zgrat | e76ef27047a9299a7c1a2cc8f33c16342f698cf55fbf85b088841f8a2a1015b7

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
28/04/2024, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4AFAF34462AEF2025EEEA79643032432.exe
Size 2.6MB
Sample240428-ryj8tsab91
SHA256 e76ef27047a9299a7c1a2cc8f33c16342f698cf55fbf85b088841f8a2a1015b7
MD5 4afaf34462aef2025eeea79643032432
SHA1 b4974353a79486a83ed650a7bf8f6f01dfd53a29
SHA512 c3326be4e936082b90f342797073cfdff9be8b370756bd0824baeb17e89c0241cb3d8e75417852d6611e6c31c8bb55832b2e1eb84e1b8e1fa1a8856ff61afdf8
SSDEEP 49152:imtEDxTJYDnSvkS0mrLjkq5z5nA6CS7mP4IRoVR:im4Y6fkGESmRiv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/memory/2684-0-0x00000000006C0000-0x0000000000960000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000a000000023ba1-51.dat	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	4AFAF34462AEF2025EEEA79643032432.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	smss.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	smss.exe

Executes dropped EXE 7 IoCs

pid	Process
1452	smss.exe
4592	smss.exe
2156	smss.exe
860	smss.exe
4228	smss.exe
3464	smss.exe
4608	smss.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\smss.exe	4AFAF34462AEF2025EEEA79643032432.exe
File created	C:\Program Files\Internet Explorer\69ddcba757bf72	4AFAF34462AEF2025EEEA79643032432.exe
File created	C:\Program Files\ModifiableWindowsApps\dllhost.exe	4AFAF34462AEF2025EEEA79643032432.exe
File created	C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe	4AFAF34462AEF2025EEEA79643032432.exe
File created	C:\Program Files (x86)\WindowsPowerShell\e6c9b481da804f	4AFAF34462AEF2025EEEA79643032432.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Performance\WinSAT\DataStore\services.exe	4AFAF34462AEF2025EEEA79643032432.exe
File opened for modification	C:\Windows\Performance\WinSAT\DataStore\services.exe	4AFAF34462AEF2025EEEA79643032432.exe
File created	C:\Windows\Performance\WinSAT\DataStore\c5b4cb5e9653cc	4AFAF34462AEF2025EEEA79643032432.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	4AFAF34462AEF2025EEEA79643032432.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	smss.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	smss.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1796	PING.EXE
2088	PING.EXE
4348	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe
2684	4AFAF34462AEF2025EEEA79643032432.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	4AFAF34462AEF2025EEEA79643032432.exe
Token: SeDebugPrivilege	1452	smss.exe
Token: SeDebugPrivilege	4592	smss.exe
Token: SeDebugPrivilege	2156	smss.exe
Token: SeDebugPrivilege	860	smss.exe
Token: SeDebugPrivilege	4228	smss.exe
Token: SeDebugPrivilege	3464	smss.exe
Token: SeDebugPrivilege	4608	smss.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 4584	2684	4AFAF34462AEF2025EEEA79643032432.exe	87
PID 2684 wrote to memory of 4584	2684	4AFAF34462AEF2025EEEA79643032432.exe	87
PID 4584 wrote to memory of 1884	4584	cmd.exe	89
PID 4584 wrote to memory of 1884	4584	cmd.exe	89
PID 4584 wrote to memory of 3996	4584	cmd.exe	90
PID 4584 wrote to memory of 3996	4584	cmd.exe	90
PID 4584 wrote to memory of 1452	4584	cmd.exe	91
PID 4584 wrote to memory of 1452	4584	cmd.exe	91
PID 1452 wrote to memory of 1684	1452	smss.exe	93
PID 1452 wrote to memory of 1684	1452	smss.exe	93
PID 1684 wrote to memory of 4140	1684	cmd.exe	95
PID 1684 wrote to memory of 4140	1684	cmd.exe	95
PID 1684 wrote to memory of 1796	1684	cmd.exe	96
PID 1684 wrote to memory of 1796	1684	cmd.exe	96
PID 1684 wrote to memory of 4592	1684	cmd.exe	98
PID 1684 wrote to memory of 4592	1684	cmd.exe	98
PID 4592 wrote to memory of 752	4592	smss.exe	102
PID 4592 wrote to memory of 752	4592	smss.exe	102
PID 752 wrote to memory of 4820	752	cmd.exe	104
PID 752 wrote to memory of 4820	752	cmd.exe	104
PID 752 wrote to memory of 2088	752	cmd.exe	105
PID 752 wrote to memory of 2088	752	cmd.exe	105
PID 752 wrote to memory of 2156	752	cmd.exe	108
PID 752 wrote to memory of 2156	752	cmd.exe	108
PID 2156 wrote to memory of 884	2156	smss.exe	111
PID 2156 wrote to memory of 884	2156	smss.exe	111
PID 884 wrote to memory of 2188	884	cmd.exe	113
PID 884 wrote to memory of 2188	884	cmd.exe	113
PID 884 wrote to memory of 3052	884	cmd.exe	114
PID 884 wrote to memory of 3052	884	cmd.exe	114
PID 884 wrote to memory of 860	884	cmd.exe	115
PID 884 wrote to memory of 860	884	cmd.exe	115
PID 860 wrote to memory of 4624	860	smss.exe	116
PID 860 wrote to memory of 4624	860	smss.exe	116
PID 4624 wrote to memory of 1856	4624	cmd.exe	118
PID 4624 wrote to memory of 1856	4624	cmd.exe	118
PID 4624 wrote to memory of 4348	4624	cmd.exe	119
PID 4624 wrote to memory of 4348	4624	cmd.exe	119
PID 4624 wrote to memory of 4228	4624	cmd.exe	120
PID 4624 wrote to memory of 4228	4624	cmd.exe	120
PID 4228 wrote to memory of 4252	4228	smss.exe	121
PID 4228 wrote to memory of 4252	4228	smss.exe	121
PID 4252 wrote to memory of 2968	4252	cmd.exe	123
PID 4252 wrote to memory of 2968	4252	cmd.exe	123
PID 4252 wrote to memory of 4364	4252	cmd.exe	124
PID 4252 wrote to memory of 4364	4252	cmd.exe	124
PID 4252 wrote to memory of 3464	4252	cmd.exe	125
PID 4252 wrote to memory of 3464	4252	cmd.exe	125
PID 3464 wrote to memory of 4796	3464	smss.exe	126
PID 3464 wrote to memory of 4796	3464	smss.exe	126
PID 4796 wrote to memory of 4408	4796	cmd.exe	128
PID 4796 wrote to memory of 4408	4796	cmd.exe	128
PID 4796 wrote to memory of 2424	4796	cmd.exe	129
PID 4796 wrote to memory of 2424	4796	cmd.exe	129
PID 4796 wrote to memory of 4608	4796	cmd.exe	130
PID 4796 wrote to memory of 4608	4796	cmd.exe	130

C:\Users\Admin\AppData\Local\Temp\4AFAF34462AEF2025EEEA79643032432.exe
"C:\Users\Admin\AppData\Local\Temp\4AFAF34462AEF2025EEEA79643032432.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\0b9wHtOVaS.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1884
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3996
- - C:\Program Files\Internet Explorer\smss.exe
    "C:\Program Files\Internet Explorer\smss.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WuqrHCDFSV.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1684
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4140
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:1796
    - - C:\Program Files\Internet Explorer\smss.exe
        
        "C:\Program Files\Internet Explorer\smss.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4592
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WLOEqHw6cP.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4820
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:2088
        
        C:\Program Files\Internet Explorer\smss.exe
        
        "C:\Program Files\Internet Explorer\smss.exe"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2156
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KtA3LkY0CV.bat"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:884
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:2188
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        9⤵
        
        PID:3052
        
        C:\Program Files\Internet Explorer\smss.exe
        
        "C:\Program Files\Internet Explorer\smss.exe"
        9⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:860
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\URBaIgEX4g.bat"
        10⤵
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        11⤵
        
        PID:1856
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        11⤵
        Runs ping.exe
        
        PID:4348
        
        C:\Program Files\Internet Explorer\smss.exe
        
        "C:\Program Files\Internet Explorer\smss.exe"
        11⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4228
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\zsJdcY9yPm.bat"
        12⤵
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        13⤵
        
        PID:2968
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        13⤵
        
        PID:4364
        
        C:\Program Files\Internet Explorer\smss.exe
        
        "C:\Program Files\Internet Explorer\smss.exe"
        13⤵
        Checks computer location settings
        Executes dropped EXE
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lcphCLUtxr.bat"
        14⤵
        Suspicious use of WriteProcessMemory
        
        PID:4796
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        15⤵
        
        PID:4408
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        15⤵
        
        PID:2424
        
        C:\Program Files\Internet Explorer\smss.exe
        
        "C:\Program Files\Internet Explorer\smss.exe"
        15⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

smss.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smss.exe.log
Size 1KB
SHA256 b3962e6d42e27ef9361243e90b4d1aab348c15b2a592bf5d9fbf1fd95b5bed73
MD5 406d15a76e2ddca1229bdfb1d4b9518a
SHA1 88c455ec9a9c46e422f92e34c56afee4a2e1ef67
SHA512 eb7eadcb0fa846fe41a5001ef3227962863f9341a1970ae3c1183086e16e853f1196858b1b198f8ae49d9cec06f59e1c655c1f0e4bf60246a9f05d8a5f5c8653
MD5 SHA1 SHA512

Submit Download

0b9wHtOVaS.bat

Path C:\Users\Admin\AppData\Local\Temp\0b9wHtOVaS.bat
Size 219B
SHA256 6411d0f42d7b057b80d6527d6e1be8619a3cd04b51d827a756aca8aa30b325b9
MD5 4317b862631863ab7189b457d98e645b
SHA1 32764ded369c3a646b291c1654910ccdbeac3d87
SHA512 c7032b536141d27cd74af75ea7eb8379c751dadbdd98bbd1715016a28984df0adb5eec5f065eb0465d406e392f0d48fe9439b22947a808e891336eba8e951d4b
MD5 SHA1 SHA512

Submit Download

KtA3LkY0CV.bat

Path C:\Users\Admin\AppData\Local\Temp\KtA3LkY0CV.bat
Size 219B
SHA256 448e80f7214d02297bf09b72f6c55ec5dd8ffc72431903dfb4cf9aa7918f0f66
MD5 6839032ffdd5a6b0177c094c7b70cf79
SHA1 4836fdcdb9dff75f9d88764005159cc5ea4f37ad
SHA512 bcc09866856100ff1a77558f5fbd02e6d12d89348425cf1107edf1c500de8a2f0e6f5e4915ea22a22ee9d68d61d6b35e78bfc5dd14ff6a0eb47f7bb40246874f
MD5 SHA1 SHA512

Submit Download

URBaIgEX4g.bat

Path C:\Users\Admin\AppData\Local\Temp\URBaIgEX4g.bat
Size 171B
SHA256 b10fe726d24d2ec9d3ecb9b9165367a59e377e8ff94024fae17a5761450192eb
MD5 9193e79d42f461aa89bb0ffd46661535
SHA1 d03d354d3df6a0b1a2993cbec04d0fa97a1bf3cd
SHA512 dd60bd80bc06a61e923cb442670ffdb9138d6c0727aae2a218824d641267ed3d476ed9c417663902059f0075c824a84cc2cd9b1acd5cb24fd6d1fc640a6a65aa
MD5 SHA1 SHA512

Submit Download

WLOEqHw6cP.bat

Path C:\Users\Admin\AppData\Local\Temp\WLOEqHw6cP.bat
Size 171B
SHA256 61f8fef46529f953026fbd4619ccc59d25fb3bac96994a76b65997e8cad85e9c
MD5 e9b63a2d6c78e9d7bc17039d07555389
SHA1 063afb15ab138a44c002ec4deeb4ccb5d409e1a1
SHA512 5aeeaa5ab71ddfd827f29b65a320e09a04df4d2c7a99c15a125dad1aa622b2f311e3f9ff678f370df18593a345affa80f54bdd40ec50ee44c5cc17462e9cef13
MD5 SHA1 SHA512

Submit Download

WuqrHCDFSV.bat

Path C:\Users\Admin\AppData\Local\Temp\WuqrHCDFSV.bat
Size 171B
SHA256 cee66dcf57ce5f0989b3ad77a08089a3935460019f9ee257ecaa6fdd586cd1ea
MD5 1b65ff32af8d253b48bb649d8640f3cb
SHA1 bc9ed27ed65d0873cd3e9f02b4add781c0273f22
SHA512 9949350994c6fcbc8bdd8610c0297a2191203a2e7b6bff937f2135aba8de55b30369fcf2e922a5f96961bc71b2190edbbd69ae580d962d180d6098258a273e59
MD5 SHA1 SHA512

Submit Download

lcphCLUtxr.bat

Path C:\Users\Admin\AppData\Local\Temp\lcphCLUtxr.bat
Size 219B
SHA256 a45f9d7e9658f3e5fc2e145c725af96b01ea979456ce2b4e0d29e877a95e8ee6
MD5 0adedff27f1e42f12b10380efbe586fe
SHA1 6db026641ac656fe9ccc0ba1b17bb0187c30babb
SHA512 e04f7599b82041d3b8c4995867b41db1df4be97d99a93d31ffc9a54986719ef9052d445097c13a47d22de783b85599cf1899930035de24b09675436406825dc5
MD5 SHA1 SHA512

Submit Download

zsJdcY9yPm.bat

Path C:\Users\Admin\AppData\Local\Temp\zsJdcY9yPm.bat
Size 219B
SHA256 77f974bfb99f7a031048400a8273b73911052b5eec3919457c45d91f62d9c7aa
MD5 8ca6873c19bd10cdb9d22788a7cb60f0
SHA1 2ac16176827113c2aba26c5135d3733c0c57e90e
SHA512 be5ddb6667bbb50c00bd27727796d9a4c06ed2f5ce0d0a53688535d7166c3ba06b75b93b79998b9a3634fa59a8da8d14a303425d81eb47ebeddc085f6f382260
MD5 SHA1 SHA512

Submit Download

StartMenuExperienceHost.exe

Path C:\Users\Default\Desktop\StartMenuExperienceHost.exe
Size 2.6MB
SHA256 e76ef27047a9299a7c1a2cc8f33c16342f698cf55fbf85b088841f8a2a1015b7
MD5 4afaf34462aef2025eeea79643032432
SHA1 b4974353a79486a83ed650a7bf8f6f01dfd53a29
SHA512 c3326be4e936082b90f342797073cfdff9be8b370756bd0824baeb17e89c0241cb3d8e75417852d6611e6c31c8bb55832b2e1eb84e1b8e1fa1a8856ff61afdf8
SSDEEP 49152:imtEDxTJYDnSvkS0mrLjkq5z5nA6CS7mP4IRoVR:im4Y6fkGESmRiv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2684-27-0x0000000002BE0000-0x0000000002BEC000-memory.dmp

Download

memory/2684-33-0x00007FFAF2AA0000-0x00007FFAF2AA1000-memory.dmp

Download

memory/2684-13-0x00007FFAF2AE0000-0x00007FFAF2AE1000-memory.dmp

Download

memory/2684-14-0x000000001B620000-0x000000001B670000-memory.dmp

Download

memory/2684-16-0x0000000002BC0000-0x0000000002BD8000-memory.dmp

Download

memory/2684-17-0x00007FFAF2AD0000-0x00007FFAF2AD1000-memory.dmp

Download

memory/2684-19-0x0000000002B80000-0x0000000002B8E000-memory.dmp

Download

memory/2684-20-0x00007FFAF2AC0000-0x00007FFAF2AC1000-memory.dmp

Download

memory/2684-22-0x0000000002B90000-0x0000000002B9E000-memory.dmp

Download

memory/2684-23-0x00007FFAF2AB0000-0x00007FFAF2AB1000-memory.dmp

Download

memory/2684-25-0x0000000002C00000-0x0000000002C12000-memory.dmp

Download

memory/2684-0-0x00000000006C0000-0x0000000000960000-memory.dmp

Download

memory/2684-29-0x0000000002BF0000-0x0000000002C00000-memory.dmp

Download

memory/2684-30-0x00007FFAD5290000-0x00007FFAD5D51000-memory.dmp

Download

memory/2684-32-0x000000001BB10000-0x000000001BB6A000-memory.dmp

Download

memory/2684-12-0x0000000002BA0000-0x0000000002BBC000-memory.dmp

Download

memory/2684-35-0x0000000002C20000-0x0000000002C30000-memory.dmp

Download

memory/2684-37-0x0000000002C30000-0x0000000002C3E000-memory.dmp

Download

memory/2684-39-0x000000001BAD0000-0x000000001BAE8000-memory.dmp

Download

memory/2684-41-0x000000001B670000-0x000000001B67C000-memory.dmp

Download

memory/2684-8-0x00007FFAF2C10000-0x00007FFAF2CCE000-memory.dmp

Download

memory/2684-60-0x00007FFAF2C10000-0x00007FFAF2CCE000-memory.dmp

Download

memory/2684-59-0x00007FFAD5290000-0x00007FFAD5D51000-memory.dmp

Download

memory/2684-9-0x00007FFAF2AF0000-0x00007FFAF2AF1000-memory.dmp

Download

memory/2684-10-0x000000001B680000-0x000000001B690000-memory.dmp

Download

memory/2684-7-0x00007FFAF2C10000-0x00007FFAF2CCE000-memory.dmp

Download

memory/2684-6-0x0000000002B70000-0x0000000002B7E000-memory.dmp

Download

memory/2684-4-0x000000001B680000-0x000000001B690000-memory.dmp

Download

memory/2684-3-0x0000000001200000-0x0000000001201000-memory.dmp

Download

memory/2684-2-0x000000001B680000-0x000000001B690000-memory.dmp

Download

memory/2684-1-0x00007FFAD5290000-0x00007FFAD5D51000-memory.dmp

Download

memory/3464-178-0x000000001D190000-0x000000001D231000-memory.dmp

Download