Overview

overview

8

Static

static

1

9a2ed5b160...0d.exe

windows7-x64

8

9a2ed5b160...0d.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    142s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/02/2024, 23:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    9a2ed5b160b641c97354eaba39e6c00d.exe
  • Size 1.3MB
  • Sample240213-3c5hesbe4v
  • SHA256 0f7ad0a7947c3676217c4f5e5d914294b36a53375ae215a71dce1e0197e06e84
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
adwarediscoveryevasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 41 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Installs/modifies Browser Helper Object 2 TTPs 5 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a2ed5b160b641c97354eaba39e6c00d.exe
    "C:\Users\Admin\AppData\Local\Temp\9a2ed5b160b641c97354eaba39e6c00d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Users\Admin\AppData\Local\Temp\T8SETUP.EXE
      "C:\Users\Admin\AppData\Local\Temp\T8SETUP.EXE" /p=RG/n="Retrogamer"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Registers COM server for autorun
      • Adds Run key to start application
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3944
      • C:\PROGRA~2\RETROG~1\bar\1.bin\2zbarsvc.exe
        "C:\PROGRA~2\RETROG~1\bar\1.bin\2zbarsvc.exe" -remove
        3⤵
        • Executes dropped EXE
        PID:2796
      • C:\PROGRA~2\RETROG~1\bar\1.bin\2zbarsvc.exe
        "C:\PROGRA~2\RETROG~1\bar\1.bin\2zbarsvc.exe" -install
        3⤵
        • Executes dropped EXE
        PID:2680
      • C:\PROGRA~2\RETROG~1\bar\1.bin\2zsrchmn.exe
        "C:\PROGRA~2\RETROG~1\bar\1.bin\2zsrchmn.exe" /m=2 /w /h
        3⤵
        • Executes dropped EXE
        PID:1764
      • C:\PROGRA~2\RETROG~1\bar\1.bin\2zbrmon.exe
        "C:\PROGRA~2\RETROG~1\bar\1.bin\2zbrmon.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3896
      • C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zHighIn.exe
        "C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zHighIn.exe" 2ztpinst.dll,#5
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\ThirdPartyInstallers\GT_silent.exe
          "C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\ThirdPartyInstallers\GT_silent.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2700
          • C:\Users\Admin\AppData\Local\Temp\is-3OJO8.tmp\GT_silent.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-3OJO8.tmp\GT_silent.tmp" /SL5="$701C6,5215731,54272,C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\ThirdPartyInstallers\GT_silent.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:404
            • C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GT_FF_silent.exe
              "C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GT_FF_silent.exe" /verysilent
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4692
              • C:\Users\Admin\AppData\Local\Temp\is-6I112.tmp\GT_FF_silent.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-6I112.tmp\GT_FF_silent.tmp" /SL5="$4021E,281097,54272,C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GT_FF_silent.exe" /verysilent
                7⤵
                • Executes dropped EXE
                PID:5108
            • C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GT_IE_silent.exe
              "C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GT_IE_silent.exe" /verysilent
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4416
              • C:\Users\Admin\AppData\Local\Temp\is-F61R9.tmp\GT_IE_silent.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-F61R9.tmp\GT_IE_silent.tmp" /SL5="$70180,307043,54272,C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GT_IE_silent.exe" /verysilent
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of WriteProcessMemory
                PID:5000
                • C:\Windows\SysWOW64\regsvr32.exe
                  "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\GameTapWebPlayer_4_4_0_7.ocx"
                  8⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  PID:4460
            • C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GameTapWebPlayer_v-4.4.0.7.exe
              "C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GameTapWebPlayer_v-4.4.0.7.exe" /verysilent
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4600
              • C:\Users\Admin\AppData\Local\Temp\is-3GQOF.tmp\GameTapWebPlayer_v-4.4.0.7.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-3GQOF.tmp\GameTapWebPlayer_v-4.4.0.7.tmp" /SL5="$A0238,3536713,53248,C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GameTapWebPlayer_v-4.4.0.7.exe" /verysilent
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks whether UAC is enabled
                • Drops file in Program Files directory
                • Modifies Internet Explorer settings
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:232
                • C:\Program Files (x86)\GameTap Web Player\bin\release\ieblaster.exe
                  "C:\Program Files (x86)\GameTap Web Player\bin\release\ieblaster.exe"
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2596
  • C:\PROGRA~2\RETROG~1\bar\1.bin\2zbarsvc.exe
    C:\PROGRA~2\RETROG~1\bar\1.bin\2zbarsvc.exe
    1⤵
    • Executes dropped EXE
    PID:1724

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        2zbrmon.exe
        • Path C:\PROGRA~2\RETROG~1\bar\1.bin\2zbrmon.exe
        • Size 29KB
        • SHA256 5418b7bb40b097da6370ada1194f8b2d2d3eefa3ca36a6eb31d39df7791a25a3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zsrchmn.exe
        • Path C:\PROGRA~2\RETROG~1\bar\1.bin\2zsrchmn.exe
        • Size 37KB
        • SHA256 b6a8fc2287131be7b61647ba640f871c8ac70a71d3a5c3346f7d75ae6680dc45
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        gtsniff.dll
        • Path C:\Program Files (x86)\GameTap Web Player\bin\release\gtsniff.dll
        • Size 304KB
        • SHA256 a67e7b938aef6ff40946c882f70259a2ed841c8d7c0cb886beb996678721dc01
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msvcp71.dll
        • Path C:\Program Files (x86)\GameTap Web Player\bin\release\msvcp71.dll
        • Size 488KB
        • SHA256 df96156f6a548fd6fe5672918de5ae4509d3c810a57bffd2a91de45a3ed5b23b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msvcr71.dll
        • Path C:\Program Files (x86)\GameTap Web Player\bin\release\msvcr71.dll
        • Size 340KB
        • SHA256 8094af5ee310714caebccaeee7769ffb08048503ba478b879edfef5f1a24fefe
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        is-MUKRN.tmp
        • Path C:\Program Files (x86)\GameTap Web Player\local\assets_hl\data\core\skins\images\is-MUKRN.tmp
        • Size 5KB
        • SHA256 2995917e74dbabafd8d25b81e688cacde1ec51aad82f49934805d0b3fddcd997
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zHighIn.exe
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zHighIn.exe
        • Size 21KB
        • SHA256 b1c485330062beb4d02e3e67e68de82c6ffa22b0bbf1eeb6356d2ae15d03249d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zPlugin.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zPlugin.dll
        • Size 61KB
        • SHA256 c290740fe6b590dfaca6db19e0ce663003b26b32eb921eb19619ea359640d348
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zSrcAs.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zSrcAs.dll
        • Size 61KB
        • SHA256 45c3cfdef55ea3abc14fab5d25cffd0e08306f91aaea4a67248ee702e7b9fd7b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zauxstb.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zauxstb.dll
        • Size 29KB
        • SHA256 2529f6465570ac7f0b82613c694181cc10515ee045cfaa48dd7402e9b9d791bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zbar.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zbar.dll
        • Size 673KB
        • SHA256 7b6924a1daae67ffb1b69f060fe5d6f6bf0a9681307feb2478281b5418e5ebb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zbarsvc.exe
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zbarsvc.exe
        • Size 41KB
        • SHA256 6689d8f62f860178685496ef45520967afaeff94cfbcc64cf77074f21577e0a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zbrstub.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zbrstub.dll
        • Size 33KB
        • SHA256 b67d6eba635dc1cec42eec2d1a1ceee34e43cb3a55e6080b1a17d29af5d9cf08
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zdatact.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zdatact.dll
        • Size 97KB
        • SHA256 0059d01f099fffa09373a6ead57f3cd1c6772667b9a7eeb6edabca3cd1963cf1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zdlghk.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zdlghk.dll
        • Size 49KB
        • SHA256 909e45c4e208907b99fef410ec4f5fe848e06be036b7a3d3a49e94bd8f259530
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zdyn.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zdyn.dll
        • Size 53KB
        • SHA256 5dc33b6ae31bb0b277f6db3b983e4adf5c509646b574c0630864ef462c6626c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zfeedmg.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zfeedmg.dll
        • Size 89KB
        • SHA256 090686b394ebf791b262b97249b20083c6a78e6cb04847a3ba643eb64c5ff184
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zhkstub.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zhkstub.dll
        • Size 33KB
        • SHA256 7c832e203c135a9a6d8feb4acd5cc828bd625bcf33f5348f38955d2eca8e31d9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zhtml.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zhtml.dll
        • Size 93KB
        • SHA256 a8b9edb8e090cb28bb4c9578fa1aab53c816b5a9d95853089135f41ff66d7385
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zhtmlmu.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zhtmlmu.dll
        • Size 157KB
        • SHA256 264e123877da29452933488131e025c7c78abcf4390e09daa4c9530133f8c4a0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zhttpct.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zhttpct.dll
        • Size 81KB
        • SHA256 c7a2447a749292e6aa3a8db104b46058af0f044ee376d6ca49a3764955d9b6b1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zidle.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zidle.dll
        • Size 33KB
        • SHA256 120b46557864c807dde6be7c0c1e71a2110d784a242dc79159945669d920fdb6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zieovr.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zieovr.dll
        • Size 41KB
        • SHA256 aa30c65ee96701116138ebae7d1f0e831452a749f1f9724232a03e660ef13f51
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zmlbtn.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zmlbtn.dll
        • Size 45KB
        • SHA256 f8274d77f804ad805806d531e940956d096f75c6b6b17f34a753f1cbce6c1632
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zmsg.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zmsg.dll
        • Size 157KB
        • SHA256 a2122cc682e9155708a0a8c12d1e0935231c82a30f4ec1afe0245d8ea4c7e7f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zradio.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zradio.dll
        • Size 121KB
        • SHA256 97b3a0272aa17e018d91d235cf5e21882a626bfc0ece264a699c25c2999bb9fc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zregfft.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zregfft.dll
        • Size 41KB
        • SHA256 159ffbb40567e8ebbcb29a24fa76bad6f1af81f5ec45a75cc5875dcdb5a78e4b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zreghk.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zreghk.dll
        • Size 41KB
        • SHA256 42c1e9298842ed383f4a0099b0782a5b57681e700f24338c5369e4a8586db9b2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zregiet.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zregiet.dll
        • Size 41KB
        • SHA256 64fa4044c2e8657b84eea6de847254731f20c010eed16bce9e82201dad825c13
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zscript.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zscript.dll
        • Size 45KB
        • SHA256 5b1fe0d4b92c46a303e112763b926c978d5a60462f72327aa4655d7663507652
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zskin.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zskin.dll
        • Size 125KB
        • SHA256 5925099be414f4f006fdbbac9d46b50d2c25e97410e9f1bd931e13ec586cd669
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2ztpinst.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2ztpinst.dll
        • Size 161KB
        • SHA256 bc26c866dae1dca43b55ff1f0c9dc79b3d6b84ad3d796c8be0e4ea9f09a77f05
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zuabtn.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\2zuabtn.dll
        • Size 41KB
        • SHA256 54fa5362ab82e7b7d631c48b7931ca50efeac29e2bfbbea30619f8f6be3b45e3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CHROME.MANIFEST
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\CHROME.MANIFEST
        • Size 265B
        • SHA256 5e9210089cbe9dfbb3de3faa4be90fec3207d027b2056ef5c25cdbd700643935
        • MD5 SHA1 SHA512
        Submit Download

        INSTALL.RDF
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\INSTALL.RDF
        • Size 937B
        • SHA256 39538e890a2a967bcfef7bf450a525244e2ff4af1182ef6c3f0d62185322b6b7
        • MD5 SHA1 SHA512
        Submit Download

        NP2zStub.dll
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\NP2zStub.dll
        • Size 29KB
        • SHA256 da5961b26d0013171e332e7bfd142111af5eed3cdf459a0ed0e61e2af0f693c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        T8RES.DLL
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\T8RES.DLL
        • Size 161KB
        • SHA256 8bd3d998cf0d76af0ef4c54567b1ac3b78715ebf35dfe4c7c7869ffc8166f470
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GT_silent.exe
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\ThirdPartyInstallers\GT_silent.exe
        • Size 246KB
        • SHA256 428023d3cc34bf1829ab0a06e1815e2a035ff16db24fbbceabd40a52373e61b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GT_silent.exe
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\ThirdPartyInstallers\GT_silent.exe
        • Size 3.2MB
        • SHA256 1c1fbaae2e8aa04c32ed4f025a5ae23944ff3cabf020c372c94c94af7f1fb802
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GT_silent.exe
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\ThirdPartyInstallers\GT_silent.exe
        • Size 3.3MB
        • SHA256 b04205efcf5380841c3f2ab615bade5c10c5620175baca8a5f06842452f22393
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        2zffxtbr.jar
        • Path C:\Program Files (x86)\Retrogamer_2z\bar\1.bin\chrome\2zffxtbr.jar
        • Size 26KB
        • SHA256 b4e792c4c71d14375c3cce18a3e632a619a74e2303ceee3b31e2387673afe02d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        77FBC64BA73370EC2F659BAD977FF2AD_9767A5403B067D539A02E2AD0F3C2C4A
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77FBC64BA73370EC2F659BAD977FF2AD_9767A5403B067D539A02E2AD0F3C2C4A
        • Size 5B
        • SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
        • MD5 SHA1 SHA512
        Submit Download

        T8SETUP.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\T8SETUP.EXE
        • Size 730KB
        • SHA256 4eaeb6ee7057e7c77f5d72d3918795763ae1f72de79f3a21a0d148cf0b8b8b94
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        T8SETUP.EXE
        • Path C:\Users\Admin\AppData\Local\Temp\T8SETUP.EXE
        • Size 1013KB
        • SHA256 a058bcfdd788f4775528dac0d599cf08bbad7a05857ca44ea632c39c1776fc42
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        T8SETUP.EX_
        • Path C:\Users\Admin\AppData\Local\Temp\T8SETUP.EX_
        • Size 1.3MB
        • SHA256 76fa321b6a86010c32635c30e2cf7e82fbbdd19c22052c6f73a6f031f33c8d59
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        gt_installer_log.txt
        • Path C:\Users\Admin\AppData\Local\Temp\gt_installer_log.txt
        • Size 126B
        • SHA256 adc9949414cc8acaa76e8416e8f4ed68afa120c6d6a03f665bb7f7361f68f220
        • MD5 SHA1 SHA512
        Submit Download

        GT_silent.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-3OJO8.tmp\GT_silent.tmp
        • Size 687KB
        • SHA256 a0cfbc8da39ad4a4d21c61d73873d225ffa5d7650fae5938ab643f719d5f7363
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _shfoldr.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-46TGG.tmp\_isetup\_shfoldr.dll
        • Size 22KB
        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GameTapWebPlayer_4_4_0_7.ocx
        • Path C:\Users\Admin\AppData\Local\Temp\is-AUU29.tmp\GameTapWebPlayer_4_4_0_7.ocx
        • Size 594KB
        • SHA256 e5a7b053c5bc718ae7546d73db684b9c2152d356effa9d76a99ecf1a02d221ec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GT_FF_silent.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GT_FF_silent.exe
        • Size 530KB
        • SHA256 d39b6fc91ef5929c4c1f073173a8763362a7869f39c2a936d2a0951941d6882b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GT_IE_silent.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GT_IE_silent.exe
        • Size 556KB
        • SHA256 97bb05aa9f1adddcc2ff2e2bb9d943f9609aedd17c2b1d29f5d7d52c837176ea
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GT_uninstall.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-E04AR.tmp\GT_uninstall.exe
        • Size 309KB
        • SHA256 5d594f8589cb8d45f0b39b44c0050b73db85bbf5c5ffb2ae747f8cc126b1dd1e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GT_IE_silent.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-F61R9.tmp\GT_IE_silent.tmp
        • Size 653KB
        • SHA256 7497cc8c14667adbe23a7ee327975be51184356acff37d62e59a37dc511ed889
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GameTapWebPlayer_4_4_0_7.ocx
        • Path C:\Windows\SysWOW64\GameTapWebPlayer_4_4_0_7.ocx
        • Size 721KB
        • SHA256 ffac1b9a081845b16a470414893279b5f4b16dbdb6ef6071dbe3df39e6400242
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/232-623-0x0000000000660000-0x0000000000661000-memory.dmp
        Download

        memory/232-627-0x0000000000400000-0x00000000004B6000-memory.dmp
        Download

        memory/232-328-0x0000000000400000-0x00000000004B6000-memory.dmp
        Download

        memory/232-649-0x0000000000400000-0x00000000004B6000-memory.dmp
        Download

        memory/232-312-0x0000000000660000-0x0000000000661000-memory.dmp
        Download

        memory/404-326-0x0000000000400000-0x00000000004BC000-memory.dmp
        Download

        memory/404-240-0x0000000000660000-0x0000000000661000-memory.dmp
        Download

        memory/404-660-0x0000000000400000-0x00000000004BC000-memory.dmp
        Download

        memory/2700-233-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/2700-324-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/2700-661-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/2700-235-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4416-303-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4416-274-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4600-305-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4600-327-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4600-650-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4692-253-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4692-270-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/4692-255-0x0000000000400000-0x0000000000414000-memory.dmp
        Download

        memory/5000-280-0x0000000000540000-0x0000000000541000-memory.dmp
        Download

        memory/5000-302-0x0000000000400000-0x00000000004BC000-memory.dmp
        Download

        memory/5108-269-0x0000000000400000-0x00000000004BC000-memory.dmp
        Download

        memory/5108-263-0x0000000002210000-0x0000000002211000-memory.dmp
        Download