gh0strat | 9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 08:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.exe
Size

2.2MB
MD5

b01a11449dd83a10497833b23fb0887d
SHA1

8f5276ee02a5b4b23cb7e9d500dd0df71382e211
SHA256

9b165f6672e74ed5dc437040829bd602afc411ce8c948c41b6d739bf1fbfb09a
SHA512

cf3634a8253c439d54233162db10b9668f080e184e4e1b52aae60db303e89d2ca9fead16097937a871d54685592b1b58e389d481b94f6c261d5caec98223ec81
SSDEEP

24576:ZFbkIsaPiXSVnC7Yp9zkNmZG8RRlnZyz/Iila8CJn0BgtscdTtOOa9pfthIDdsRQ:ZREXSVMDi350aFJqciOa925sRtMZ

Score

10^/10

gh0strat neshta discovery persistence rat spyware stealer

Malware Config

Signatures

Detect Neshta payload 3 IoCs

Processes:

resource	yara_rule
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe	family_neshta
behavioral1/memory/2400-125-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2400-127-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Gh0st RAT payload 1 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\259437447.bat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

Processes:

look2.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\svchcst\Parameters\ServiceDll = "C:\\Windows\\system32\\259437447.bat"	look2.exe

Executes dropped EXE 4 IoCs

Processes:

.exelook2.exeHD_.exesvchcst.exe

pid process

2368 .exe
2240 look2.exe
2888 HD_.exe
1992 svchcst.exe
Loads dropped DLL 10 IoCs

Processes:

.exe.exelook2.exesvchost.exesvchcst.exe

pid process

2400 .exe
2368 .exe
2240 look2.exe
2768 svchost.exe
2368 .exe
2368 .exe
2400 .exe
2400 .exe
2768 svchost.exe
1992 svchcst.exe
Modifies system executable filetype association 2 TTPs 1 IoCs
persistence

Modify Registry
T1112

Change Default File Association
T1546.001

Processes:

.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" .exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
2368	.exe
2240	look2.exe
2888	HD_.exe
1992	svchcst.exe

pid	process
2400	.exe
2368	.exe
2240	look2.exe
2768	svchost.exe
2368	.exe
2368	.exe
2400	.exe
2400	.exe
2768	svchost.exe
1992	svchcst.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	.exe

Drops file in System32 directory 4 IoCs

Processes:

svchost.exelook2.exe

description	ioc	process
File created	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\svchcst.exe	svchost.exe
File created	C:\Windows\SysWOW64\259437447.bat	look2.exe
File opened for modification	C:\Windows\SysWOW64\ini.ini	look2.exe

Drops file in Program Files directory 64 IoCs

Processes:

.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	.exe

Drops file in Windows directory 1 IoCs

Processes:

.exe

description ioc process

File opened for modification C:\Windows\svchost.com .exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

look2.exesvchost.exeHD_.exesvchcst.exe.exe.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	look2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HD_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchcst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	.exe

Modifies registry class 1 IoCs

Processes:

.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" .exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

.exe

pid process

2368 .exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	.exe

pid	process
2368	.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

HD_.exe

description	pid	process
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe
Token: 33	2888	HD_.exe
Token: SeIncBasePriorityPrivilege	2888	HD_.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

.exeHD_.exe

pid process

2368 .exe
2368 .exe
2888 HD_.exe
2888 HD_.exe

pid	process
2368	.exe
2368	.exe
2888	HD_.exe
2888	HD_.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

.exe.exesvchost.exe

description	pid	process	target process
PID 2400 wrote to memory of 2368	2400	.exe	.exe
PID 2400 wrote to memory of 2368	2400	.exe	.exe
PID 2400 wrote to memory of 2368	2400	.exe	.exe
PID 2400 wrote to memory of 2368	2400	.exe	.exe
PID 2368 wrote to memory of 2240	2368	.exe	look2.exe
PID 2368 wrote to memory of 2240	2368	.exe	look2.exe
PID 2368 wrote to memory of 2240	2368	.exe	look2.exe
PID 2368 wrote to memory of 2240	2368	.exe	look2.exe
PID 2368 wrote to memory of 2888	2368	.exe	HD_.exe
PID 2368 wrote to memory of 2888	2368	.exe	HD_.exe
PID 2368 wrote to memory of 2888	2368	.exe	HD_.exe
PID 2368 wrote to memory of 2888	2368	.exe	HD_.exe
PID 2768 wrote to memory of 1992	2768	svchost.exe	svchcst.exe
PID 2768 wrote to memory of 1992	2768	svchost.exe	svchcst.exe
PID 2768 wrote to memory of 1992	2768	svchost.exe	svchcst.exe
PID 2768 wrote to memory of 1992	2768	svchost.exe	svchcst.exe

C:\Users\Admin\AppData\Local\Temp\.exe
"C:\Users\Admin\AppData\Local\Temp\.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\3582-490\.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Users\Admin\AppData\Local\Temp\look2.exe
    C:\Users\Admin\AppData\Local\Temp\\look2.exe
    3⤵
    - Server Software Component: Terminal Services DLL
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:2240
- - C:\Users\Admin\AppData\Local\Temp\3582-490\HD_.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\HD_.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2888

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
PID:560

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k "svchcst"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\svchcst.exe
  C:\Windows\system32\svchcst.exe "c:\windows\system32\259437447.bat",MainThread
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe

Filesize
1.6MB

MD5
368d54c69746fb31b62a15f5e301985f

SHA1
87148fe56d71df166239e5459f50721d15bc7028

SHA256
c9d5ed0975c7e70358172241767af75cf390a79139345641aeab244ca129f9b2

SHA512
d4f2db7921a97345bf19340357534155a7ea2ad48fd1c58d437cbbc4790f06f1e0878b3eb85244a849fa55472711da883efbf8e299971f78d050233c51526b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.3MB

MD5
ebea7267d953cf95a2dc1c6b0a57738e

SHA1
6b03b9bf837a7fb61b4164b03c611335db5c56ab

SHA256
291d8260378ac894d10b140c053985907b53d0593b2cda19028cc3f0c132f514

SHA512
335edeff6cc79633382ba83105497ef6a4eba5b5696164bc0703df6546a7e5c1c994262063e0eaf28f909cb4dd7f242b6209862de4e05e6ff82853bb2149d899

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\.exe

Filesize
2.1MB

MD5
3e1b9039148d196063ab784e4548e798

SHA1
bb8c6ddf201aa6f3a23649fc7d206f6471f4f024

SHA256
c96306e907e6532cb82ae4d410a5ca72fd19955e28d4c209f7b2495da9925b88

SHA512
39c121a7bdb91074aac4af762cdb824d7bb78c71ac1bb4acf500293afb35e92dc49da65d91646ebbf03ae31d2428ac07409139e76bfef37c2451bc0c313af6c4

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\HD_.exe

Filesize
896KB

MD5
8bacad1c57463f2e403ca5656ffa129e

SHA1
7cd8041fb1bd703d31f778700813531ed43882da

SHA256
bdec97ee615088549771300bd65d6114a74dd0a4c1ecc6bb4ffc8ac484f19fac

SHA512
40a5a0cabd2561b2d32ec14e91172db6f812d0e2dcc6cfda3a2f458e0994fc387324212bd47f21acb6d05bed151a96ad444a0a5a7f7bb35ae6fd0dcd57d25d64

Download Submit
\Users\Admin\AppData\Local\Temp\look2.exe

Filesize
337KB

MD5
2f3b6f16e33e28ad75f3fdaef2567807

SHA1
85e907340faf1edfc9210db85a04abd43d21b741

SHA256
86492ebf2d6f471a5ee92977318d099b3ea86175b5b7ae522237ae01d07a4857

SHA512
db17e99e2df918cfc9ccbe934adfe73f0777ce1ce9f28b57a4b24ecd821efe2e0b976a634853247b77b16627d2bb3af4ba20306059d1d25ef38ffada7da3e3a4

Download Submit
\Windows\SysWOW64\259437447.bat

Filesize
51KB

MD5
c3ac037ec51ccd9a87f3d5afe5d05a67

SHA1
b1f30d835f72992856597d3bfef4b595cac30162

SHA256
4f4f63931c808d8dc3f58b5396d67f9a86e6c19342c4b6557b30a8c95128d42b

SHA512
e9d3d20353a488f5a4f4df6d0207069bc8c92f6849a3ac64ef2964f8bd8ae62128c1e24c36f8475918f045e7f8cfdcad2be21004f3c44717aa554fc77ea177b6

Download Submit
\Windows\SysWOW64\svchcst.exe

Filesize
43KB

MD5
51138beea3e2c21ec44d0932c71762a8

SHA1
8939cf35447b22dd2c6e6f443446acc1bf986d58

SHA256
5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124

SHA512
794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d

Download Submit
memory/2400-125-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2400-127-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download