de009e01aeec6423b6de85b2f104adda61774df2fbe46b932e646910aa2b00cd839b582d794ea462265b19f6e8a8b66a267ff02ffcab9f072086ba199

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kvj4hypi.ebq.ps1
                              Filesize

                              60B

                              MD5

                              d17fe0a3f47be24a6453e9ef58c94641

                              SHA1

                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                              SHA256

                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                              SHA512

                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\vshost.exe
                              Filesize

                              1.4MB

                              MD5

                              e94b6ec9ddd7650edca505017d01963f

                              SHA1

                              f20f3f81b8036055947022f992d9451ca4ffa68c

                              SHA256

                              1d3966efbe2a63eebaae96d6c30d48869ab96d16b6e10747784683fa6d3c3802

                              SHA512

                              15b7191343d7e5ff9453cd2b449f172f35e469a1047b6578974ce226a9ffbc526a7b261092c0364b2733453e2181b046aec0528ccee1f5b87537f36ce549aa9d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\vshost.exe
                              Filesize

                              1.4MB

                              MD5

                              132f91b836964264f6f2a768b07218ea

                              SHA1

                              5e1e3318deda774226023b90826452369ae837b4

                              SHA256

                              c009cab0347dfaa393b765df8480cee58936a2bba71cdeed860c42a32a85c3fe

                              SHA512

                              e24ef0c27c2543b5da2c0a4763e190d2dd52670618916f850b5b096d0063cd0340dcfd5328eaf411c4253158ea1a2b8489c902e772a69068d952d399eae74de1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\vshost.exe
                              Filesize

                              2.1MB

                              MD5

                              e8fababb7847e5e21a04beff02c03c48

                              SHA1

                              c8f0e9925bd9e0a8ca61d6d4327d3a978e0c5019

                              SHA256

                              a8db7ef5043f8a2c38b95c8bf51f811ef43acbfb091ba57c87f2a7bb53f53fcb

                              SHA512

                              5f7b10dfa1d42abfda94bbc276d66fbd4fc6e394a1c0633a22f37419850059d7f3f13ed96fc998370940edefeecf38c03f6d584c5fdee2dfcce4279cb8ed0346

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\ComHostMonitor.exe
                              Filesize

                              1.8MB

                              MD5

                              ecefdd2c208aa4ee21ec1aaefbce70af

                              SHA1

                              52d1ca50f5223acb8a108eaf5bdc5f1555729e62

                              SHA256

                              73653e7417d877e579be9f4396d1469aec4cc435feb81288fcf6bb83f5eb6e39

                              SHA512

                              edd93f47f63eda33b21da247a9518bb3b19704c4acd0b74f9e09987b2e9555cdfc72fc2b1bfd40ace047590727ca49ac30b5c77b2ac9805bdc5671c3cd08b679

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\S903xrp3IvxHRBfAcFsv5cxIr0gwIgb37HA0EpJISpY3XGxtgDIAkj1dpfv2.vbe
                              Filesize

                              232B

                              MD5

                              7c43a572b8c309cf82d08855b10aa7e6

                              SHA1

                              8cd93e1bb49c4607a05bfce77d4630b93c66ee38

                              SHA256

                              c92c45044bf2226ee79982adfc88110ac5c0b0783947a1585cd89c1168299c8c

                              SHA512

                              79059c0affd2949997d5129cf21d79994df01f62628970e386d613201556174d31527940e746770a01ab97980bc649269fffea86a0b4e24c713968c1d97ae3b3

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\ComponentFontIntoperf\VivgHRzCUfvKc6g2AjCmaH9rmM.bat
                              Filesize

                              96B

                              MD5

                              f545576060709383a44bd1644ea89e9a

                              SHA1

                              022c528164c76704331680a9c35cae656c7b9577

                              SHA256

                              f416e55491a643eaaa267d2446ca6fe7b3240f1e1ab72abf2ecc1ee103c40566

                              SHA512

                              675a5b28951bf39cdade0794d2e54fd9fe5e9a8b301d10a91eeb3673661b74ff154e702acc1a30ba0c43a190885e02e010bf78f97431b9156c7d1a2147c4bd3b

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Microsoft\MMC\taskschd
                              Filesize

                              142KB

                              MD5

                              71d0d42ccec374fd5d11f7cc082cac77

                              SHA1

                              d157e549889a37cee52d4815fc359d7dbe3bc9ba

                              SHA256

                              10bcb6e5182e26b364a248c486aa4612c971ebaa7197f307d49735cd3beada6c

                              SHA512

                              5f4ec1c0b680314fa0237b4480eee7b6f1e28af8e6dae6e75ebe0679d406077463fbc23321ad6ae23a8624caa8a74f3b43de890a4bf051bc9e0697ea617fc1cb

                              Download Submit

                            • C:\windows\system32\gw1gni.exe
                              Filesize

                              4KB

                              MD5

                              ba6e13dbb57b3d8e24b13ec9f728542c

                              SHA1

                              6eeb85ac96d253c541bcf491836a419b5b7f47d2

                              SHA256

                              be1215d660f37441ef9c7823e63be63ca6f3b9f188f4c76e6d70be68e4e0ddb6

                              SHA512

                              7bd7b443f31fead745d53571b42e8dfac2f323998fcd507bdf47da7ba9d8a2054cc3de2264e3a54ec681a14ce3f339f5e439bfde460afcb13933e50d87e0356d

                              Download Submit

                            • \??\c:\Users\Admin\AppData\Local\Temp\5tcm2exn\5tcm2exn.0.cs
                              Filesize

                              381B

                              MD5

                              2050774b048b22072e40296d6c7c4e08

                              SHA1

                              a5141baa8cf0d98387b007d76822b77841a43659

                              SHA256

                              2bd11876b8879d335dc379474c65171cdf24c5aa5be3e414429eba1d5ef4519c

                              SHA512

                              ac5335d133296aef457ae70a6288aa2d3bcc9662be5d13485549b9e83a078bd603ebcdcacff2b84947743104b6b8825aa6fac097261c10006a2ad1bca2962d0a

                              Download Submit

                            • \??\c:\Users\Admin\AppData\Local\Temp\5tcm2exn\5tcm2exn.cmdline
                              Filesize

                              235B

                              MD5

                              ac7b677751bc4f39f998a683444766e5

                              SHA1

                              cd128a7a8d95d2d8a2ba8fea9295b7fff9f6e44d

                              SHA256

                              1b389f61fa540a4857563af73e53d34777161d8b0ab93d7449f538d2f5dbde45

                              SHA512

                              886884d8f5af0616a8c11e084a6ac886209baff95f47961aebbe78ea6bc2d8168b91e5353c00fd10a1acd49a2a045b680d881583b78eb5791a5c7312d148aa2c

                              Download Submit

                            • \??\c:\Windows\System32\CSC3D8393B3F4A54E158616112A954916AC.TMP
                              Filesize

                              1KB

                              MD5

                              c7af0f30f84f74adf546e15ce85b7ef0

                              SHA1

                              bb4a0d4caae0318467db17c4060a3b11ce6a83a9

                              SHA256

                              c419e8bfb2b5f92cb8082c51a1cc25d49322e5a2315e7254fe45d24fe8912cea

                              SHA512

                              eb5a2d7b3bf4a16586dc93723c64c9f60490a53bf9d13afbfc9f56eec2f8d64b135caefd43591f730ddefe5615922e1fb17e57069873e571508ff798e1976686

                              Download Submit

                            • memory/876-3-0x0000000001460000-0x0000000001461000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/876-5-0x00000000007F0000-0x0000000001433000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/876-89-0x00000000007F0000-0x0000000001433000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/876-1-0x0000000001450000-0x0000000001451000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/876-0-0x00000000007F0000-0x0000000001433000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/876-77-0x00000000007F0000-0x0000000001433000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/1620-115-0x0000000073940000-0x00000000740F0000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/1620-86-0x0000000006360000-0x00000000063AC000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/1620-104-0x0000000007370000-0x0000000007381000-memory.dmp

                              Filesize

                              68KB

                              Download

                            • memory/1620-64-0x0000000073940000-0x00000000740F0000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/1620-65-0x0000000002780000-0x0000000002790000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1620-76-0x0000000005920000-0x0000000005C74000-memory.dmp

                              Filesize

                              3.3MB

                              Download

                            • memory/1620-101-0x0000000002780000-0x0000000002790000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1620-79-0x0000000002780000-0x0000000002790000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1620-103-0x0000000002780000-0x0000000002790000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1620-106-0x00000000073B0000-0x00000000073C4000-memory.dmp

                              Filesize

                              80KB

                              Download

                            • memory/1620-102-0x00000000070B0000-0x0000000007153000-memory.dmp

                              Filesize

                              652KB

                              Download

                            • memory/1620-91-0x000000007F360000-0x000000007F370000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/1620-90-0x000000006F600000-0x000000006F64C000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/2012-319-0x00000000005E0000-0x00000000005E1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2012-318-0x00000000005D0000-0x00000000005D1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2264-374-0x00000000007F0000-0x0000000001433000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/2264-371-0x0000000001870000-0x0000000001871000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2264-372-0x0000000001880000-0x0000000001881000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2772-111-0x00007FFA4C900000-0x00007FFA4D3C1000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/2772-130-0x0000000002D00000-0x0000000002D0C000-memory.dmp

                              Filesize

                              48KB

                              Download

                            • memory/2772-161-0x00007FFA6AA50000-0x00007FFA6AB0E000-memory.dmp

                              Filesize

                              760KB

                              Download

                            • memory/2772-110-0x0000000000B10000-0x0000000000CEA000-memory.dmp

                              Filesize

                              1.9MB

                              Download

                            • memory/2772-160-0x00007FFA4C900000-0x00007FFA4D3C1000-memory.dmp

                              Filesize

                              10.8MB

                              Download

                            • memory/2772-112-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/2772-113-0x0000000001270000-0x0000000001271000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2772-131-0x00007FFA6A500000-0x00007FFA6A501000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2772-116-0x000000001BAA0000-0x000000001BAB0000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/2772-118-0x0000000002CF0000-0x0000000002CFE000-memory.dmp

                              Filesize

                              56KB

                              Download

                            • memory/2772-119-0x00007FFA6AA50000-0x00007FFA6AB0E000-memory.dmp

                              Filesize

                              760KB

                              Download

                            • memory/2772-120-0x00007FFA6A530000-0x00007FFA6A531000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2772-121-0x00007FFA6AA50000-0x00007FFA6AB0E000-memory.dmp

                              Filesize

                              760KB

                              Download

                            • memory/2772-122-0x00007FFA6A520000-0x00007FFA6A521000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2772-124-0x0000000002D20000-0x0000000002D3C000-memory.dmp

                              Filesize

                              112KB

                              Download

                            • memory/2772-125-0x000000001B890000-0x000000001B8E0000-memory.dmp

                              Filesize

                              320KB

                              Download

                            • memory/2772-126-0x00007FFA6A510000-0x00007FFA6A511000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2772-128-0x0000000002D60000-0x0000000002D78000-memory.dmp

                              Filesize

                              96KB

                              Download

                            • memory/4520-38-0x0000000004F10000-0x0000000004F20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4520-12-0x0000000005C80000-0x0000000005CE6000-memory.dmp

                              Filesize

                              408KB

                              Download

                            • memory/4520-47-0x00000000078D0000-0x00000000078DE000-memory.dmp

                              Filesize

                              56KB

                              Download

                            • memory/4520-46-0x00000000078A0000-0x00000000078B1000-memory.dmp

                              Filesize

                              68KB

                              Download

                            • memory/4520-45-0x0000000007920000-0x00000000079B6000-memory.dmp

                              Filesize

                              600KB

                              Download

                            • memory/4520-44-0x0000000007710000-0x000000000771A000-memory.dmp

                              Filesize

                              40KB

                              Download

                            • memory/4520-49-0x00000000079E0000-0x00000000079FA000-memory.dmp

                              Filesize

                              104KB

                              Download

                            • memory/4520-50-0x00000000079C0000-0x00000000079C8000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/4520-43-0x00000000076A0000-0x00000000076BA000-memory.dmp

                              Filesize

                              104KB

                              Download

                            • memory/4520-42-0x0000000007CE0000-0x000000000835A000-memory.dmp

                              Filesize

                              6.5MB

                              Download

                            • memory/4520-41-0x0000000007560000-0x0000000007603000-memory.dmp

                              Filesize

                              652KB

                              Download

                            • memory/4520-53-0x00000000749D0000-0x0000000075180000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/4520-39-0x0000000007340000-0x000000000735E000-memory.dmp

                              Filesize

                              120KB

                              Download

                            • memory/4520-40-0x0000000004F10000-0x0000000004F20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4520-28-0x0000000070C00000-0x0000000070C4C000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/4520-27-0x0000000007300000-0x0000000007332000-memory.dmp

                              Filesize

                              200KB

                              Download

                            • memory/4520-26-0x000000007FDF0000-0x000000007FE00000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4520-25-0x00000000063B0000-0x00000000063FC000-memory.dmp

                              Filesize

                              304KB

                              Download

                            • memory/4520-24-0x0000000006380000-0x000000000639E000-memory.dmp

                              Filesize

                              120KB

                              Download

                            • memory/4520-23-0x0000000005EA0000-0x00000000061F4000-memory.dmp

                              Filesize

                              3.3MB

                              Download

                            • memory/4520-13-0x0000000005CF0000-0x0000000005D56000-memory.dmp

                              Filesize

                              408KB

                              Download

                            • memory/4520-48-0x00000000078E0000-0x00000000078F4000-memory.dmp

                              Filesize

                              80KB

                              Download

                            • memory/4520-6-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

                              Filesize

                              216KB

                              Download

                            • memory/4520-8-0x0000000005550000-0x0000000005B78000-memory.dmp

                              Filesize

                              6.2MB

                              Download

                            • memory/4520-7-0x00000000749D0000-0x0000000075180000-memory.dmp

                              Filesize

                              7.7MB

                              Download

                            • memory/4520-11-0x00000000053A0000-0x00000000053C2000-memory.dmp

                              Filesize

                              136KB

                              Download

                            • memory/4520-10-0x0000000004F10000-0x0000000004F20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4520-9-0x0000000004F10000-0x0000000004F20000-memory.dmp

                              Filesize

                              64KB

                              Download

                            • memory/4900-555-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4900-546-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4900-547-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4900-553-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4900-552-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4900-554-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4900-545-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4900-556-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4900-557-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/4900-558-0x00000182C73C0000-0x00000182C73C1000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5500-454-0x00000000007F0000-0x0000000001433000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/5500-452-0x0000000001B60000-0x0000000001B61000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/5500-451-0x0000000001970000-0x0000000001971000-memory.dmp

                              Filesize

                              4KB

                              Download