Analysis

  • user interaction
    yes
  • max time kernel
    35s
  • max time network
    36s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    26/08/2026, 19:23

General

  • Target
    42121545255_FB.exe
  • Size 19.8MB
  • Sample260826-x3vs1sstc1
  • SHA256 0a49bb799a217ef47ab45e434839adc08a065b5947a9efd49a19b4eaf19ae264
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: ZGRat

    ZGRat is remote access trojan written in C#.

  • Detect ZGRat V2 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Modifies trusted root certificate store through registry 1 TTPs 1 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42121545255_FB.exe
    "C:\Users\Admin\AppData\Local\Temp\42121545255_FB.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4860
    • C:\Users\Admin\AppData\Local\Temp\1bm45ut5ihf.exe
      "C:\Users\Admin\AppData\Local\Temp\1bm45ut5ihf.exe" --delete-old "C:\Users\Admin\AppData\Local\Temp\42121545255_FB.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Modifies trusted root certificate store through registry
      • Modifies registry class
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5752
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1724

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MarketWithPerks.json

        • Path C:\Users\Admin\AppData\Local\FortniteBurger2\Profiles\MarketWithPerks.json
        • Size 734KB
        • SHA256 89a99c87fe6f638d3e0bafc2fdf4f3d0b317a090e9f37b1e642cb73337c8e8ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        42121545255_FB.deps.json

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\42121545255_FB.deps.json
        • Size 27KB
        • SHA256 d68278c5a5984e5cdb8a0f89b28be3cb569bdf8aedd7f48c0331eacc5c49827d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        42121545255_FB.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\42121545255_FB.dll
        • Size 1.5MB
        • SHA256 b562810e9db651782cdf55ce47e716e34d079ece8506e9411ebd6c3ec9227f11
        • MD5 SHA1 SHA512 SSDEEP TLSH

        42121545255_FB.runtimeconfig.json

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\42121545255_FB.runtimeconfig.json
        • Size 372B
        • SHA256 1eca0f0c70070aa83bb609e4b749b26dcb4409784326032726394722224a098a
        • MD5 SHA1 SHA512 TLSH

        AutoUpdater.NET.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\AutoUpdater.NET.dll
        • Size 248KB
        • SHA256 91f8f0038d5f6597e32229353116dbcbbfa8b1991a22321af4ca56c86de69e09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BCMakeCert.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\BCMakeCert.dll
        • Size 600KB
        • SHA256 93ba40952f4be52de0c6afb0d66e8c306489edc682ad4515fb12cac8bee2630e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BasicFormatsForCore.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\BasicFormatsForCore.dll
        • Size 145KB
        • SHA256 f60f48e8a320b6fa2760d2f8fc5dcd5dff2fb526f967545dd2d620d09b9c5675
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BouncyCastle.Cryptography.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\BouncyCastle.Cryptography.dll
        • Size 6.7MB
        • SHA256 a96969c7964648c24aba2795587ee448d07b50ca5212e9d8eade021eb0f0cef6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DotNetZip.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\DotNetZip.dll
        • Size 234KB
        • SHA256 309f84521fff1f48c3509f7110f1789347a272501992c79af3ef6e6d3b3de7d2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FiddlerCore.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\FiddlerCore.dll
        • Size 774KB
        • SHA256 e7e7572d2c3028ffaa0b58c765a526525b2bdb5cc9696045e34f36b01ba847fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FontAwesome.WPF.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\FontAwesome.WPF.dll
        • Size 204KB
        • SHA256 63d50dbe094bbce5d7bf8af08c0d919cfa5e057ca05ae7b27704a8477c8b348f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FontAwesome5.Net.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\FontAwesome5.Net.dll
        • Size 1.1MB
        • SHA256 fd4d8ee0fe47c19a5388b80b758b427cf1a05ec3a7290fe8a0203b1d7033911a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FontAwesome5.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\FontAwesome5.dll
        • Size 2.3MB
        • SHA256 288faeae1f76e37bc4ecf3cf0227754e9e10172c9cece36385049b58cc94fc12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Hardcodet.NotifyIcon.Wpf.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\Hardcodet.NotifyIcon.Wpf.dll
        • Size 101KB
        • SHA256 2059222c4ae5d0291fce13bd296adcc448d79b6fae27746aedf347608ed3090c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Web.WebView2.Core.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\Microsoft.Web.WebView2.Core.dll
        • Size 461KB
        • SHA256 c6feb73ec1cb9271f2004d2586fe1833621a0fcd3d04a6fc1dcf08557d634ac0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Web.WebView2.WinForms.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\Microsoft.Web.WebView2.WinForms.dll
        • Size 37KB
        • SHA256 983a69e9ae41e7cc91962704a903a2c2dd49d464f243a7d101d0b715f723f1c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Web.WebView2.Wpf.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\Microsoft.Web.WebView2.Wpf.dll
        • Size 43KB
        • SHA256 29f6e7dac224fc0ba91e45145e209fdb18c985781280d778aeedbd1ea885f137
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft.Xaml.Behaviors.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\Microsoft.Xaml.Behaviors.dll
        • Size 141KB
        • SHA256 8f782ad7adfdeeaa933183065aa7a0be9387abce6038e912455e78527b04adca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        NetDiscordRpc.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\NetDiscordRpc.dll
        • Size 83KB
        • SHA256 7f4d4192386df8c03f279890a15a271b62b496cc66da7b832d4cff6cbf764a2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Newtonsoft.Json.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\Newtonsoft.Json.dll
        • Size 695KB
        • SHA256 22c649f75fce5be7c7ccda8880473b634ef69ecf33f5d1ab8ad892caf47d5a07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Notification.Wpf.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\Notification.Wpf.dll
        • Size 161KB
        • SHA256 190a25f196340ef2b38ea970e609f23e3b926f90197a4243b91d2021bc23b173
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SharpVectors.Converters.Wpf.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\SharpVectors.Converters.Wpf.dll
        • Size 145KB
        • SHA256 f10c1da6aa2b7e6d35627d8ff5a1da7d146d226e0691efd7c5655f3c596890ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SharpVectors.Core.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\SharpVectors.Core.dll
        • Size 183KB
        • SHA256 85462c6c76008e89c556afae41ba4860fbb4628c96f60c66e9eff07b0181abce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SharpVectors.Css.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\SharpVectors.Css.dll
        • Size 91KB
        • SHA256 8bf943e62620bfb811ddd841567d854f6e2c7b6ef4ccbf54790033623d3fc47e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SharpVectors.Dom.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\SharpVectors.Dom.dll
        • Size 33KB
        • SHA256 e2b5b5d9c73a7aab145dbb26222b15aeac0c4bdda88f35dee22230fc3e0684e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SharpVectors.Model.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\SharpVectors.Model.dll
        • Size 1.0MB
        • SHA256 62d56d695db4030cf75f0e981b12d76ba56cb5d5cf69adcb5ae26d5747123221
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SharpVectors.Rendering.Gdi.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\SharpVectors.Rendering.Gdi.dll
        • Size 110KB
        • SHA256 d491846dd891cf1edff0b63434ad44f14d7399be7c7b24651e3908cfe3a0add9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SharpVectors.Rendering.Wpf.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\SharpVectors.Rendering.Wpf.dll
        • Size 224KB
        • SHA256 ec4fc6f411352e86bbe5a929af1a4d2ed7b0dda8ba48d8df6c81dee0be8034c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SharpVectors.Runtime.Wpf.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\SharpVectors.Runtime.Wpf.dll
        • Size 71KB
        • SHA256 f2264867d415ffd582049a212dd6e0bbc4eeddc23fcd665cf9f1ee63fdcc94a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.CodeDom.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\System.CodeDom.dll
        • Size 181KB
        • SHA256 e58b1961cc1cafc9bbec52d071fc121809e3501318e0ff5650b5763f24589abe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ComponentModel.Composition.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\System.ComponentModel.Composition.dll
        • Size 262KB
        • SHA256 7e65f888588c79f69acb593d9b39990c33fd58377fc48300a0a93fc8dbaa159f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.EventLog.Messages.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\System.Diagnostics.EventLog.Messages.dll
        • Size 782KB
        • SHA256 68f73ab17fb7f4aff3d35ef6db0e9d5b0fa0151111cb3d03992e23bc29d6c40a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Diagnostics.EventLog.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\System.Diagnostics.EventLog.dll
        • Size 156KB
        • SHA256 2af781190ab7c97d6b846d5027745d609ad227665695e8ecb3afd4cc9fce6537
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.Management.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\System.Management.dll
        • Size 304KB
        • SHA256 fff7c1e9f12a99c2c52a6c0ae81075be78dbef7dbc4f1162164990b4ccf6eadd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.ServiceProcess.ServiceController.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\System.ServiceProcess.ServiceController.dll
        • Size 84KB
        • SHA256 7dfaced56145f3c6b80de25a09e0df6729149ef3c6a8f8f1b559e93b914fd2de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Telerik.NetworkConnections.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\Telerik.NetworkConnections.dll
        • Size 67KB
        • SHA256 14a8afece485815896fc9f098d66b0457d1be374b10366b48c706dfdbb275094
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WebView2Loader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\WebView2Loader.dll
        • Size 156KB
        • SHA256 8d6fe8b14529e1d6a02a7f2d5991ee72ace0d7e2f1901c71cfd7df310600f4c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WpfPageTransitions.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\WpfPageTransitions.dll
        • Size 17KB
        • SHA256 342394576187bdc2804943e8bc9928f8f4d7e94f0dc4241057e7f401139fd0c1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\ar\AutoUpdater.NET.resources.dll
        • Size 10KB
        • SHA256 cf2b1c3cf607e7884fe8dbeb87b74ce6c42f4536fb92131704df5abfad96ecd5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\cs\AutoUpdater.NET.resources.dll
        • Size 9KB
        • SHA256 18b1eb31160b5d3ef6e8424204dcfdd2df69a48ff191f08810fd01a95bf3f9a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\da\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 3d1dac05f707e995b1fa1a1a1c89dff452036fbf20273e6334afbb4b00033aa6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\de\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 408bbd72954cdd8e830ebd0787f9214405b5acc15d06c3336d7015cdaebb71ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\es\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 d689092b0e4d74e1a55d0c6fe43abf65580a3fbf52b3b8368285d8639b1d2cb7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\fr\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 2fb47dfb09f9f24585b8bfa71c773d855b93744dbbd8c376ed8c3edfd3f36064
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\it\AutoUpdater.NET.resources.dll
        • Size 9KB
        • SHA256 eea2adbc5356ce05b2d9fc418e99ef0711e9c7fcdeff3d0c6d85c3758a49a75f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\ja-JP\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 3370fbd2efb274b714a02ce32b3b642c65fa19a896f3ed7ac0a9502fe7d6beeb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\ko\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 c5b8a8e7da93b9b50d3a1ef3330035b41c514ef6f361188be97ac273716919ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\lv\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 b00f6217cb875a0daedfea0e00d3311d2608d03c0bee74d524d177de06f4da74
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\nl\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 6e9df964edd743039174e6dffc068219e59f40cafd33902581e74a08dc72edf2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\pl\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 a041069ac5e288d2704ab670efa6753dd268bf86b3223003e4e094754a337936
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\pt-BR\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 ae81bc07e5daf06825a77b68d5ec12cc5998348c2a73bdbf6d5e6fcef9d64f70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\pt\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 1212b1aa059492afa336dcc83a96a409f9d00198f7fc20e340f60619cf3f63b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\ru\AutoUpdater.NET.resources.dll
        • Size 9KB
        • SHA256 97314053709366284705558e17873ee11b29eac1344306c851c29e4e559fea55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\sk\AutoUpdater.NET.resources.dll
        • Size 9KB
        • SHA256 1408db02419f71222248b0019446b2d501c7e68584fc155445ed7af56074c9d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\sv\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 c428be2722773a6234ade47ac9c7977dfea0bb671fdd893efe74b22665097fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\th\AutoUpdater.NET.resources.dll
        • Size 9KB
        • SHA256 048a52e5ea8c4a6d8d8cf7ec46c1f41ae67aced49c10d11d5d13ecacef886077
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\tr\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 749ebe2660ef8ce869ee88627cb1a7c4ef6f7049b65eb04ef25b610f7f50f9d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\zh-TW\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 93d21963b12a0553d4d5b1df679f3b8ff61e5fc699acab45266f0cd3e9764533
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AutoUpdater.NET.resources.dll

        • Path C:\Users\Admin\AppData\Local\Temp\.net\42121545255_FB\zNJpASwRL0rwKDxMPVRegnCxc5pD6tE=\zh\AutoUpdater.NET.resources.dll
        • Size 8KB
        • SHA256 4ea925fb369c847a76f2adc2e8b48b17189dc29eb13337865ed63e5fa88f3a31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        1bm45ut5ihf.exe

        • Path C:\Users\Admin\AppData\Local\Temp\1bm45ut5ihf.exe
        • Size 19.8MB
        • SHA256 f4c1ab6f4799fca3b6b67fc76161addbe1411276690da01b7e36c9863f3832cc
        • MD5 SHA1 SHA512 SSDEEP TLSH