Malware Analysis Report

2024-11-30 20:04

Sample ID 240509-l549pacc6y
Target a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe
SHA256 a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a
Tags
zgrat evasion rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a

Threat Level: Known bad

The file a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe was found to be: Known bad.

Malicious Activity Summary

zgrat evasion rat spyware stealer

Detect ZGRat V1

ZGRat

Disables Task Manager via registry modification

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Reads user/profile data of web browsers

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Modifies registry key

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 10:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 10:07

Reported

2024-05-09 10:10

Platform

win7-20240220-en

Max time kernel

118s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

Disables Task Manager via registry modification

evasion

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Windows Journal\conhost.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File opened for modification C:\Program Files\Windows Journal\conhost.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\Windows Journal\088424020bedd6 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Enumerates physical storage devices

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
Token: SeDebugPrivilege N/A C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\dwm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2924 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 2924 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 2924 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 2924 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 2560 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 2560 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 2560 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 2560 wrote to memory of 2428 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 2428 wrote to memory of 2880 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2428 wrote to memory of 2880 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2428 wrote to memory of 2880 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2428 wrote to memory of 2880 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2880 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 2972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2880 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 2880 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 2880 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 2880 wrote to memory of 1648 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 1648 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 1648 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 1648 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 1192 wrote to memory of 1460 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 1192 wrote to memory of 1460 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 1192 wrote to memory of 1460 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 1192 wrote to memory of 1152 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 1192 wrote to memory of 1152 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 1192 wrote to memory of 1152 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 1192 wrote to memory of 2228 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\dwm.exe
PID 1192 wrote to memory of 2228 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\dwm.exe
PID 1192 wrote to memory of 2228 N/A C:\Windows\System32\cmd.exe C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\dwm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe

"C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe"

C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe

"C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat" "

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe

"C:\Users\Admin\AppData\Roaming\componentRuntimehost/BridgeChainportWebInto.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\TSnaP5ddU7.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\PING.EXE

ping -n 10 localhost

C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\dwm.exe

"C:\Users\All Users\Package Cache\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\dwm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 065963cm.nyashkoon.top udp
US 172.67.185.34:80 065963cm.nyashkoon.top tcp
US 172.67.185.34:80 065963cm.nyashkoon.top tcp

Files

memory/2924-0-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

memory/2924-1-0x0000000000D10000-0x0000000001336000-memory.dmp

memory/2924-2-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe

MD5 2cf0a29383fd0b2054138434eed1b265
SHA1 84138a0182af9ef5c6b31255bd85707e0ad6a0c3
SHA256 e4011f2b2426a6fcb2f48317c8623a9d7583b782b2a4f10caee19f0df70b4185
SHA512 3977b288e3512184bed9ead0947f35cb6e3c95c83a517cadd8c63ed642fbb47a41e9ac30c43a0f877ed33bd13a482e082c308081b387e7d339f71c3582da91ca

memory/2924-11-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe

MD5 cf441f15daf3339180706cf594e97131
SHA1 ca5663745d79bd9196fea24b51d6061f79355d3c
SHA256 9a2afde59f2326a4cfbc827e87c7270da20d4a6e19e8d00b5b3a479c26f8ad13
SHA512 37d2b08ca78ee06fbcc93577a31a243670fd4efce506449e2e4e3b33c2319081e1f905f8651a642112386620f6551c1a598cdc7f69e682ee252fddc2fa9cde74

C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat

MD5 f4846b111f4c8ced35bf1ed60502270f
SHA1 625bb8296688ca9cde0c60c60cc17ed83383050c
SHA256 2b20a48f281b60176569332a9e56f5aa7911ba9793f87f9729aafc81aab5a6cd
SHA512 ef77a850b15f988754eb17c48ce84e15bcf824c4bcc64ac7f5f372f86fee5738de67417fd0cf56271d1701b5256edcf4ad8603b5fab28016af8e28359967df67

\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe

MD5 51a33d556ce031ad0a5e752f10b00a13
SHA1 f05e11e3034481de8590ee4afd912628cacfde9a
SHA256 eab0d35dc956885b222e69fde419f3974db712c98bbb23f41325388bde0cc341
SHA512 c27a18ebee3e32854e4ad136c3af7de753764a9b44fc024487eb4a197a3f68b506f8578c4beab63e23c64b4e8ce10d63d2987b78175a9691e9aec9fc13887356

memory/1648-25-0x0000000000160000-0x00000000004CA000-memory.dmp

memory/1648-27-0x0000000000960000-0x0000000000986000-memory.dmp

memory/1648-29-0x0000000000790000-0x000000000079E000-memory.dmp

memory/1648-31-0x0000000000990000-0x00000000009AC000-memory.dmp

memory/1648-33-0x00000000007A0000-0x00000000007B0000-memory.dmp

memory/1648-35-0x00000000009B0000-0x00000000009C8000-memory.dmp

memory/1648-37-0x0000000000930000-0x0000000000940000-memory.dmp

memory/1648-39-0x0000000000940000-0x0000000000950000-memory.dmp

memory/1648-41-0x0000000000950000-0x000000000095E000-memory.dmp

memory/1648-43-0x00000000022A0000-0x00000000022B2000-memory.dmp

memory/1648-45-0x00000000009D0000-0x00000000009E0000-memory.dmp

memory/1648-47-0x00000000022C0000-0x00000000022D6000-memory.dmp

memory/1648-49-0x00000000022E0000-0x00000000022F2000-memory.dmp

memory/1648-51-0x00000000009E0000-0x00000000009F0000-memory.dmp

memory/1648-53-0x00000000009F0000-0x0000000000A00000-memory.dmp

memory/1648-55-0x000000001B780000-0x000000001B7DA000-memory.dmp

memory/1648-57-0x0000000002300000-0x000000000230E000-memory.dmp

memory/1648-59-0x0000000002560000-0x0000000002578000-memory.dmp

memory/1648-61-0x0000000002310000-0x000000000231C000-memory.dmp

memory/1648-63-0x000000001B7E0000-0x000000001B82E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TSnaP5ddU7.bat

MD5 a8c70d0fa8c0475d96fecb36a5ec9cc9
SHA1 78c26e8389179c2d4d90ccb1180a7f37289ef4a6
SHA256 21b06138fdf613ef4426e52db117622072735c6d72a63cf16048cedf9dfc8863
SHA512 96cce4c197ae75705e33dec9b92f9b7fdcdaa2b27c06e4caa4df1f4b197fea46b30374e27b03e55e153bc4d1d7fca8fb1727db07187593e9a755562ce7c64080

memory/2228-82-0x00000000011A0000-0x000000000150A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 10:07

Reported

2024-05-09 10:10

Platform

win10v2004-20240426-en

Max time kernel

141s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

ZGRat

rat zgrat

Disables Task Manager via registry modification

evasion

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Windows Multimedia Platform\cb656409aa1485 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\Windows Mail\lsass.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files\Windows Mail\6203df4a6bafc7 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\MoUsoCoreWorker.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\MoUsoCoreWorker.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\1f93f77a7f4778 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Program Files (x86)\Windows Multimedia Platform\BridgeChainportWebInto.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Web\4K\Wallpaper\Windows\backgroundTaskHost.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Windows\Web\4K\Wallpaper\Windows\eddb19405b7ce1 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Windows\apppatch\fr-FR\smss.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
File created C:\Windows\apppatch\fr-FR\69ddcba757bf72 C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Modifies registry key

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\reg.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Windows Sidebar\Gadgets\MoUsoCoreWorker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3564 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 3564 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 3564 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe
PID 1556 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 1556 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 1556 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe C:\Windows\SysWOW64\WScript.exe
PID 2080 wrote to memory of 700 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 700 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2080 wrote to memory of 700 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 700 wrote to memory of 4492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 700 wrote to memory of 4492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 700 wrote to memory of 4492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 700 wrote to memory of 3088 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 700 wrote to memory of 3088 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe
PID 3088 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 3088 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe C:\Windows\System32\cmd.exe
PID 5112 wrote to memory of 1420 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 5112 wrote to memory of 1420 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\chcp.com
PID 5112 wrote to memory of 4696 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 5112 wrote to memory of 4696 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 5112 wrote to memory of 2324 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Sidebar\Gadgets\MoUsoCoreWorker.exe
PID 5112 wrote to memory of 2324 N/A C:\Windows\System32\cmd.exe C:\Program Files (x86)\Windows Sidebar\Gadgets\MoUsoCoreWorker.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe

"C:\Users\Admin\AppData\Local\Temp\a10d2a23354cf0130e15d2bf55148e7c34131033b62500615a60bb6f13f0c53a.exe"

C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe

"C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat" "

C:\Windows\SysWOW64\reg.exe

reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f

C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe

"C:\Users\Admin\AppData\Roaming\componentRuntimehost/BridgeChainportWebInto.exe"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L1kOHrzZkO.bat"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Program Files (x86)\Windows Sidebar\Gadgets\MoUsoCoreWorker.exe

"C:\Program Files (x86)\Windows Sidebar\Gadgets\MoUsoCoreWorker.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.196.91:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 91.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 2.17.196.145:443 www.bing.com tcp
US 8.8.8.8:53 145.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 139.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 065963cm.nyashkoon.top udp
US 172.67.185.34:80 065963cm.nyashkoon.top tcp
US 172.67.185.34:80 065963cm.nyashkoon.top tcp
US 8.8.8.8:53 34.185.67.172.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp

Files

memory/3564-0-0x00007FFE7BBA3000-0x00007FFE7BBA5000-memory.dmp

memory/3564-1-0x00000000004E0000-0x0000000000B06000-memory.dmp

memory/3564-2-0x00007FFE7BBA0000-0x00007FFE7C661000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\injector.exe

MD5 af3137e67eabdae073fdc900f863f6a8
SHA1 53d956673d51d05f17374a778fa08c70f3d33372
SHA256 659517254a9b0f0478c4f601326dd9d9afd8f86308179e202fe6b89184b9a0c9
SHA512 4edbdcee2328256a7fa01c0b4aaa18f24a4c392269cefdcdad34bf2b222edd4332b654da36223925dd1769eb463e5163344342da30f1dd2f7fd54fa64c9bb4ad

C:\Users\Admin\AppData\Local\Temp\MoonHack cfg helper.exe

MD5 2cf0a29383fd0b2054138434eed1b265
SHA1 84138a0182af9ef5c6b31255bd85707e0ad6a0c3
SHA256 e4011f2b2426a6fcb2f48317c8623a9d7583b782b2a4f10caee19f0df70b4185
SHA512 3977b288e3512184bed9ead0947f35cb6e3c95c83a517cadd8c63ed642fbb47a41e9ac30c43a0f877ed33bd13a482e082c308081b387e7d339f71c3582da91ca

memory/3564-16-0x00007FFE7BBA0000-0x00007FFE7C661000-memory.dmp

C:\Users\Admin\AppData\Roaming\componentRuntimehost\qJhC.vbe

MD5 cf441f15daf3339180706cf594e97131
SHA1 ca5663745d79bd9196fea24b51d6061f79355d3c
SHA256 9a2afde59f2326a4cfbc827e87c7270da20d4a6e19e8d00b5b3a479c26f8ad13
SHA512 37d2b08ca78ee06fbcc93577a31a243670fd4efce506449e2e4e3b33c2319081e1f905f8651a642112386620f6551c1a598cdc7f69e682ee252fddc2fa9cde74

C:\Users\Admin\AppData\Roaming\componentRuntimehost\ZSAMlm727VnRbcACh79Hay0D7R9lrDKrBu.bat

MD5 f4846b111f4c8ced35bf1ed60502270f
SHA1 625bb8296688ca9cde0c60c60cc17ed83383050c
SHA256 2b20a48f281b60176569332a9e56f5aa7911ba9793f87f9729aafc81aab5a6cd
SHA512 ef77a850b15f988754eb17c48ce84e15bcf824c4bcc64ac7f5f372f86fee5738de67417fd0cf56271d1701b5256edcf4ad8603b5fab28016af8e28359967df67

C:\Users\Admin\AppData\Roaming\componentRuntimehost\BridgeChainportWebInto.exe

MD5 51a33d556ce031ad0a5e752f10b00a13
SHA1 f05e11e3034481de8590ee4afd912628cacfde9a
SHA256 eab0d35dc956885b222e69fde419f3974db712c98bbb23f41325388bde0cc341
SHA512 c27a18ebee3e32854e4ad136c3af7de753764a9b44fc024487eb4a197a3f68b506f8578c4beab63e23c64b4e8ce10d63d2987b78175a9691e9aec9fc13887356

memory/3088-30-0x0000000000290000-0x00000000005FA000-memory.dmp

memory/3088-32-0x0000000002A80000-0x0000000002AA6000-memory.dmp

memory/3088-34-0x0000000000FD0000-0x0000000000FDE000-memory.dmp

memory/3088-36-0x0000000002A50000-0x0000000002A6C000-memory.dmp

memory/3088-37-0x000000001B1D0000-0x000000001B220000-memory.dmp

memory/3088-39-0x0000000002920000-0x0000000002930000-memory.dmp

memory/3088-41-0x0000000002AD0000-0x0000000002AE8000-memory.dmp

memory/3088-43-0x0000000002930000-0x0000000002940000-memory.dmp

memory/3088-45-0x0000000002A70000-0x0000000002A80000-memory.dmp

memory/3088-47-0x0000000002AB0000-0x0000000002ABE000-memory.dmp

memory/3088-49-0x000000001B250000-0x000000001B262000-memory.dmp

memory/3088-51-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

memory/3088-53-0x000000001B270000-0x000000001B286000-memory.dmp

memory/3088-55-0x000000001B290000-0x000000001B2A2000-memory.dmp

memory/3088-56-0x000000001BCF0000-0x000000001C218000-memory.dmp

memory/3088-58-0x0000000002AF0000-0x0000000002B00000-memory.dmp

memory/3088-60-0x000000001B230000-0x000000001B240000-memory.dmp

memory/3088-62-0x000000001B820000-0x000000001B87A000-memory.dmp

memory/3088-64-0x000000001B240000-0x000000001B24E000-memory.dmp

memory/3088-66-0x000000001B7E0000-0x000000001B7F8000-memory.dmp

memory/3088-68-0x000000001B7C0000-0x000000001B7CC000-memory.dmp

memory/3088-70-0x000000001BAD0000-0x000000001BB1E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\L1kOHrzZkO.bat

MD5 1855a8d6644deadc196670a33e8e997b
SHA1 090c460dadfbe0e8ac352f2775d7002b2fefa136
SHA256 d7bf629259b3d6111cc6a51e353170de3d25f4896ef0b834dbde30b44ecf7259
SHA512 c9789accc63d91dbf02e986df77113a64787ca920bc9a7f3b8b196f28020b3368fe28e0a7dee68add2748dabccd2ce8ffcc512b977a702e7f0a0a38b5bed956e