Overview

overview

10

Static

static

fb4ef45c89...54.exe

windows7-x64

10

fb4ef45c89...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2022, 19:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    fb4ef45c89a844cc3634dfa671063eaf3843e25d780f33b6268d3545096b8c54.exe
  • Size 320KB
  • Sample221021-ymtfpadccp
  • SHA256 fb4ef45c89a844cc3634dfa671063eaf3843e25d780f33b6268d3545096b8c54
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gozi_ifsb1080bankerpersistencetrojan

Malware Config

Extracted

Family

  • gozi_ifsb

Botnet

  • 1080

C2

  • newsnortonscheck.com

  • woofboots.com

  • broosnoops.pw

Attributes
  • exe_type

    worker

  • server_id

    12

rsa_pubkey.plain
serpent.plain

Signatures

  • Gozi, Gozi IFSB

    Gozi ISFB is a well-known and widely distributed banking trojan.

    bankertrojangozi_ifsb
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb4ef45c89a844cc3634dfa671063eaf3843e25d780f33b6268d3545096b8c54.exe
    "C:\Users\Admin\AppData\Local\Temp\fb4ef45c89a844cc3634dfa671063eaf3843e25d780f33b6268d3545096b8c54.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5088
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:4476
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C41E.bat" "C:\Users\Admin\AppData\Local\Temp\FB4EF4~1.EXE""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Windows\SysWOW64\attrib.exe
        attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\FB4EF4~1.EXE"
        3⤵
        • Views/modifies file attributes
        PID:3148
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1432
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4248
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4048

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Apps.ft
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e22ae315-fc27-4079-afb5-167922def2fb}\Apps.ft
        • Size 38KB
        • SHA256 98165953997752f649bbf3479ff75a6a1833984950f41f04aad8ca21a86d00c0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Apps.index
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{e22ae315-fc27-4079-afb5-167922def2fb}\Apps.index
        • Size 1.0MB
        • SHA256 b24597daa08491cde184ea8409d441fd6690490b1491f5cd8086d0afef35d12a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AppCache133109628019798975.txt
        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133109628019798975.txt
        • Size 73KB
        • SHA256 c9fa68d0602128a61a36dc93136b49142fc8d66846a5ee626e4244a96bcd147c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        -agUIR63wi5ejtPiYoDJzyvaItE.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\-agUIR63wi5ejtPiYoDJzyvaItE.br[1].js
        • Size 49KB
        • SHA256 c321f991108d48d8cb75008fa9cfbc918e195f284102847f0bd47c5d0c72fe59
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2FlmCt8_0mLFFeOC8caRGywwuj0.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\2FlmCt8_0mLFFeOC8caRGywwuj0.br[1].js
        • Size 31KB
        • SHA256 1c87f43c2b009b67ebb2f865f6d2f35d37dc863308fc8ec70e0922444423baa5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        6lFX_p2r69AMDJtn379-Jqplukg.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\6lFX_p2r69AMDJtn379-Jqplukg.br[1].js
        • Size 105KB
        • SHA256 276f28318b6952e512443067ec578d556281ffb29d96781423aad5a54b70fc8f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        6mDplh2-tnrwx7GcRbXrFrcA_p8.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\6mDplh2-tnrwx7GcRbXrFrcA_p8.br[1].js
        • Size 4KB
        • SHA256 264b1fbcda5416ebe7b7bd3f5fc347a922e93dcc7e7d0703c9d83d321a52ec13
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        7E8VAkODfg7U7WI8dbX16q_qufI.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\7E8VAkODfg7U7WI8dbX16q_qufI.br[1].js
        • Size 95KB
        • SHA256 c8e11d57f2c1120280f8d2d551432786f979a04f8df07f1d00a79354ee873d6c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        7JiA4mfUTnS5nJY0HglHAU8iO-8.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\7JiA4mfUTnS5nJY0HglHAU8iO-8.br[1].js
        • Size 1.7MB
        • SHA256 7403bda52a40c51e8fac3c3aa67317c578bac476df0856b01040c9c4aea298e8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        9CoUHSoLuEjBAvav2GP95cHcN0M.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\9CoUHSoLuEjBAvav2GP95cHcN0M.br[1].js
        • Size 2KB
        • SHA256 7fc2cb6c6c9743883de1c5e0f200a502b2a02e5a8e922e0e77744044f8b19eb9
        • MD5 SHA1 SHA512
        Submit Download

        9RLIrLi3GlOL2Eylg9IcArIkw20.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\9RLIrLi3GlOL2Eylg9IcArIkw20.br[1].js
        • Size 8KB
        • SHA256 24d847fbf4fd59be3529fdfa7542fd3fe9512662927dd482e60d11344175e778
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        9kAvRypYmWc9B8vB-LFOrkNKVL8[1].css
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\9kAvRypYmWc9B8vB-LFOrkNKVL8[1].css
        • Size 19KB
        • SHA256 fb02f3758825d03c788c23db2a558fa9f9f490bb1e693d00761162d0ec617ae6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AwK8i0vdU1Fr4Ok7IspvNKL6Uak.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\AwK8i0vdU1Fr4Ok7IspvNKL6Uak.br[1].js
        • Size 2KB
        • SHA256 aefc1baa100056f5b834b5d9cfd1ee523a17951b9ef9f433f3a33900fc975fdb
        • MD5 SHA1 SHA512
        Submit Download

        Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js
        • Size 1B
        • SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
        • MD5 SHA1 SHA512
        Submit Download

        DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js
        • Size 128KB
        • SHA256 a1c2f4c8ca6113ebdac36f2c33d6ce19bcf2f4bd99ec06e8ba845e2b25b03322
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js
        • Size 17KB
        • SHA256 5d54790c856ce13811590e18ac3b0aceefefb61258852490f4c5c60748365e89
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Init[1].htm
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\Init[1].htm
        • Size 204KB
        • SHA256 e493ac930f2cf48542a09ff28cc2f3bca2afac2500065f5fb37f1c356bd74104
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js
        • Size 15KB
        • SHA256 365f8b7a23865ca36d1c1f7a25553afddb6223ff524b56d4beb80fdd98c8e057
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PvVze1dcpBMAPV5PYO5uw3GriyY.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\PvVze1dcpBMAPV5PYO5uw3GriyY.br[1].js
        • Size 2KB
        • SHA256 ca4f6ace2f342b343573167189121752a640860a7c2882ff81f5ed3d55b6f2b5
        • MD5 SHA1 SHA512
        Submit Download

        QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css
        • Size 6B
        • SHA256 a319af2e953e7afda681b85a62f629a5c37344af47d2fcd23ab45e1d99497f13
        • MD5 SHA1 SHA512
        Submit Download

        U7lYsMImC2KOE_VoqxIhF8N5thg.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\U7lYsMImC2KOE_VoqxIhF8N5thg.br[1].js
        • Size 10KB
        • SHA256 000a7e5f4726722669e8ff8c495990630bfb58d15c0109bce7f06eaf854706db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VA9SqX6YZSWJrJ6ibXvpRZGCupQ.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\VA9SqX6YZSWJrJ6ibXvpRZGCupQ.br[1].js
        • Size 44KB
        • SHA256 6a232348034a0564b74d8a293ac8dc15664e26664cd4e071e1d2e740b76d9ec6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VyNvnYSbzlS6ZeREEo0wIzSCoHI.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\VyNvnYSbzlS6ZeREEo0wIzSCoHI.br[1].js
        • Size 255KB
        • SHA256 e1c5f53feebff0b3703873280d8af7f8f11e9b0ed3b0f733205d6ac7fe1be085
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        W5AptvLGWBcTBLuPBJuqDe89v4w[1].css
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\W5AptvLGWBcTBLuPBJuqDe89v4w[1].css
        • Size 202KB
        • SHA256 a0102ff3c5a8ac05953fedf11820fe304dbb1bb7edbcc8b718079436c0b3cf8f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WeaqEJfS9Yrl9laS6TOxoSX0WqM.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\WeaqEJfS9Yrl9laS6TOxoSX0WqM.br[1].js
        • Size 2KB
        • SHA256 828a496f74c81febe572bd1219f7cb4122669e8c1b800468647f169b1cfcbf0c
        • MD5 SHA1 SHA512
        Submit Download

        XGTOWbtsOB8bq4oK5IIDOP8Bno4.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\XGTOWbtsOB8bq4oK5IIDOP8Bno4.br[1].js
        • Size 5KB
        • SHA256 40b4f56449caed2936add68c02b0e90cd59dfc297af6a9751688ef3fd8ab291a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Xf9TaXFokQXdP8mYtTIGSCtNrOA.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\Xf9TaXFokQXdP8mYtTIGSCtNrOA.br[1].js
        • Size 36KB
        • SHA256 1d92f3fc7be2362c5476622d2d927eb8a96b0967a1eb45d66e7bb58f64aae22b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Xk0n9ycPBpl3ibUiCDpx5bvphM0[1].css
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\Xk0n9ycPBpl3ibUiCDpx5bvphM0[1].css
        • Size 5KB
        • SHA256 6931c8fcd193fb037fcca1f2ed3f3f7c61d775d117c74fb24760b9d648f90090
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        YwTf7_MkSSj_dMIStQXBoF2zTjM.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\YwTf7_MkSSj_dMIStQXBoF2zTjM.br[1].js
        • Size 325KB
        • SHA256 a1cd255e6e45ed6951ce3ed4114a87a91ec456f29019d739495eb5c2b7d97947
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        b9OAcoBMd8KkpEXfZanHIKzaQeE.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\b9OAcoBMd8KkpEXfZanHIKzaQeE.br[1].js
        • Size 46KB
        • SHA256 a32917f0e651400730d8c617627c61a27c831b6a687a7df3644f808bc453b854
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        eRaywc7bgxpJRgIQ731mHeqxYFY.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\eRaywc7bgxpJRgIQ731mHeqxYFY.br[1].js
        • Size 42KB
        • SHA256 a0b5403d1722e007d65638b3912d9fc2abdc4bb89ca3015899b1070630990446
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        hPlNScrKKGfUAhwQVepjVKsWqRY.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\hPlNScrKKGfUAhwQVepjVKsWqRY.br[1].js
        • Size 1KB
        • SHA256 98377a7d539e735206b81f22ebf2f3321ccd5abca865d3a6cec9588cc0cea5ee
        • MD5 SHA1 SHA512
        Submit Download

        jReNPx8gS5IWDxQLFD-EkpG1n7w.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\jReNPx8gS5IWDxQLFD-EkpG1n7w.br[1].js
        • Size 1KB
        • SHA256 e933028aec3448b1202190e2efab00417f2d5abeaed20e6cf579db04c2ee86e9
        • MD5 SHA1 SHA512
        Submit Download

        jptBWImiVIYzQaI0kP9_1gjDeu4.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\jptBWImiVIYzQaI0kP9_1gjDeu4.br[1].js
        • Size 3KB
        • SHA256 4cf825a05be99be456c9f670be6516bf10a9c3fd06d4ce954ba9f0b032f54723
        • MD5 SHA1 SHA512
        Submit Download

        k1RpQk-eyyvyZyQ5ONtAXPCy-FI.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\k1RpQk-eyyvyZyQ5ONtAXPCy-FI.br[1].js
        • Size 5KB
        • SHA256 a10f1fac70b5833ec23b756edc34392fa5e0c3c97ceeabdef2bd973e843a6062
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        lcrtGhqTqXwqwW-iaQ_Nw0mszKc.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\lcrtGhqTqXwqwW-iaQ_Nw0mszKc.br[1].js
        • Size 197KB
        • SHA256 90fccf6342d5bcfde3f69f88b80253ec694b9b901cc55fd84a2e0c6e0ff05caf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mmDWBuo_mXPMwstmF0M6Gea7YQA.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\mmDWBuo_mXPMwstmF0M6Gea7YQA.br[1].js
        • Size 130KB
        • SHA256 28f817732a4e9c1741cb823970389b24a1ef126512dfb3cf37ca7d857925b015
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        onra7PQl9o5bYT2lASI1BE4DDEs[1].css
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\onra7PQl9o5bYT2lASI1BE4DDEs[1].css
        • Size 65KB
        • SHA256 be2e9b42fc02b16643c01833de7d1c14d8790ecc4355c76529a41fa2f7d3efad
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        qRqw0fKEID_9I4HEO5LDdD8CaWE.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\qRqw0fKEID_9I4HEO5LDdD8CaWE.br[1].js
        • Size 52KB
        • SHA256 05d0046198336f88241f3d2703c54350e98f5f6c9fd69824f342712b3d11d186
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        t8shg5d7KiteLFdk0T__nZRbsds.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\t8shg5d7KiteLFdk0T__nZRbsds.br[1].js
        • Size 15KB
        • SHA256 001718daf3df6a85ffdc59f7d12039301e7aafaa16ccf96889729fbd5e1de0db
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        w9zqVJkEZ_qpNCqYvGYoqL8BWm0.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\w9zqVJkEZ_qpNCqYvGYoqL8BWm0.br[1].js
        • Size 118KB
        • SHA256 2d55886903198e35295b8e90738da47859837baba26d47e15bac87f90ee608d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        xZtFP6ADa5r6W-Gs9azRy1BzdoM.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\xZtFP6ADa5r6W-Gs9azRy1BzdoM.br[1].js
        • Size 14KB
        • SHA256 7baa4579de695048f2b372780b43e0b1d80ea9dbc43e45850cf6d488c745d3c4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ylvUeoqI4aQx1bG1g9p73jp3ODM.br[1].js
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\AppCache\03SH6L3D\3\ylvUeoqI4aQx1bG1g9p73jp3ODM.br[1].js
        • Size 94KB
        • SHA256 c49b924d82c6f41749f8bc49b2bb20b3bd68da27f5a30a39e862c4f2f31fd63c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
        • Size 1KB
        • SHA256 5a985cb236bb42d84c4df8dc4a8d8550131b3710544a5645ff7caaada6e2b14b
        • MD5 SHA1 SHA512
        Submit Download

        6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442
        • Size 446B
        • SHA256 2d4464076424043316c6bb9d9ea7fe4d3041ce572191815f931adcddfa9cb07e
        • MD5 SHA1 SHA512
        Submit Download

        www.bing[1].xml
        • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\B0ESNM48\www.bing[1].xml
        • Size 1KB
        • SHA256 1a86ef50f3f5c2aba71aec9556c0976170de4ba5757f9d2d457f05e1c263bae9
        • MD5 SHA1 SHA512
        Submit Download

        C41E.bat
        • Path C:\Users\Admin\AppData\Local\Temp\C41E.bat
        • Size 76B
        • SHA256 9eec0ba4a76b3568f62becb427678c45e4e355c67a553ee609fbdbff503938d5
        • MD5 SHA1 SHA512
        Submit Download

        memory/4048-219-0x000002A235670000-0x000002A235690000-memory.dmp
        Download

        memory/4048-216-0x000002A2355D0000-0x000002A2355F0000-memory.dmp
        Download

        memory/4048-215-0x000002A234F40000-0x000002A234F60000-memory.dmp
        Download

        memory/4248-160-0x0000021DEC1D0000-0x0000021DEC1D3000-memory.dmp
        Download

        memory/4248-157-0x0000021DEC1C0000-0x0000021DEC1C4000-memory.dmp
        Download

        memory/4248-154-0x0000021DEC1C0000-0x0000021DEC1C4000-memory.dmp
        Download

        memory/4248-155-0x0000021DEC1C0000-0x0000021DEC1C4000-memory.dmp
        Download

        memory/4248-150-0x0000021DEA360000-0x0000021DEA380000-memory.dmp
        Download

        memory/4248-147-0x0000021DEAE80000-0x0000021DEAEA0000-memory.dmp
        Download

        memory/4248-145-0x0000021DEA6E8000-0x0000021DEA6F0000-memory.dmp
        Download

        memory/4248-156-0x0000021DEC1C0000-0x0000021DEC1C4000-memory.dmp
        Download

        memory/4248-158-0x0000021DEC1C0000-0x0000021DEC1C4000-memory.dmp
        Download

        memory/4248-163-0x0000021DEC1D0000-0x0000021DEC1D3000-memory.dmp
        Download

        memory/4248-161-0x0000021DEC1D0000-0x0000021DEC1D3000-memory.dmp
        Download

        memory/4248-162-0x0000021DEC1D0000-0x0000021DEC1D3000-memory.dmp
        Download

        memory/5088-134-0x0000000000400000-0x0000000000455000-memory.dmp
        Download

        memory/5088-133-0x00000000005B0000-0x00000000005C6000-memory.dmp
        Download