gh0strat | 414d68f1148a3b596cef9291ebd25582017349216f259819c4d7c6c66dc4384d

Analysis

max time kernel
132s
max time network
161s
platform
windows7_x64
resource
win7-20220414-en
submitted
08-07-2022 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

data.exe
Size

121KB
MD5

ecffbccad6aecd736cbc7e9ba525a00a
SHA1

195636cf0307fd7e56c4254bba6a500c5421b934
SHA256

313ee6496bf01e9b17d76081ebe76efd04c6fc056ff9749cfff960a00fe36299
SHA512

d7d3f7c60b3045fe109b40b5d18a3348eb25da2f7dc2832dc7855e66de714b1c40963e3a9b138df3aabfd3fc4ddac5731221037c171e5b85634ed7d847e23de5

Score

10^/10

gh0strat ramnit banker persistence rat spyware stealer trojan upx worm

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral7/memory/1528-79-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat
behavioral7/memory/1528-82-0x0000000010000000-0x0000000010121000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Executes dropped EXE 3 IoCs

Processes:

UnRARSrv.exeDesktopLayer.exefun.exe

pid process

792 UnRARSrv.exe
104 DesktopLayer.exe
1528 fun.exe

pid	process
792	UnRARSrv.exe
104	DesktopLayer.exe
1528	fun.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\UnRARSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe	upx
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe	upx
\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral7/memory/792-64-0x0000000000400000-0x000000000042E000-memory.dmp	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
C:\Program Files (x86)\Microsoft\DesktopLayer.exe	upx
behavioral7/memory/104-70-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Loads dropped DLL 4 IoCs

Processes:

UnRAR.exeUnRARSrv.execmd.exe

pid process

1644 UnRAR.exe
792 UnRARSrv.exe
1632 cmd.exe
1632 cmd.exe

pid	process
1644	UnRAR.exe
792	UnRARSrv.exe
1632	cmd.exe
1632	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

fun.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\XXXXXX00587F8E = "C:\\Windows\\XXXXXX00587F8E\\svchsot.exe"	fun.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	fun.exe

Drops file in Program Files directory 3 IoCs

Processes:

UnRARSrv.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxC12.tmp	UnRARSrv.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	UnRARSrv.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	UnRARSrv.exe

Drops file in Windows directory 1 IoCs

Processes:

fun.exe

description ioc process

File created C:\Windows\XXXXXX00587F8E\JH.BAT fun.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1480 sc.exe

description	ioc	process
File created	C:\Windows\XXXXXX00587F8E\JH.BAT	fun.exe

pid	process
1480	sc.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364053203"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF938961-FEC4-11EC-939C-6AE7990DC39D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Runs net.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

DesktopLayer.exefun.exe

pid process

104 DesktopLayer.exe
104 DesktopLayer.exe
104 DesktopLayer.exe
104 DesktopLayer.exe
1528 fun.exe
1528 fun.exe
1528 fun.exe
1528 fun.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1952 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1952 iexplore.exe
1952 iexplore.exe
1780 IEXPLORE.EXE
1780 IEXPLORE.EXE
1780 IEXPLORE.EXE
1780 IEXPLORE.EXE

pid	process
104	DesktopLayer.exe
104	DesktopLayer.exe
104	DesktopLayer.exe
104	DesktopLayer.exe
1528	fun.exe
1528	fun.exe
1528	fun.exe
1528	fun.exe

pid	process
1952	iexplore.exe

pid	process
1952	iexplore.exe
1952	iexplore.exe
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE
1780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

data.execmd.exeUnRAR.exeUnRARSrv.exeDesktopLayer.execmd.exeiexplore.exefun.execmd.exenet.exe

description	pid	process	target process
PID 904 wrote to memory of 952	904	data.exe	cmd.exe
PID 904 wrote to memory of 952	904	data.exe	cmd.exe
PID 904 wrote to memory of 952	904	data.exe	cmd.exe
PID 904 wrote to memory of 952	904	data.exe	cmd.exe
PID 952 wrote to memory of 1644	952	cmd.exe	UnRAR.exe
PID 952 wrote to memory of 1644	952	cmd.exe	UnRAR.exe
PID 952 wrote to memory of 1644	952	cmd.exe	UnRAR.exe
PID 952 wrote to memory of 1644	952	cmd.exe	UnRAR.exe
PID 1644 wrote to memory of 792	1644	UnRAR.exe	UnRARSrv.exe
PID 1644 wrote to memory of 792	1644	UnRAR.exe	UnRARSrv.exe
PID 1644 wrote to memory of 792	1644	UnRAR.exe	UnRARSrv.exe
PID 1644 wrote to memory of 792	1644	UnRAR.exe	UnRARSrv.exe
PID 792 wrote to memory of 104	792	UnRARSrv.exe	DesktopLayer.exe
PID 792 wrote to memory of 104	792	UnRARSrv.exe	DesktopLayer.exe
PID 792 wrote to memory of 104	792	UnRARSrv.exe	DesktopLayer.exe
PID 792 wrote to memory of 104	792	UnRARSrv.exe	DesktopLayer.exe
PID 904 wrote to memory of 1632	904	data.exe	cmd.exe
PID 904 wrote to memory of 1632	904	data.exe	cmd.exe
PID 904 wrote to memory of 1632	904	data.exe	cmd.exe
PID 904 wrote to memory of 1632	904	data.exe	cmd.exe
PID 104 wrote to memory of 1952	104	DesktopLayer.exe	iexplore.exe
PID 104 wrote to memory of 1952	104	DesktopLayer.exe	iexplore.exe
PID 104 wrote to memory of 1952	104	DesktopLayer.exe	iexplore.exe
PID 104 wrote to memory of 1952	104	DesktopLayer.exe	iexplore.exe
PID 1632 wrote to memory of 1528	1632	cmd.exe	fun.exe
PID 1632 wrote to memory of 1528	1632	cmd.exe	fun.exe
PID 1632 wrote to memory of 1528	1632	cmd.exe	fun.exe
PID 1632 wrote to memory of 1528	1632	cmd.exe	fun.exe
PID 1952 wrote to memory of 1780	1952	iexplore.exe	IEXPLORE.EXE
PID 1952 wrote to memory of 1780	1952	iexplore.exe	IEXPLORE.EXE
PID 1952 wrote to memory of 1780	1952	iexplore.exe	IEXPLORE.EXE
PID 1952 wrote to memory of 1780	1952	iexplore.exe	IEXPLORE.EXE
PID 1528 wrote to memory of 1784	1528	fun.exe	cmd.exe
PID 1528 wrote to memory of 1784	1528	fun.exe	cmd.exe
PID 1528 wrote to memory of 1784	1528	fun.exe	cmd.exe
PID 1528 wrote to memory of 1784	1528	fun.exe	cmd.exe
PID 1784 wrote to memory of 1672	1784	cmd.exe	schtasks.exe
PID 1784 wrote to memory of 1672	1784	cmd.exe	schtasks.exe
PID 1784 wrote to memory of 1672	1784	cmd.exe	schtasks.exe
PID 1784 wrote to memory of 1672	1784	cmd.exe	schtasks.exe
PID 1784 wrote to memory of 1480	1784	cmd.exe	sc.exe
PID 1784 wrote to memory of 1480	1784	cmd.exe	sc.exe
PID 1784 wrote to memory of 1480	1784	cmd.exe	sc.exe
PID 1784 wrote to memory of 1480	1784	cmd.exe	sc.exe
PID 1784 wrote to memory of 568	1784	cmd.exe	net.exe
PID 1784 wrote to memory of 568	1784	cmd.exe	net.exe
PID 1784 wrote to memory of 568	1784	cmd.exe	net.exe
PID 1784 wrote to memory of 568	1784	cmd.exe	net.exe
PID 568 wrote to memory of 1744	568	net.exe	net1.exe
PID 568 wrote to memory of 1744	568	net.exe	net1.exe
PID 568 wrote to memory of 1744	568	net.exe	net1.exe
PID 568 wrote to memory of 1744	568	net.exe	net1.exe
PID 1784 wrote to memory of 844	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 844	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 844	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 844	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 2032	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 2032	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 2032	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 2032	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 1100	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 1100	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 1100	1784	cmd.exe	at.exe
PID 1784 wrote to memory of 1100	1784	cmd.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\data.exe
"C:\Users\Admin\AppData\Local\Temp\data.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c unrar e -p03DFF56238E52E88 -y pack.rar
2⤵
- Suspicious use of WriteProcessMemory
PID:952

C:\Users\Admin\AppData\Local\Temp\UnRAR.exe
unrar e -p03DFF56238E52E88 -y pack.rar
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:792

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:104

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
6⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
7⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c start fun.exe
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632

C:\Users\Admin\AppData\Local\Temp\fun.exe
fun.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\XXXXXX00587F8E\JH.BAT
4⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\SysWOW64\schtasks.exe
schtasks /delete /tn * /f
5⤵
PID:1672

C:\Windows\SysWOW64\sc.exe
sc config Schedule start= auto
5⤵
- Launches sc.exe
PID:1480

C:\Windows\SysWOW64\net.exe
net start "Task Scheduler"
5⤵
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start "Task Scheduler"
6⤵
PID:1744

C:\Windows\SysWOW64\at.exe
At 0:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:844

C:\Windows\SysWOW64\at.exe
At 1:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2032

C:\Windows\SysWOW64\at.exe
At 2:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1100

C:\Windows\SysWOW64\at.exe
At 3:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1440

C:\Windows\SysWOW64\at.exe
At 4:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1632

C:\Windows\SysWOW64\at.exe
At 5:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:384

C:\Windows\SysWOW64\at.exe
At 6:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1620

C:\Windows\SysWOW64\at.exe
At 7:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1708

C:\Windows\SysWOW64\at.exe
At 8:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1444

C:\Windows\SysWOW64\at.exe
At 9:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1652

C:\Windows\SysWOW64\at.exe
At 10:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:568

C:\Windows\SysWOW64\at.exe
At 11:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:844

C:\Windows\SysWOW64\at.exe
At 12:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1452

C:\Windows\SysWOW64\at.exe
At 13:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1100

C:\Windows\SysWOW64\at.exe
At 14:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:272

C:\Windows\SysWOW64\at.exe
At 15:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1472

C:\Windows\SysWOW64\at.exe
At 16:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1708

C:\Windows\SysWOW64\at.exe
At 17:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1744

C:\Windows\SysWOW64\at.exe
At 18:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:2004

C:\Windows\SysWOW64\at.exe
At 19:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:704

C:\Windows\SysWOW64\at.exe
At 20:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1692

C:\Windows\SysWOW64\at.exe
At 21:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:972

C:\Windows\SysWOW64\at.exe
At 22:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1716

C:\Windows\SysWOW64\at.exe
At 23:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:288

C:\Windows\SysWOW64\at.exe
At 24:00 C:\Windows\XXXXXX00587F8E\svchsot.exe
5⤵
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UnRARSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fun.exe
Filesize
183KB

MD5
e30a6a423ed21d7106fd5433cf72c023

SHA1
abeae0fcc61080fbed7cd23684bf66d28ae33b86

SHA256
0d40c508008ccd5f9fbd5965f997f98ae00a3e94b1d0bc1fcc617fe9826023d4

SHA512
cec97a26d9922a1871605afe6af7c2cecf413c93f58d2cd54d10f7d7f1558b25e5cf6b067c4a84bae81b547970cbd9f13b2245e7b44cdec922a0360e9c7b6d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\fun.exe
Filesize
183KB

MD5
e30a6a423ed21d7106fd5433cf72c023

SHA1
abeae0fcc61080fbed7cd23684bf66d28ae33b86

SHA256
0d40c508008ccd5f9fbd5965f997f98ae00a3e94b1d0bc1fcc617fe9826023d4

SHA512
cec97a26d9922a1871605afe6af7c2cecf413c93f58d2cd54d10f7d7f1558b25e5cf6b067c4a84bae81b547970cbd9f13b2245e7b44cdec922a0360e9c7b6d1e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S6U28L6R.txt
Filesize
604B

MD5
5cbad03264f8121e428168c589f299be

SHA1
27c79516c94348a95dd067c666a7906109bc853c

SHA256
0abd87e29afe50cfe186b542b56f54fc89550971b61433d25cb3a8f6b447a833

SHA512
997509d9659ae5733f924e2ac9048342b0dfb84715455e3534a58a867ed25d6a479cc205175991de9d73e77011a664d706a9ea5e4785c56ed3088eb44415a8e3

Download Submit
C:\Windows\XXXXXX00587F8E\JH.BAT
Filesize
1KB

MD5
771de19c28cde1d4a7d632b46a3b0e14

SHA1
33193cd299a3df198db951f61ffe1c7db11bd865

SHA256
f8aff1d929ced28db09fc4e08c89d4b5c214353ba93235a87ee3e4c340713d59

SHA512
311d9be5371b992f35d64cc15956e880cefb42faf6c6a4ca0c980bb77d960a801533c021c92db1f6747470ead65717ee043b533c3b279896e116f3c635a08397

Download Submit
\Program Files (x86)\Microsoft\DesktopLayer.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\UnRARSrv.exe
Filesize
55KB

MD5
ff5e1f27193ce51eec318714ef038bef

SHA1
b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6

SHA256
fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320

SHA512
c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a

Download Submit
\Users\Admin\AppData\Local\Temp\fun.exe
Filesize
183KB

MD5
e30a6a423ed21d7106fd5433cf72c023

SHA1
abeae0fcc61080fbed7cd23684bf66d28ae33b86

SHA256
0d40c508008ccd5f9fbd5965f997f98ae00a3e94b1d0bc1fcc617fe9826023d4

SHA512
cec97a26d9922a1871605afe6af7c2cecf413c93f58d2cd54d10f7d7f1558b25e5cf6b067c4a84bae81b547970cbd9f13b2245e7b44cdec922a0360e9c7b6d1e

Download Submit
\Users\Admin\AppData\Local\Temp\fun.exe
Filesize
183KB

MD5
e30a6a423ed21d7106fd5433cf72c023

SHA1
abeae0fcc61080fbed7cd23684bf66d28ae33b86

SHA256
0d40c508008ccd5f9fbd5965f997f98ae00a3e94b1d0bc1fcc617fe9826023d4

SHA512
cec97a26d9922a1871605afe6af7c2cecf413c93f58d2cd54d10f7d7f1558b25e5cf6b067c4a84bae81b547970cbd9f13b2245e7b44cdec922a0360e9c7b6d1e

Download Submit
memory/104-63-0x0000000000000000-mapping.dmp

Download
memory/104-70-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/272-115-0x0000000000000000-mapping.dmp

Download
memory/288-134-0x0000000000000000-mapping.dmp

Download
memory/384-98-0x0000000000000000-mapping.dmp

Download
memory/568-108-0x0000000000000000-mapping.dmp

Download
memory/568-87-0x0000000000000000-mapping.dmp

Download
memory/704-126-0x0000000000000000-mapping.dmp

Download
memory/792-64-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/792-58-0x0000000000000000-mapping.dmp

Download
memory/844-110-0x0000000000000000-mapping.dmp

Download
memory/844-89-0x0000000000000000-mapping.dmp

Download
memory/952-54-0x0000000000000000-mapping.dmp

Download
memory/972-130-0x0000000000000000-mapping.dmp

Download
memory/1100-114-0x0000000000000000-mapping.dmp

Download
memory/1100-93-0x0000000000000000-mapping.dmp

Download
memory/1440-94-0x0000000000000000-mapping.dmp

Download
memory/1444-104-0x0000000000000000-mapping.dmp

Download
memory/1452-112-0x0000000000000000-mapping.dmp

Download
memory/1472-117-0x0000000000000000-mapping.dmp

Download
memory/1480-86-0x0000000000000000-mapping.dmp

Download
memory/1528-74-0x0000000000000000-mapping.dmp

Download
memory/1528-77-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1528-82-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1528-79-0x0000000010000000-0x0000000010121000-memory.dmp

Filesize
1.1MB

Download
memory/1620-100-0x0000000000000000-mapping.dmp

Download
memory/1632-96-0x0000000000000000-mapping.dmp

Download
memory/1632-68-0x0000000000000000-mapping.dmp

Download
memory/1644-55-0x0000000000000000-mapping.dmp

Download
memory/1644-56-0x00000000751C1000-0x00000000751C3000-memory.dmp

Filesize
8KB

Download
memory/1644-66-0x00000000012C0000-0x000000000132F000-memory.dmp

Filesize
444KB

Download
memory/1652-106-0x0000000000000000-mapping.dmp

Download
memory/1672-85-0x0000000000000000-mapping.dmp

Download
memory/1692-128-0x0000000000000000-mapping.dmp

Download
memory/1708-119-0x0000000000000000-mapping.dmp

Download
memory/1708-102-0x0000000000000000-mapping.dmp

Download
memory/1716-132-0x0000000000000000-mapping.dmp

Download
memory/1744-88-0x0000000000000000-mapping.dmp

Download
memory/1744-122-0x0000000000000000-mapping.dmp

Download
memory/1784-83-0x0000000000000000-mapping.dmp

Download
memory/1840-136-0x0000000000000000-mapping.dmp

Download
memory/2004-124-0x0000000000000000-mapping.dmp

Download
memory/2032-91-0x0000000000000000-mapping.dmp

Download