zgrat | 21015dd4a12034f48c1432acbf1149131a3dd1412f4b8426ec7273d95dc19da6

Analysis

max time kernel
599s
max time network
597s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gm2.exe
Size

2.3MB
MD5

2ce10fcd4e165a82a76f77d1f661fa36
SHA1

a3ffe8a330d9e2128172b74dd76f0a31060c0e1e
SHA256

21015dd4a12034f48c1432acbf1149131a3dd1412f4b8426ec7273d95dc19da6
SHA512

f2ed5af0ba9173d483943d7a3761ae2419232ec52980597dfc7ef9c79516297fd2df63970528faeed14f642fb1dbc00114d659068c33cc619ff70583da0bc818
SSDEEP

49152:eOtTYNB84W4Vjms6VSSiht/zAKq4uhL61/I+C62w3/MLfQyTIUhlLY/EDZ50R:eOtTYzfVv6VSSEt/z7qfL6e+HaIez0Ee

Score

10^/10

zgrat rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023423-17.dat	family_zgrat_v1
behavioral1/files/0x0008000000023427-38.dat	family_zgrat_v1
behavioral1/memory/4328-40-0x00000000004E0000-0x00000000006E8000-memory.dmp	family_zgrat_v1

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2576	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3808	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3664	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4736	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3888	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4708	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3824	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	232	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3408	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3616	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3916	3960	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	3960	schtasks.exe	89

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	gm2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	tzidRecG.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	HyperPortsavesmonitor.exe

Executes dropped EXE 9 IoCs

pid	Process
3368	Cheat.sfx.exe
3096	tzidRecG.exe
4328	HyperPortsavesmonitor.exe
772	winlogon.exe
1616	HyperPortsavesmonitor.exe
4552	csrss.exe
1712	unsecapp.exe
1520	fontdrvhost.exe
1748	HyperPortsavesmonitor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\dllhost.exe	HyperPortsavesmonitor.exe
File opened for modification	C:\Program Files (x86)\Windows Portable Devices\dllhost.exe	HyperPortsavesmonitor.exe
File created	C:\Program Files (x86)\Windows Portable Devices\5940a34987c991	HyperPortsavesmonitor.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\debug\5b884080fd4f94	HyperPortsavesmonitor.exe
File created	C:\Windows\de-DE\unsecapp.exe	HyperPortsavesmonitor.exe
File created	C:\Windows\de-DE\29c1c3cc0f7685	HyperPortsavesmonitor.exe
File created	C:\Windows\debug\fontdrvhost.exe	HyperPortsavesmonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
620	3368	WerFault.exe	82

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4700	schtasks.exe
2356	schtasks.exe
3512	schtasks.exe
4708	schtasks.exe
3664	schtasks.exe
620	schtasks.exe
3408	schtasks.exe
2576	schtasks.exe
4736	schtasks.exe
232	schtasks.exe
3616	schtasks.exe
3916	schtasks.exe
3808	schtasks.exe
1396	schtasks.exe
3888	schtasks.exe
3824	schtasks.exe
3760	schtasks.exe
1404	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	tzidRecG.exe
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	HyperPortsavesmonitor.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe
4328	HyperPortsavesmonitor.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
772	winlogon.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	HyperPortsavesmonitor.exe
Token: SeDebugPrivilege	772	winlogon.exe
Token: SeDebugPrivilege	1616	HyperPortsavesmonitor.exe
Token: SeDebugPrivilege	4552	csrss.exe
Token: SeDebugPrivilege	1712	unsecapp.exe
Token: SeDebugPrivilege	1520	fontdrvhost.exe
Token: SeDebugPrivilege	1748	HyperPortsavesmonitor.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 3368	3088	gm2.exe	82
PID 3088 wrote to memory of 3368	3088	gm2.exe	82
PID 3088 wrote to memory of 3368	3088	gm2.exe	82
PID 3088 wrote to memory of 3096	3088	gm2.exe	84
PID 3088 wrote to memory of 3096	3088	gm2.exe	84
PID 3088 wrote to memory of 3096	3088	gm2.exe	84
PID 3096 wrote to memory of 2152	3096	tzidRecG.exe	86
PID 3096 wrote to memory of 2152	3096	tzidRecG.exe	86
PID 3096 wrote to memory of 2152	3096	tzidRecG.exe	86
PID 2152 wrote to memory of 716	2152	WScript.exe	102
PID 2152 wrote to memory of 716	2152	WScript.exe	102
PID 2152 wrote to memory of 716	2152	WScript.exe	102
PID 716 wrote to memory of 4328	716	cmd.exe	104
PID 716 wrote to memory of 4328	716	cmd.exe	104
PID 4328 wrote to memory of 2164	4328	HyperPortsavesmonitor.exe	123
PID 4328 wrote to memory of 2164	4328	HyperPortsavesmonitor.exe	123
PID 2164 wrote to memory of 4980	2164	cmd.exe	125
PID 2164 wrote to memory of 4980	2164	cmd.exe	125
PID 2164 wrote to memory of 3352	2164	cmd.exe	126
PID 2164 wrote to memory of 3352	2164	cmd.exe	126
PID 2164 wrote to memory of 772	2164	cmd.exe	128
PID 2164 wrote to memory of 772	2164	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\gm2.exe
"C:\Users\Admin\AppData\Local\Temp\gm2.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Users\Admin\AppData\Local\Temp\Cheat.sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\Cheat.sfx.exe"
  2⤵
  - Executes dropped EXE
  PID:3368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3368 -s 996
    3⤵
    - Program crash
    PID:620
- C:\Users\Admin\AppData\Local\Temp\tzidRecG.exe
  "C:\Users\Admin\AppData\Local\Temp\tzidRecG.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\comDriverinto\yqpI0X0JgApYgtlSsocRWTSVHRK.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\comDriverinto\ucUiAXPN2zx9bZrTcu4WHQVTQZueYbZneVkQGpMslSdQ.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:716
    - - C:\comDriverinto\HyperPortsavesmonitor.exe
        
        "C:\comDriverinto/HyperPortsavesmonitor.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4328
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\toqQ8zqSHx.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2164
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4980
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3352
        
        C:\comDriverinto\winlogon.exe
        
        "C:\comDriverinto\winlogon.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3368 -ip 3368
1⤵
PID:4480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\comDriverinto\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\comDriverinto\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\comDriverinto\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Users\Default User\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 8 /tr "'C:\Windows\debug\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\debug\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 9 /tr "'C:\Windows\debug\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 5 /tr "'C:\Windows\de-DE\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\de-DE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\de-DE\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Portable Devices\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperPortsavesmonitorH" /sc MINUTE /mo 8 /tr "'C:\comDriverinto\HyperPortsavesmonitor.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperPortsavesmonitor" /sc ONLOGON /tr "'C:\comDriverinto\HyperPortsavesmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "HyperPortsavesmonitorH" /sc MINUTE /mo 5 /tr "'C:\comDriverinto\HyperPortsavesmonitor.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1404

C:\comDriverinto\HyperPortsavesmonitor.exe
C:\comDriverinto\HyperPortsavesmonitor.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Users\Default User\csrss.exe
"C:\Users\Default User\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\de-DE\unsecapp.exe
C:\Windows\de-DE\unsecapp.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\debug\fontdrvhost.exe
C:\Windows\debug\fontdrvhost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\comDriverinto\HyperPortsavesmonitor.exe
C:\comDriverinto\HyperPortsavesmonitor.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HyperPortsavesmonitor.exe.log

Filesize
1KB

MD5
ab369ba851730702cd35acdf04a5bd76

SHA1
5c225b94fb86e6932defc91ce518eacef25808ad

SHA256
4b976805d9a7a91fc84cd27b58bd54d57269b1af9b45dc89ef94c1bda36f088d

SHA512
1a4afe28c129a2e657d93c4217e240ed807cba734cc55c21592615ec5e6fb11114232af9b553c824ec8aa00d5db415501d3334b79bc810d1640725378103000c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cheat.sfx.exe

Filesize
368KB

MD5
e56343f2eb88fef62d4cf5df0a2c7734

SHA1
21f1b3a3dcbc29388bb72bc7aa7fc4ce654c6135

SHA256
d3e4275fe34ac20bb9d3c53e9971d2a21ba8f7ec5dc8b943c1a52edb2aa0f1ea

SHA512
b56053c8f0f86ee235cce13601000ed31622b87a5b5b6ed7e723b94bc4a9281918feccbab1f99d827187982ad4d5de2eafb02dd8d6dd179b49e2e029eeef4f32

Download Submit
C:\Users\Admin\AppData\Local\Temp\toqQ8zqSHx.bat

Filesize
205B

MD5
6514ed190d5405a56a26e93b73c2151a

SHA1
cb760a100520d382831efe431c55ed8a466018e6

SHA256
5662859331969563010d572580c817892d11c145bfc18940c430de7b43668d43

SHA512
bd8a8ecc151702ebb6509d295a58b8f7af6852d5b0dc4908a52d95799014165430d6a813485d9713da8e8f928d441e5a4bb1c5c0fb55b308c6c0f404bb4132b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tzidRecG.exe

Filesize
2.3MB

MD5
92a0909017b45d6498197b1b817e9303

SHA1
bc8a0aad4e4f3e6ddbd816a98873b24ba22bf502

SHA256
71fcb54017a98fe981d8b725891371518878e684acc63ca9c81f284f5e4b6e23

SHA512
b59ae5bd68f1ef934dbba306312c288f1e81b744cf717cff4a529f7b2ed779cd4f85d85e77b0589d1971d42896b8523b495ae1d81921d75cb7df43308940a021

Download Submit
C:\comDriverinto\HyperPortsavesmonitor.exe

Filesize
2.0MB

MD5
75da1def0cb2b50f387441c2ebed4120

SHA1
7eca930b9afe2bf57ab9a3e546cc9969d4e5dce7

SHA256
2edf5f9fc75dc5cc293db94f337b66524386b0a4d1fd6e56f3d7ad30963cc790

SHA512
adc14364c6e6d614f2a92b7094cced4ca247f96a27844c6601b3f2519de72d3215bb3335eae095363dd82edc2a3ff31b631c61df272c8cf023f72f8bcce737e1

Download Submit
C:\comDriverinto\ucUiAXPN2zx9bZrTcu4WHQVTQZueYbZneVkQGpMslSdQ.bat

Filesize
85B

MD5
97f25de6d41811f5f69377a04cfa76c7

SHA1
e1ff3b69aa65bbf38b49bf3972f739c0af5f6805

SHA256
caf5baa2d2e1705ecae3aa9e95212d2cde2141161defa5e19b7aa9fda05575f4

SHA512
d4af223a7e438d596655cdb1e4189792cf685b9c02f8e5ae0290eabbe29972d1182daaa98d39abf803d1e41b6eefa671d2ae3f051568cfba6adaaa77b8ad74eb

Download Submit
C:\comDriverinto\yqpI0X0JgApYgtlSsocRWTSVHRK.vbe

Filesize
236B

MD5
4ef5f91cd4fabd32da27992dacfc6ad6

SHA1
e6aae689706c107b9b6ff58e474df1d3fe1f16ff

SHA256
fc9b4a6b7b877ee52d56c5b1440de893d1b2bce5fbdf96c6233274af24a2cea7

SHA512
bc1698dc036031250e9dcb9c0d7b87271b1dc15fdaf63ef991aab195cdf9fe4056b2a4a164f46346cb9bfe63aa6c458555de43c9c96945f0f5752d983b1536b6

Download Submit
memory/3368-23-0x00000000731DE000-0x00000000731DF000-memory.dmp

Filesize
4KB

Download
memory/3368-30-0x0000000000620000-0x0000000000682000-memory.dmp

Filesize
392KB

Download
memory/3368-32-0x0000000005750000-0x0000000005CF4000-memory.dmp

Filesize
5.6MB

Download
memory/3368-34-0x0000000005080000-0x0000000005112000-memory.dmp

Filesize
584KB

Download
memory/3368-35-0x0000000005120000-0x0000000005186000-memory.dmp

Filesize
408KB

Download
memory/4328-40-0x00000000004E0000-0x00000000006E8000-memory.dmp

Filesize
2.0MB

Download
memory/4328-45-0x000000001B500000-0x000000001B550000-memory.dmp

Filesize
320KB

Download
memory/4328-47-0x00000000028C0000-0x00000000028D0000-memory.dmp

Filesize
64KB

Download
memory/4328-49-0x0000000002A70000-0x0000000002A88000-memory.dmp

Filesize
96KB

Download
memory/4328-51-0x00000000028D0000-0x00000000028DE000-memory.dmp

Filesize
56KB

Download
memory/4328-53-0x000000001B380000-0x000000001B398000-memory.dmp

Filesize
96KB

Download
memory/4328-55-0x00000000028E0000-0x00000000028EC000-memory.dmp

Filesize
48KB

Download
memory/4328-44-0x0000000002A50000-0x0000000002A6C000-memory.dmp

Filesize
112KB

Download
memory/4328-42-0x00000000028B0000-0x00000000028BE000-memory.dmp

Filesize
56KB

Download