Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

61c51c7ab2...34.exe

windows7-x64

10

61c51c7ab2...34.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2024, 01:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe

  • Size

    7.2MB

  • MD5

    5446af14bfb2bf63ec1b409a0752f2bb

  • SHA1

    2d0ed53f2bab261a09e50e35b95f896ddf6dd688

  • SHA256

    61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434

  • SHA512

    3f96ff6656d7937fe3be66688c5559a238be9e0277373dd8a325f2e36fbd50095285ae8da8db0b59f0706b9514bdf54f2f66da81caf4d2818b9c9d20d5cff436

  • SSDEEP

    49152:OSa5+lvH/3ehlWOU9Hl73KkPjOMVMC21gt9dmFF9KINW1FQr7qrzW+x30rY6yTK4:A0X3IWbXPjObC9CFAArmGm3U0KFK/j

Score
10/10
zgratexecutionrat

Malware Config

Signatures

  • Detect ZGRat V1 32 IoCs
  • Process spawned unexpected child process 18 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Detects executables packed with unregistered version of .NET Reactor 39 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 18 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe
    "C:\Users\Admin\AppData\Local\Temp\61c51c7ab209978d127693a8837c3fb65f16a8315d511aa84e0b8c9129afc434.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Users\Admin\AppData\Local\Temp\Province Hacks.exe
      "C:\Users\Admin\AppData\Local\Temp\Province Hacks.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Users\Admin\AppData\Local\Temp\Logger.exe
        "C:\Users\Admin\AppData\Local\Temp\Logger.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4880
        • C:\Users\Admin\AppData\Local\Temp\1.exe
          "C:\Users\Admin\AppData\Local\Temp\1.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2732
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1156
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:5012
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4980
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:824
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1528
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4156
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2524
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1620
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:2004
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3288
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:1944
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3896
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4736
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\Saved Games\msedge.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4480
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\unsecapp.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4124
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\TextInputHost.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4688
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\msedge.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:3524
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious use of AdjustPrivilegeToken
            PID:4952
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Mk9gQGmwZ5.bat"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:5308
            • C:\Windows\system32\chcp.com
              chcp 65001
              6⤵
                PID:5752
              • C:\Windows\system32\PING.EXE
                ping -n 10 localhost
                6⤵
                • Runs ping.exe
                PID:5720
              • C:\odt\unsecapp.exe
                "C:\odt\unsecapp.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5520
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:1232
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1920
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4776
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4108
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\msedge.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3600
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\msedge.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4892
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\Saved Games\msedge.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2644
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\odt\unsecapp.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2344
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\odt\unsecapp.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4640
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\odt\unsecapp.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4756
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:60
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:708
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\TextInputHost.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1360
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4516
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:4728
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "msedgem" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\msedge.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1188
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "11" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\1.exe'" /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:2284
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "1" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\1.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:1136
      • C:\Windows\system32\schtasks.exe
        schtasks.exe /create /tn "11" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\1.exe'" /rl HIGHEST /f
        1⤵
        • Process spawned unexpected child process
        • Creates scheduled task(s)
        PID:3872

      Network

      • flag-us
        DNS
        13.86.106.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.86.106.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        20.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        20.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        28.118.140.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        28.118.140.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        159.113.53.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        159.113.53.23.in-addr.arpa
        IN PTR
        Response
        159.113.53.23.in-addr.arpa
        IN PTR
        a23-53-113-159deploystaticakamaitechnologiescom
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        142.53.16.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        142.53.16.96.in-addr.arpa
        IN PTR
        Response
        142.53.16.96.in-addr.arpa
        IN PTR
        a96-16-53-142deploystaticakamaitechnologiescom
      • flag-us
        DNS
        183.142.211.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        183.142.211.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        13.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        90.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        90.16.208.104.in-addr.arpa
        IN PTR
        Response
      • 23.44.234.16:80
        260 B
         5
      • 13.107.253.64:443
        46 B
         40 B
         1
        1
      • 8.8.8.8:53
        13.86.106.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        13.86.106.20.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        20.160.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        20.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        146 B
         144 B
         2
        1

        DNS Request

        95.221.229.192.in-addr.arpa

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        28.118.140.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        28.118.140.52.in-addr.arpa

      • 8.8.8.8:53
        159.113.53.23.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        159.113.53.23.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        142.53.16.96.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        142.53.16.96.in-addr.arpa

      • 8.8.8.8:53
        183.142.211.20.in-addr.arpa
        dns
        73 B
         159 B
         1
        1

        DNS Request

        183.142.211.20.in-addr.arpa

      • 8.8.8.8:53
        13.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        13.227.111.52.in-addr.arpa

      • 8.8.8.8:53
        90.16.208.104.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        90.16.208.104.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
        Filesize

        2KB

        MD5

        d85ba6ff808d9e5444a4b369f5bc2730

        SHA1

        31aa9d96590fff6981b315e0b391b575e4c0804a

        SHA256

        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

        SHA512

        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        d28a889fd956d5cb3accfbaf1143eb6f

        SHA1

        157ba54b365341f8ff06707d996b3635da8446f7

        SHA256

        21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

        SHA512

        0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        e8ce785f8ccc6d202d56fefc59764945

        SHA1

        ca032c62ddc5e0f26d84eff9895eb87f14e15960

        SHA256

        d85c19fc6b9d25e2168a2cc50ff38bd226fbf4f02aa7ac038a5f319522d2ffa4

        SHA512

        66460aec4afee582556270f8ee6048d130a090f1c12a2632ed71a99a4073e9931e9e1cc286e32debffb95a90bd955f0f0d6ec891b1c5cd2f0aae41eb6d25832f

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        3a6bad9528f8e23fb5c77fbd81fa28e8

        SHA1

        f127317c3bc6407f536c0f0600dcbcf1aabfba36

        SHA256

        986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

        SHA512

        846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        aaaac7c68d2b7997ed502c26fd9f65c2

        SHA1

        7c5a3731300d672bf53c43e2f9e951c745f7fbdf

        SHA256

        8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

        SHA512

        c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        a8e8360d573a4ff072dcc6f09d992c88

        SHA1

        3446774433ceaf0b400073914facab11b98b6807

        SHA256

        bf5e284e8f95122bf75ead61c7e2b40f55c96742b05330b5b1cb7915991df13b

        SHA512

        4ee5167643d82082f57c42616007ef9be57f43f9731921bdf7bca611a914724ad94072d3c8f5b130fa54129e5328ccdebf37ba74339c37deb53e79df5cdf0dbe

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        60804e808a88131a5452fed692914a8e

        SHA1

        fdb74669923b31d573787fe024dbd701fa21bb5b

        SHA256

        064fdd6e9e6e7f51da354604a56f66217f1edfc12d9bbbaf869a628915a86a61

        SHA512

        d4f2791433c0bacd8cad57b40fab4a807db4dd74f7c5357d2bce9aaa6544f97667497307d1e0704b98e2c99a94775fbb6ea676685a01578e4d0304f541c9854a

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        Filesize

        944B

        MD5

        ecceac16628651c18879d836acfcb062

        SHA1

        420502b3e5220a01586c59504e94aa1ee11982c9

        SHA256

        58238de09a8817ed9f894ed8e5bf06a897fd08e0b0bd77e508d37b2598edd2a9

        SHA512

        be3c7cb529cafb00f58790a6f8b35c4ff6db9f7f43a507d2218fd80cebc88413e46f71b1bc35b8afcc36b68f9409c946470d1e74a4fe225400eeb6f3f898f5b3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1.exe
        Filesize

        6.3MB

        MD5

        4e2c3489ec26807d69f9171479886188

        SHA1

        40f8c57e6918d1626177810c6f1b5a65d9bf93d1

        SHA256

        33466d0c92e0fb64d98b89ca503976b86cfd5400c387aeb9dd66f096b4c14ca9

        SHA512

        0ed949039d77b4777f8da9ede1e245b22759fa2bd86ec90692c216263a27693264f926ad256336a8b4e2e688c05deb4790ba0a2799479213a9cb9960787f0d3e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Logger.exe
        Filesize

        6.6MB

        MD5

        48bfaeb0285f1b090cbf09e2feb6ad10

        SHA1

        67d25ecce37f5a70ec950758351e81593b99ed05

        SHA256

        d8c19254251b41d6f815582ba4c018994cae3bdf3677e198a88138a43aaaf15e

        SHA512

        f8f19c480a72dcb1a88585a94c95767dfdaab0320aafd46f61309385fd9f7e68a8b392801ab243e7c545f43cd9e23366aa94814a05d9f9a0b604c22ab81ad08d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Mk9gQGmwZ5.bat
        Filesize

        147B

        MD5

        710dcd1097713344551a8ebdd8ca517d

        SHA1

        c9c03562adaac741336e4cd5cf774872274ff28d

        SHA256

        565fc63d25b97a5b7b5ac6ddb0df1bb9a152f1cf2baa124de88433e13a189981

        SHA512

        c4b6b79e2c50c55a8824314bc39ee12686a0e42080f57aa5ffbcda7910c9a5c810c717ba401208ade9a792d63bb670e65c95ccb82219ca96955cbb81032d58d0

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Province Hacks.exe
        Filesize

        6.9MB

        MD5

        d22490055518bbf8d44579a00453da46

        SHA1

        d738768635f9646c71b98befc3bf2a4c9f5c29e3

        SHA256

        ee2c37126091fa67a5b5abbf7ac2a4271514ec7620aef87b34d42e80c576cd0a

        SHA512

        ecdd5baf602b3e9e59f15b47ad3925026568be9fdf1d384cc3dbae2b292abbf1878cbd1f919cf680442c65a9299c3496d9f03fed8b8504ba34f805e5ef984f08

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pbyzamwd.ozc.ps1
        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        Download Submit

      • memory/2732-3594-0x000000001C580000-0x000000001C5A6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2732-3609-0x000000001C5E0000-0x000000001C5EE000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2732-52-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-48-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-46-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-50-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-42-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-44-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-40-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-90-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-96-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-94-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-92-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-88-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-86-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-84-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-82-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-80-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-78-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-76-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-74-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-70-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-66-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-58-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-3596-0x0000000003090000-0x000000000309E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2732-3598-0x000000001C5B0000-0x000000001C5CC000-memory.dmp

        Filesize

        112KB

        Download

      • memory/2732-3599-0x000000001C620000-0x000000001C670000-memory.dmp

        Filesize

        320KB

        Download

      • memory/2732-3601-0x00000000030A0000-0x00000000030B0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2732-3603-0x000000001C5F0000-0x000000001C608000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2732-3605-0x00000000030B0000-0x00000000030C0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2732-3607-0x000000001C5D0000-0x000000001C5E0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2732-54-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-3611-0x000000001C690000-0x000000001C6A2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2732-3613-0x000000001C610000-0x000000001C620000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2732-3615-0x000000001C6B0000-0x000000001C6C6000-memory.dmp

        Filesize

        88KB

        Download

      • memory/2732-3617-0x000000001C6D0000-0x000000001C6E2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2732-3618-0x000000001CC20000-0x000000001D148000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/2732-3620-0x000000001C670000-0x000000001C67E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2732-3622-0x000000001C680000-0x000000001C690000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2732-3624-0x000000001C6F0000-0x000000001C700000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2732-3626-0x000000001C760000-0x000000001C7BA000-memory.dmp

        Filesize

        360KB

        Download

      • memory/2732-3628-0x000000001C700000-0x000000001C70E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2732-3630-0x000000001C710000-0x000000001C720000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2732-3632-0x000000001C720000-0x000000001C72E000-memory.dmp

        Filesize

        56KB

        Download

      • memory/2732-3634-0x000000001C7C0000-0x000000001C7D8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/2732-3636-0x000000001C730000-0x000000001C73C000-memory.dmp

        Filesize

        48KB

        Download

      • memory/2732-3638-0x000000001C830000-0x000000001C87E000-memory.dmp

        Filesize

        312KB

        Download

      • memory/2732-35-0x0000000000970000-0x0000000000FC0000-memory.dmp

        Filesize

        6.3MB

        Download

      • memory/2732-36-0x000000001BEA0000-0x000000001C22E000-memory.dmp

        Filesize

        3.6MB

        Download

      • memory/2732-37-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-60-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-62-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-64-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-68-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-72-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-56-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/2732-38-0x000000001BEA0000-0x000000001C227000-memory.dmp

        Filesize

        3.5MB

        Download

      • memory/3732-11-0x0000000000400000-0x0000000000B37000-memory.dmp

        Filesize

        7.2MB

        Download

      • memory/4236-23-0x0000000000400000-0x0000000000AF3000-memory.dmp

        Filesize

        6.9MB

        Download

      • memory/4688-3654-0x000002490F2E0000-0x000002490F302000-memory.dmp

        Filesize

        136KB

        Download

      • memory/4880-33-0x0000000000400000-0x0000000000A98000-memory.dmp

        Filesize

        6.6MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.