gh0strat | a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2

Analysis

max time kernel
203s
max time network
227s
platform
windows7_x64
resource
win7-20220414-en
submitted
16-05-2022 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe
Size

944KB
MD5

e4f4b58d13524ae7521d07274eabc0f0
SHA1

0cb88305e8e0e8a9dea1db8025caede6f6f256bb
SHA256

a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2
SHA512

8593105fa62843dd144a900ddb1ae9f4ffda76549f240166418c10b585e5c8df9397a0c3eef7215e1784d103c6a3ab578efd1aaf63b76852d310890d7d262b4d

Score

10^/10

gh0strat xmrig miner persistence rat suricata

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2044-60-0x0000000010000000-0x0000000010023000-memory.dmp	family_gh0strat
behavioral1/memory/884-79-0x0000000010000000-0x0000000010023000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 3 IoCs

miner

Processes:

resource	yara_rule
\Windows\IIS\CPUInfo.exe	xmrig
\Windows\IIS\CPUInfo.exe	xmrig
C:\Windows\IIS\CPUInfo.exe	xmrig

Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

84.exesysteinfo.exesysteinfo.exeCPUInfo.exe

pid process

2044 84.exe
1448 systeinfo.exe
884 systeinfo.exe
1380 CPUInfo.exe
Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
2044	84.exe
1448	systeinfo.exe
884	systeinfo.exe
1380	CPUInfo.exe

Loads dropped DLL 6 IoCs

Processes:

a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exeWerFault.exe

pid	process
1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe
1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe
1808	WerFault.exe
1808	WerFault.exe
1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe
1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe

Drops file in System32 directory 4 IoCs

Processes:

systeinfo.exe84.exesysteinfo.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	systeinfo.exe
File created	C:\Windows\SysWOW64\systeinfo.exe	84.exe
File opened for modification	C:\Windows\SysWOW64\systeinfo.exe	84.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	systeinfo.exe

Drops file in Windows directory 4 IoCs

Processes:

a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exeCPUInfo.exe

description	ioc	process
File created	C:\Windows\IIS\CPUInfo.exe	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe
File created	C:\Windows\IIS\srvany.exe	CPUInfo.exe
File created	C:\Windows\IIS\iis.reg	CPUInfo.exe
File created	C:\Windows\IIS\1.BAT	CPUInfo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1808 1448 WerFault.exe systeinfo.exe

pid	pid_target	process	target process
1808	1448	WerFault.exe	systeinfo.exe

Modifies data under HKEY_USERS 36 IoCs

Processes:

systeinfo.exesysteinfo.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-be-27-1e-f8-7a\WpadDecision = "0"	systeinfo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	systeinfo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6F03467A-F5C4-4683-B8E7-6E3DCE6855C5}\WpadDecisionTime = a022dc035669d801	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-be-27-1e-f8-7a	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	systeinfo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6F03467A-F5C4-4683-B8E7-6E3DCE6855C5}	systeinfo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	systeinfo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	systeinfo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6F03467A-F5C4-4683-B8E7-6E3DCE6855C5}\WpadNetworkName = "Network 3"	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-be-27-1e-f8-7a\WpadDecisionReason = "1"	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	systeinfo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6F03467A-F5C4-4683-B8E7-6E3DCE6855C5}\WpadDecisionReason = "1"	systeinfo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\62-be-27-1e-f8-7a\WpadDecisionTime = a022dc035669d801	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6F03467A-F5C4-4683-B8E7-6E3DCE6855C5}\62-be-27-1e-f8-7a	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	systeinfo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6F03467A-F5C4-4683-B8E7-6E3DCE6855C5}\WpadDecision = "0"	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	systeinfo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	systeinfo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	systeinfo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	systeinfo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	systeinfo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	systeinfo.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

624 regedit.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exeCPUInfo.exe

pid process

1328 a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe
1380 CPUInfo.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

84.exe

description pid process

Token: SeIncBasePriorityPrivilege 2044 84.exe

pid	process
624	regedit.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2044	84.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exeCPUInfo.exe

pid	process
1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe
1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe
1380	CPUInfo.exe
1380	CPUInfo.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exesysteinfo.exe84.exeCPUInfo.execmd.exe

description	pid	process	target process
PID 1328 wrote to memory of 2044	1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe	84.exe
PID 1328 wrote to memory of 2044	1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe	84.exe
PID 1328 wrote to memory of 2044	1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe	84.exe
PID 1328 wrote to memory of 2044	1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe	84.exe
PID 1448 wrote to memory of 884	1448	systeinfo.exe	systeinfo.exe
PID 1448 wrote to memory of 884	1448	systeinfo.exe	systeinfo.exe
PID 1448 wrote to memory of 884	1448	systeinfo.exe	systeinfo.exe
PID 1448 wrote to memory of 884	1448	systeinfo.exe	systeinfo.exe
PID 1448 wrote to memory of 1808	1448	systeinfo.exe	WerFault.exe
PID 1448 wrote to memory of 1808	1448	systeinfo.exe	WerFault.exe
PID 1448 wrote to memory of 1808	1448	systeinfo.exe	WerFault.exe
PID 1448 wrote to memory of 1808	1448	systeinfo.exe	WerFault.exe
PID 2044 wrote to memory of 1108	2044	84.exe	cmd.exe
PID 2044 wrote to memory of 1108	2044	84.exe	cmd.exe
PID 2044 wrote to memory of 1108	2044	84.exe	cmd.exe
PID 2044 wrote to memory of 1108	2044	84.exe	cmd.exe
PID 1328 wrote to memory of 1380	1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe	CPUInfo.exe
PID 1328 wrote to memory of 1380	1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe	CPUInfo.exe
PID 1328 wrote to memory of 1380	1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe	CPUInfo.exe
PID 1328 wrote to memory of 1380	1328	a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe	CPUInfo.exe
PID 1380 wrote to memory of 1708	1380	CPUInfo.exe	cmd.exe
PID 1380 wrote to memory of 1708	1380	CPUInfo.exe	cmd.exe
PID 1380 wrote to memory of 1708	1380	CPUInfo.exe	cmd.exe
PID 1380 wrote to memory of 1708	1380	CPUInfo.exe	cmd.exe
PID 1708 wrote to memory of 624	1708	cmd.exe	regedit.exe
PID 1708 wrote to memory of 624	1708	cmd.exe	regedit.exe
PID 1708 wrote to memory of 624	1708	cmd.exe	regedit.exe
PID 1708 wrote to memory of 624	1708	cmd.exe	regedit.exe

C:\Users\Admin\AppData\Local\Temp\a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe
"C:\Users\Admin\AppData\Local\Temp\a4a6f36b13b24e595d97d22205acadad91bda33e1ad608fb914a59b4b9c13ef2.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328

C:\Users\Admin\AppData\Local\Temp\84.exe
C:\Users\Admin\AppData\Local\Temp\84.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\84.exe > nul
3⤵
PID:1108

C:\Windows\IIS\CPUInfo.exe
"C:\Windows\IIS\CPUInfo.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\IIS\1.BAT" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\regedit.exe
regedit.exe /s iis.reg
4⤵
- Runs .reg file with regedit
PID:624

C:\Windows\SysWOW64\systeinfo.exe
C:\Windows\SysWOW64\systeinfo.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 296
2⤵
- Loads dropped DLL
- Program crash
PID:1808

C:\Windows\SysWOW64\systeinfo.exe
C:\Windows\SysWOW64\systeinfo.exe Win7
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:884

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\84.exe
Filesize
180KB

MD5
5ee6b001a1cc627f56b239fb33a9bb14

SHA1
5d960e316da7321802ee43d5138c15bb651eedbf

SHA256
d214e4ca9d19d90b15ccccc03b54eef032f38abc9c7e3e85a14b39c5f3673e66

SHA512
03a95c30b9e52484a6759ca8ab32cc6f04c1b140fb027e560f47f6949110ad417cdccd103fefd227801d0b6cc43042c78351c8b9221c100cff78d4d8486b7d1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\84.exe
Filesize
180KB

MD5
5ee6b001a1cc627f56b239fb33a9bb14

SHA1
5d960e316da7321802ee43d5138c15bb651eedbf

SHA256
d214e4ca9d19d90b15ccccc03b54eef032f38abc9c7e3e85a14b39c5f3673e66

SHA512
03a95c30b9e52484a6759ca8ab32cc6f04c1b140fb027e560f47f6949110ad417cdccd103fefd227801d0b6cc43042c78351c8b9221c100cff78d4d8486b7d1a

Download Submit
C:\Windows\IIS\1.BAT
Filesize
32B

MD5
2450c0476e1be691164e992f796c1c13

SHA1
3fe9da9ae94dab5fe732023e24c509d7471605cf

SHA256
653596cb1f474fc012624a04f6504f2f01fb4aacf1f121e653b20cf262b28164

SHA512
f23ac0f0a11b6861f0927d01d5e42261f552a975140c9c061f1da338f013475164089b9777b083d6718f0fab268a63469d5875ed7f7c9c329b22de2ebb268997

Download Submit
C:\Windows\IIS\CPUInfo.exe
Filesize
13.7MB

MD5
25db93b9c70a81bd8ab39dada7ea9691

SHA1
b3d3eccc28c99631e85db8214f750b853773b8c3

SHA256
f29842a6956eabe0989657309fe3ccc27e30f297a45fa8dd6ac04f74c4e1d8be

SHA512
6d7ac5943e214ee1120f4a7a0f5c95a9e624e9b04afd7411c52ddc73fab75f048ed74ece1f58d6ab24ef440c64df037a8d09638995a6911df1d1a0c66ceb4d6b

Download Submit
C:\Windows\IIS\iis.reg
Filesize
1KB

MD5
77226e89c32d86ac341cdce4884b03a1

SHA1
bc78bef2aaa2a4699a85d78c9a76304a812885ab

SHA256
1fee5453d046a348fe795039210519ff94846bab0980e583b32255726d035607

SHA512
e9e380b22b3cfff23c778ad106071c8420f8aca6634ce1e5ea9973ec42a66f188bb6dd5b3404d3baccf84a738464bcfe9318441c516dd60453fed02ae398b286

Download Submit
C:\Windows\SysWOW64\systeinfo.exe
Filesize
180KB

MD5
5ee6b001a1cc627f56b239fb33a9bb14

SHA1
5d960e316da7321802ee43d5138c15bb651eedbf

SHA256
d214e4ca9d19d90b15ccccc03b54eef032f38abc9c7e3e85a14b39c5f3673e66

SHA512
03a95c30b9e52484a6759ca8ab32cc6f04c1b140fb027e560f47f6949110ad417cdccd103fefd227801d0b6cc43042c78351c8b9221c100cff78d4d8486b7d1a

Download Submit
C:\Windows\SysWOW64\systeinfo.exe
Filesize
180KB

MD5
5ee6b001a1cc627f56b239fb33a9bb14

SHA1
5d960e316da7321802ee43d5138c15bb651eedbf

SHA256
d214e4ca9d19d90b15ccccc03b54eef032f38abc9c7e3e85a14b39c5f3673e66

SHA512
03a95c30b9e52484a6759ca8ab32cc6f04c1b140fb027e560f47f6949110ad417cdccd103fefd227801d0b6cc43042c78351c8b9221c100cff78d4d8486b7d1a

Download Submit
C:\Windows\SysWOW64\systeinfo.exe
Filesize
180KB

MD5
5ee6b001a1cc627f56b239fb33a9bb14

SHA1
5d960e316da7321802ee43d5138c15bb651eedbf

SHA256
d214e4ca9d19d90b15ccccc03b54eef032f38abc9c7e3e85a14b39c5f3673e66

SHA512
03a95c30b9e52484a6759ca8ab32cc6f04c1b140fb027e560f47f6949110ad417cdccd103fefd227801d0b6cc43042c78351c8b9221c100cff78d4d8486b7d1a

Download Submit
\Users\Admin\AppData\Local\Temp\84.exe
Filesize
180KB

MD5
5ee6b001a1cc627f56b239fb33a9bb14

SHA1
5d960e316da7321802ee43d5138c15bb651eedbf

SHA256
d214e4ca9d19d90b15ccccc03b54eef032f38abc9c7e3e85a14b39c5f3673e66

SHA512
03a95c30b9e52484a6759ca8ab32cc6f04c1b140fb027e560f47f6949110ad417cdccd103fefd227801d0b6cc43042c78351c8b9221c100cff78d4d8486b7d1a

Download Submit
\Users\Admin\AppData\Local\Temp\84.exe
Filesize
180KB

MD5
5ee6b001a1cc627f56b239fb33a9bb14

SHA1
5d960e316da7321802ee43d5138c15bb651eedbf

SHA256
d214e4ca9d19d90b15ccccc03b54eef032f38abc9c7e3e85a14b39c5f3673e66

SHA512
03a95c30b9e52484a6759ca8ab32cc6f04c1b140fb027e560f47f6949110ad417cdccd103fefd227801d0b6cc43042c78351c8b9221c100cff78d4d8486b7d1a

Download Submit
\Windows\IIS\CPUInfo.exe
Filesize
13.7MB

MD5
25db93b9c70a81bd8ab39dada7ea9691

SHA1
b3d3eccc28c99631e85db8214f750b853773b8c3

SHA256
f29842a6956eabe0989657309fe3ccc27e30f297a45fa8dd6ac04f74c4e1d8be

SHA512
6d7ac5943e214ee1120f4a7a0f5c95a9e624e9b04afd7411c52ddc73fab75f048ed74ece1f58d6ab24ef440c64df037a8d09638995a6911df1d1a0c66ceb4d6b

Download Submit
\Windows\IIS\CPUInfo.exe
Filesize
13.7MB

MD5
25db93b9c70a81bd8ab39dada7ea9691

SHA1
b3d3eccc28c99631e85db8214f750b853773b8c3

SHA256
f29842a6956eabe0989657309fe3ccc27e30f297a45fa8dd6ac04f74c4e1d8be

SHA512
6d7ac5943e214ee1120f4a7a0f5c95a9e624e9b04afd7411c52ddc73fab75f048ed74ece1f58d6ab24ef440c64df037a8d09638995a6911df1d1a0c66ceb4d6b

Download Submit
\Windows\SysWOW64\systeinfo.exe
Filesize
180KB

MD5
5ee6b001a1cc627f56b239fb33a9bb14

SHA1
5d960e316da7321802ee43d5138c15bb651eedbf

SHA256
d214e4ca9d19d90b15ccccc03b54eef032f38abc9c7e3e85a14b39c5f3673e66

SHA512
03a95c30b9e52484a6759ca8ab32cc6f04c1b140fb027e560f47f6949110ad417cdccd103fefd227801d0b6cc43042c78351c8b9221c100cff78d4d8486b7d1a

Download Submit
\Windows\SysWOW64\systeinfo.exe
Filesize
180KB

MD5
5ee6b001a1cc627f56b239fb33a9bb14

SHA1
5d960e316da7321802ee43d5138c15bb651eedbf

SHA256
d214e4ca9d19d90b15ccccc03b54eef032f38abc9c7e3e85a14b39c5f3673e66

SHA512
03a95c30b9e52484a6759ca8ab32cc6f04c1b140fb027e560f47f6949110ad417cdccd103fefd227801d0b6cc43042c78351c8b9221c100cff78d4d8486b7d1a

Download Submit
memory/624-90-0x0000000000000000-mapping.dmp

Download
memory/884-79-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/884-72-0x0000000000000000-mapping.dmp

Download
memory/1108-77-0x0000000000000000-mapping.dmp

Download
memory/1328-54-0x0000000076C81000-0x0000000076C83000-memory.dmp

Filesize
8KB

Download
memory/1328-93-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/1380-85-0x0000000000000000-mapping.dmp

Download
memory/1708-88-0x0000000000000000-mapping.dmp

Download
memory/1808-74-0x0000000000000000-mapping.dmp

Download
memory/2044-60-0x0000000010000000-0x0000000010023000-memory.dmp

Filesize
140KB

Download
memory/2044-57-0x0000000000000000-mapping.dmp

Download