Analysis
-
max time kernel
119s -
max time network
108s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
26-04-2024 23:58
Static task
static1
Behavioral task
behavioral1
Sample
Seroxen.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Seroxen.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Seroxen.exe
Resource
win11-20240419-en
General
-
Target
Seroxen.exe
-
Size
12KB
-
MD5
8208ea3955533b799b0f5f65db02df8a
-
SHA1
8829745dd294bb94d1dc39266cb2b8c2457b00cd
-
SHA256
0663f1114eca93d267e0ae9ddbaacf05974d77c0fa95efdf22f23ecbdf8e38cb
-
SHA512
f9d17761a044ec89490c7727a4cd365f950dd4e5f56762363ea8441fed2a6552036aafc8804fdddf87488148d2e94052e8f94c11dcc36e77d8d047baaf97448a
-
SSDEEP
192:+3s2rvMWWwghZv1Bsl0csO9qqjKw65dKUmP+eBQ8JG0x/kPo:as27M/zhZNyWjO9H65dDmPVQKdkw
Malware Config
Extracted
gozi
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
q0cnmzr2.exepid process 2408 q0cnmzr2.exe -
Loads dropped DLL 1 IoCs
Processes:
Seroxen.exepid process 1900 Seroxen.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 2 raw.githubusercontent.com 3 raw.githubusercontent.com 9 discord.com 10 discord.com 16 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 checkip.amazonaws.com -
Drops file in Windows directory 1 IoCs
Processes:
unregmp2.exedescription ioc process File opened for modification C:\Windows\win.ini unregmp2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 64 IoCs
Processes:
unregmp2.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.asx\OpenWithProgIds unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.midi\OpenWithProgIds unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.mov\OpenWithProgids\WMP11.AssocFile.MOV = "0" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mpa\OpenWithProgIds unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.3gp unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.asf\OpenWithProgIds unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpe\MP2.Last = "Custom" unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.wmv unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMZ unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/3gpp unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.aiff\OpenWithProgIds\WMP11.AssocFile.AIFF = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.mpe unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.mts unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpeg unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpe\MPlayer2.BAK = "VLC.mpe" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\MP2.Last = "Custom" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AudioCD\DefaultIcon\ = "%SystemRoot%\\system32\\shell32.dll,40" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tts\OpenWithProgIds unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.wm\OpenWithProgids\WMP11.AssocFile.ASF = "0" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wmd unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.3gp2 unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.m4a\OpenWithProgIds unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\.mpv2\OpenWithProgIds\WMP11.AssocFile.MPEG = "0" unregmp2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.wmv\ = "WMP11.AssocFile.WMV" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-matroska\Extension = ".mkv" unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\ms-settings\shell\open\command reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.3gp2\OpenWithProgids\WMP11.AssocFile.3G2 = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/mpeg\CLSID = "{cd3afa89-b84f-48f0-9393-7edc34128127}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wm unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wpl\MPlayer2.BAK = "VLC.wpl" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpeg\Extension = ".mp3" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpegurl unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.flac unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.m2t\OpenWithProgids\WMP11.AssocFile.M2TS = "0" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.midi unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.snd unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MKA unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mp2v unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wmx\ = "WMP11.AssocFile.ASX" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mp3\CLSID = "{cd3afa76-b84f-48f0-9393-7edc34128127}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MIDI unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpeg unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/avi\Extension = ".avi" unregmp2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.3gpp\OpenWithProgids\WMP11.AssocFile.3GP = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.3gpp unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.aif\MP2.Last = "Custom" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wmz\OpenWithProgIds unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wvx\MPlayer2.BAK = "VLC.wvx" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-matroska\CLSID = "{cd3afa7e-b84f-48f0-9393-7edc34128127}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.flac\ = "WMP11.AssocFile.FLAC" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mod unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.snd\OpenWithProgIds unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/basic\Extension = ".au" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-flac\CLSID = "{cd3afa7f-b84f-48f0-9393-7edc34128127}" unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\.asf unregmp2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Seroxen.exeq0cnmzr2.exepid process 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 2408 q0cnmzr2.exe 2408 q0cnmzr2.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe 1900 Seroxen.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
Seroxen.exeq0cnmzr2.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1900 Seroxen.exe Token: SeDebugPrivilege 2408 q0cnmzr2.exe Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE Token: SeShutdownPrivilege 3412 Explorer.EXE Token: SeCreatePagefilePrivilege 3412 Explorer.EXE -
Suspicious use of FindShellTrayWindow 23 IoCs
Processes:
ComputerDefaults.exeExplorer.EXEpid process 2344 ComputerDefaults.exe 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE 3412 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Seroxen.exepid process 1900 Seroxen.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
Seroxen.execmd.execmd.exeq0cnmzr2.exeComputerDefaults.exeunregmp2.exedescription pid process target process PID 1900 wrote to memory of 372 1900 Seroxen.exe reg.exe PID 1900 wrote to memory of 372 1900 Seroxen.exe reg.exe PID 1900 wrote to memory of 372 1900 Seroxen.exe reg.exe PID 1900 wrote to memory of 2088 1900 Seroxen.exe reg.exe PID 1900 wrote to memory of 2088 1900 Seroxen.exe reg.exe PID 1900 wrote to memory of 2088 1900 Seroxen.exe reg.exe PID 1900 wrote to memory of 216 1900 Seroxen.exe cmd.exe PID 1900 wrote to memory of 216 1900 Seroxen.exe cmd.exe PID 1900 wrote to memory of 216 1900 Seroxen.exe cmd.exe PID 216 wrote to memory of 2344 216 cmd.exe ComputerDefaults.exe PID 216 wrote to memory of 2344 216 cmd.exe ComputerDefaults.exe PID 216 wrote to memory of 2344 216 cmd.exe ComputerDefaults.exe PID 1900 wrote to memory of 2332 1900 Seroxen.exe cmd.exe PID 1900 wrote to memory of 2332 1900 Seroxen.exe cmd.exe PID 1900 wrote to memory of 2332 1900 Seroxen.exe cmd.exe PID 2332 wrote to memory of 3704 2332 cmd.exe schtasks.exe PID 2332 wrote to memory of 3704 2332 cmd.exe schtasks.exe PID 2332 wrote to memory of 3704 2332 cmd.exe schtasks.exe PID 1900 wrote to memory of 2408 1900 Seroxen.exe q0cnmzr2.exe PID 1900 wrote to memory of 2408 1900 Seroxen.exe q0cnmzr2.exe PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2408 wrote to memory of 3412 2408 q0cnmzr2.exe Explorer.EXE PID 2344 wrote to memory of 4728 2344 ComputerDefaults.exe unregmp2.exe PID 2344 wrote to memory of 4728 2344 ComputerDefaults.exe unregmp2.exe PID 2344 wrote to memory of 4728 2344 ComputerDefaults.exe unregmp2.exe PID 4728 wrote to memory of 4312 4728 unregmp2.exe unregmp2.exe PID 4728 wrote to memory of 4312 4728 unregmp2.exe unregmp2.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\Seroxen.exe"C:\Users\Admin\AppData\Local\Temp\Seroxen.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbs" /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unregmp2.exeC:\Windows\system32\unregmp2.exe /SetWMPAsDefault5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /SetWMPAsDefault /REENTRANT6⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN FoxitReaderUpdater_FGHgbhnJDeyD1gGgf050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\FGHgbhnJDeyD1gGgf050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN FoxitReaderUpdater_FGHgbhnJDeyD1gGgf050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\FGHgbhnJDeyD1gGgf050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\q0cnmzr2.exe"C:\Users\Admin\AppData\Local\Temp\q0cnmzr2.exe" explorer.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\c20abedad5064184a49ba572c6efca60Filesize
136KB
MD5454b3ed43bd868c6783c979507a2f354
SHA15fda75c6e18babbd85c89a75cedfa7c4bc09842e
SHA2566142f1e02fdcce9ea7fb176281fe20f70970e46a165b7a8f9f530da7ed50c7f9
SHA512ccacbb22e4040f21252be4864864a1ae23e30d51b3362c7ac76e529fa183e7a19ca6ad0c00562ddf88918ff195ca87d707004824e7117fb7e62fda02faf83a78
-
C:\Users\Admin\AppData\Local\Temp\q0cnmzr2.exeFilesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
C:\Users\Admin\AppData\Roaming\Gongle\aPDQVAJ2H0\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Roaming\Gongle\aPDQVAJ2H0\LOGFilesize
332B
MD52e82faa9cdaf2881048de70d40553251
SHA1e05954ce11cd2f09544485786a32648908bca132
SHA256bbb8152932d085d4c46a4040a3e6af30b7486f4d38bb4ac181b67cdf2faaa81d
SHA5126a96de19c48e554e266588eae9a618c49946e2282d5a9c82e1db607d2378c2573489aca285da1d60d8e82faedfd81bceef08a5c65ee3b10d394332af1023942b
-
C:\Users\Admin\AppData\Roaming\Gongle\aPDQVAJ2H0\LOG.oldFilesize
289B
MD53db4eaf9addced7c26a1bbf2cf3de208
SHA171d17155fdcee6696ef875d4bfe17c6553f53ae7
SHA2566b3e1df99dc1835356cd98b4712b7fe9a9df158e013d3529ab28389c748d4d84
SHA51292d9eb220574abdaed121775b9701ca7a4481f028a140db3aba3d551bc14d10ebcb11a70ba04a8700e31c250506c7786c47b2971267f5b5ab47fa73edcacf7d8
-
C:\Users\Admin\AppData\Roaming\Gongle\aPDQVAJ2H0\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
C:\Users\Admin\AppData\Roaming\Gongle\aT89ULUPSS\je1358xf.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteFilesize
48KB
MD5ac3e539ae563112b3a5a09257679d5ae
SHA143ccb9f13df2a94fb8c7ce77827f943abfd00d92
SHA25611138228b6d2bda305a633a312e1c9f7907df738d4c162043e4f8b95873ce726
SHA5125e46647f07aaeb0fe2a805b4ee7f4a6d7b6ff8f599fe44f57a581d5c7fa812230701fd8a24c70017d0ec0d86dbe38fb14ac9563b1675cdbad96b561dab3c9b70
-
\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dllFilesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
memory/1900-39-0x0000000006020000-0x000000000602A000-memory.dmpFilesize
40KB
-
memory/1900-5-0x0000000004950000-0x00000000049E2000-memory.dmpFilesize
584KB
-
memory/1900-9-0x000000000A460000-0x000000000B060000-memory.dmpFilesize
12.0MB
-
memory/1900-169-0x0000000006820000-0x000000000682A000-memory.dmpFilesize
40KB
-
memory/1900-1-0x0000000000A20000-0x0000000000A3A000-memory.dmpFilesize
104KB
-
memory/1900-162-0x0000000006770000-0x0000000006790000-memory.dmpFilesize
128KB
-
memory/1900-161-0x00000000067D0000-0x000000000680C000-memory.dmpFilesize
240KB
-
memory/1900-157-0x0000000006700000-0x000000000674B000-memory.dmpFilesize
300KB
-
memory/1900-35-0x0000000007470000-0x0000000007482000-memory.dmpFilesize
72KB
-
memory/1900-36-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/1900-37-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/1900-38-0x0000000005F70000-0x0000000005FD6000-memory.dmpFilesize
408KB
-
memory/1900-0-0x00000000008D0000-0x00000000008DC000-memory.dmpFilesize
48KB
-
memory/1900-40-0x00000000084B0000-0x00000000084BA000-memory.dmpFilesize
40KB
-
memory/1900-41-0x00000000084A0000-0x00000000084AC000-memory.dmpFilesize
48KB
-
memory/1900-42-0x000000000A440000-0x000000000A448000-memory.dmpFilesize
32KB
-
memory/1900-6-0x0000000004F60000-0x000000000545E000-memory.dmpFilesize
5.0MB
-
memory/1900-10-0x00000000111D0000-0x0000000011E72000-memory.dmpFilesize
12.6MB
-
memory/1900-4-0x0000000004A50000-0x0000000004A60000-memory.dmpFilesize
64KB
-
memory/1900-3-0x0000000000A00000-0x0000000000A0A000-memory.dmpFilesize
40KB
-
memory/1900-2-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/1900-150-0x0000000006040000-0x00000000060F2000-memory.dmpFilesize
712KB
-
memory/1900-151-0x0000000006160000-0x0000000006182000-memory.dmpFilesize
136KB
-
memory/1900-152-0x0000000006220000-0x0000000006296000-memory.dmpFilesize
472KB
-
memory/1900-153-0x00000000061C0000-0x00000000061DE000-memory.dmpFilesize
120KB
-
memory/1900-154-0x00000000062F0000-0x0000000006340000-memory.dmpFilesize
320KB
-
memory/1900-155-0x0000000006340000-0x00000000063AA000-memory.dmpFilesize
424KB
-
memory/1900-156-0x00000000063B0000-0x0000000006700000-memory.dmpFilesize
3.3MB
-
memory/3412-29-0x0000000001050000-0x0000000001058000-memory.dmpFilesize
32KB
-
memory/3412-28-0x0000000001050000-0x0000000001058000-memory.dmpFilesize
32KB
-
memory/3412-26-0x0000000001050000-0x0000000001058000-memory.dmpFilesize
32KB
-
memory/3412-22-0x0000000001050000-0x0000000001058000-memory.dmpFilesize
32KB
-
memory/3412-23-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB