Malware Analysis Report

2024-10-24 17:54

Sample ID 240509-x2vfvsdg36
Target INJV2.exe
SHA256 aa4ee47c8ab931a02915fbede23a34ac01e653d9e64da989e7c59e4226a69f06
Tags
gozi banker isfb spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aa4ee47c8ab931a02915fbede23a34ac01e653d9e64da989e7c59e4226a69f06

Threat Level: Known bad

The file INJV2.exe was found to be: Known bad.

Malicious Activity Summary

gozi banker isfb spyware stealer trojan

Gozi

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Checks computer location settings

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Unsigned PE

Enumerates physical storage devices

Creates scheduled task(s)

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 19:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 19:21

Reported

2024-05-09 19:23

Platform

win10v2004-20240508-en

Max time kernel

129s

Max time network

121s

Command Line

C:\Windows\Explorer.EXE

Signatures

Gozi

banker trojan gozi

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\wscript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A

Reads user/profile data of web browsers

spyware stealer

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A checkip.amazonaws.com N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\Explorer.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259} C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\damagehit2754547.vbs" C:\Windows\SysWOW64\reg.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev = "0" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID = "{30C8EEF4-A832-41E2-AB32-E3C3CA28FD29}" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\ms-settings\shell\open\command C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\ms-settings\shell\open\command C:\Windows\SysWOW64\reg.exe N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode = "2" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode = "6" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize = "48" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 3a002e8005398e082303024b98265d99428e115f260001002600efbe11000000ac3bd29140a1da0114a5952549a1da0114a5952549a1da0114000000 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\ms-settings C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\ms-settings\shell\open C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort = 0000000000000000000000000000000002000000f4eec83032a8e241ab32e3c3ca28fd29030000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668} C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags = "1092616193" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection = "1" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev = "0" C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\ms-settings\shell C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView = "4294967295" C:\Windows\Explorer.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID = "2" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders C:\Windows\Explorer.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" C:\Windows\Explorer.EXE N/A
Set value (data) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f80cb859f6720028040b29b5540cc05aab60000 C:\Windows\Explorer.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell C:\Windows\Explorer.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeShutdownPrivilege N/A C:\Windows\Explorer.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe N/A
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1196 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\reg.exe
PID 1196 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\reg.exe
PID 1196 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\reg.exe
PID 1196 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\reg.exe
PID 1196 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\reg.exe
PID 1196 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\reg.exe
PID 1196 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\cmd.exe
PID 1196 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\cmd.exe
PID 1196 wrote to memory of 2148 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\cmd.exe
PID 2148 wrote to memory of 3088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ComputerDefaults.exe
PID 2148 wrote to memory of 3088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ComputerDefaults.exe
PID 2148 wrote to memory of 3088 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\ComputerDefaults.exe
PID 3088 wrote to memory of 1360 N/A C:\Windows\SysWOW64\ComputerDefaults.exe C:\Windows\SysWOW64\wscript.exe
PID 3088 wrote to memory of 1360 N/A C:\Windows\SysWOW64\ComputerDefaults.exe C:\Windows\SysWOW64\wscript.exe
PID 3088 wrote to memory of 1360 N/A C:\Windows\SysWOW64\ComputerDefaults.exe C:\Windows\SysWOW64\wscript.exe
PID 1360 wrote to memory of 876 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1360 wrote to memory of 876 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1360 wrote to memory of 876 N/A C:\Windows\SysWOW64\wscript.exe C:\Windows\SysWOW64\cmd.exe
PID 1196 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\cmd.exe
PID 1196 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\cmd.exe
PID 1196 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Windows\SysWOW64\cmd.exe
PID 3240 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3240 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 3240 wrote to memory of 3896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\schtasks.exe
PID 1196 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe
PID 1196 wrote to memory of 3796 N/A C:\Users\Admin\AppData\Local\Temp\INJV2.exe C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE
PID 3796 wrote to memory of 3556 N/A C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe C:\Windows\Explorer.EXE

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\INJV2.exe

"C:\Users\Admin\AppData\Local\Temp\INJV2.exe"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\damagehit2754547.vbs" /f

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C computerdefaults.exe

C:\Windows\SysWOW64\ComputerDefaults.exe

computerdefaults.exe

C:\Windows\SysWOW64\wscript.exe

"wscript.exe" C:\Users\Admin\AppData\Local\Temp\damagehit2754547.vbs

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN iTunesUpdateTask_JgKPzgmrZu1ekI1dj050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\JgKPzgmrZu1ekI1dj050MX.exe" /RL HIGHEST /IT

C:\Windows\SysWOW64\schtasks.exe

schtasks /Create /SC ONLOGON /TN iTunesUpdateTask_JgKPzgmrZu1ekI1dj050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\JgKPzgmrZu1ekI1dj050MX.exe" /RL HIGHEST /IT

C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe

"C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe" explorer.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
BE 2.17.196.129:443 www.bing.com tcp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 129.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 textpubshiers.top udp
US 104.21.79.145:443 textpubshiers.top tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 145.79.21.104.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 232.136.159.162.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 checkip.amazonaws.com udp
IE 52.211.130.173:80 checkip.amazonaws.com tcp
US 104.21.79.145:443 textpubshiers.top tcp
US 8.8.8.8:53 173.130.211.52.in-addr.arpa udp
US 162.159.136.232:443 discord.com tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/1196-0-0x000000007440E000-0x000000007440F000-memory.dmp

memory/1196-1-0x0000000000530000-0x000000000053C000-memory.dmp

memory/1196-2-0x0000000000AC0000-0x0000000000ADA000-memory.dmp

memory/1196-3-0x0000000000A10000-0x0000000000A1A000-memory.dmp

memory/1196-4-0x0000000004B80000-0x0000000004C12000-memory.dmp

memory/1196-5-0x0000000005260000-0x0000000005804000-memory.dmp

memory/1196-6-0x0000000074400000-0x0000000074BB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\damagehit2754547.vbs

MD5 a34267102c21aff46aecc85598924544
SHA1 77268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256 eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA512 5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

memory/1196-10-0x000000000A950000-0x000000000B550000-memory.dmp

memory/1196-11-0x00000000116E0000-0x0000000012382000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dll

MD5 6f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1 fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA256 70e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512 fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b

C:\Users\Admin\AppData\Local\Temp\ffnhdtsg.exe

MD5 e898826598a138f86f2aa80c0830707a
SHA1 1e912a5671f7786cc077f83146a0484e5a78729c
SHA256 df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA512 6827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb

memory/3556-26-0x0000000000B30000-0x0000000000B38000-memory.dmp

memory/3556-27-0x0000000000B60000-0x0000000000B61000-memory.dmp

memory/3556-28-0x0000000000B30000-0x0000000000B38000-memory.dmp

memory/3556-30-0x0000000000B30000-0x0000000000B38000-memory.dmp

memory/3556-31-0x0000000000B30000-0x0000000000B38000-memory.dmp

memory/1196-37-0x00000000075A0000-0x00000000075B2000-memory.dmp

memory/1196-38-0x000000007440E000-0x000000007440F000-memory.dmp

memory/1196-39-0x0000000074400000-0x0000000074BB0000-memory.dmp

memory/1196-40-0x0000000007F50000-0x0000000007FB6000-memory.dmp

memory/1196-41-0x0000000008080000-0x000000000808A000-memory.dmp

memory/1196-42-0x000000000A910000-0x000000000A91A000-memory.dmp

memory/1196-43-0x000000000A930000-0x000000000A93C000-memory.dmp

memory/1196-44-0x000000000CC50000-0x000000000CC58000-memory.dmp

C:\Users\Admin\AppData\Roaming\Gongle\a9JK27MTM8\afevplna.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

MD5 d3211993a87fb182e9b56e82acb5549c
SHA1 9136c9ad046d538d9cd524ad27f9935779516831
SHA256 a5442e3c9f120b581869e14b75a86c9f8257127326ee011e963bae0703103ad0
SHA512 6fb761177c3575f8b3885693f72bd7959781cd8767e909d76145edc1737fe07f953a563a300700cc18c779ee059328d1c9dd17af744f40cac4690aaf176cf7fb

C:\Users\Admin\AppData\Roaming\Gongle\a95AFHP852\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Roaming\Gongle\a95AFHP852\LOG

MD5 ed2c6891f9298b4485b39bba0b59bfd6
SHA1 0993bd50b5991c4adbc2d1a29a0785fb9fbb293e
SHA256 ad93f92bb36b976dab155e195944a48705f44645b98ecb67b26fd1fa7077b262
SHA512 58fe343a125f7e604a095cf02dbab191bc497ab559bb9e42691653a45282ef85145ff14929a9ff209a95ee67add03ce4ab081a3b4dc6db15fd429774d12d49c5

C:\Users\Admin\AppData\Roaming\Gongle\a95AFHP852\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Roaming\Gongle\aZM48ZZKV9\LOG

MD5 ec9bcbe3608f7a34909581ab9a069c6e
SHA1 e523c07f6d30cb7c49b6d98da352d065812fcbe5
SHA256 0765fedbadcd9cd8a1f386ecb7cdd1e6e1055b429232624167e06700a6cfb7c0
SHA512 763969be02de6a7b1384509a5a70bfa33b416341167f493a422189edc3649d3be2838691dad67c4bb5db6a6684349e01b7e73e97609be643fecc80466df9ee08

C:\Users\Admin\AppData\Roaming\Gongle\aZM48ZZKV9\LOG.old

MD5 35a59bf5f84a92ffacf1424219da9740
SHA1 e2e3b2af6a2e6c8fc0e9eb56e746f6398f67b07d
SHA256 b0840212236bd08136388c31b3dd00b7cb4962500a706585953f3c1d3ec21369
SHA512 0cd80a11187d7e94ea4c3d581909e633ba7636e91792f5b03f84980f34f97cce0018b8c99420870c8503a94f5a6448250ebbf343bf602171b8b535410731182e

memory/1196-172-0x000000000CC60000-0x000000000CD12000-memory.dmp

memory/1196-173-0x000000000CD10000-0x000000000CD32000-memory.dmp

memory/1196-174-0x000000000CDC0000-0x000000000CE36000-memory.dmp

memory/1196-175-0x000000000CD60000-0x000000000CD7E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Gongle\a95AFHP852\LOG.old

MD5 921ff2050928372f6f2d9af17bb08d36
SHA1 31e0561115475c84db1e1ac5a141b77557c8e4a1
SHA256 9c5c47feae436e236c38c5d0f939fd358be000daf523e87bb930c836ed2423ca
SHA512 e8681309d3a8681ee51e5686dd4d014785f1e2309ed735c1657dce2742291ef9aef8f280dad8e47ab6128d61acd474dbbec8e7b4d1cdfe7a6d395d5445528372

memory/1196-178-0x000000000CE90000-0x000000000CEE0000-memory.dmp

memory/1196-179-0x00000000063D0000-0x000000000643A000-memory.dmp

memory/1196-180-0x000000000CEE0000-0x000000000D234000-memory.dmp

memory/1196-181-0x00000000064A0000-0x00000000064EC000-memory.dmp

memory/1196-186-0x0000000007110000-0x0000000007131000-memory.dmp

memory/1196-185-0x0000000007150000-0x000000000718C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\48519d200a15444ea265fcb9fa023406

MD5 8f5942354d3809f865f9767eddf51314
SHA1 20be11c0d42fc0cef53931ea9152b55082d1a11e
SHA256 776ecf8411b1b0167bea724409ac9d3f8479973df223ecc6e60e3302b3b2b8ea
SHA512 fde8dfae8a862cf106b0cb55e02d73e4e4c0527c744c20886681245c8160287f722612a6de9d0046ed1156b1771229c8950b9ac036b39c988d75aa20b7bac218

C:\Users\Admin\AppData\Local\Temp\4378fface2a64ebe8d117999a074b066

MD5 ada6fc392b78f818885a5a7e02159f2c
SHA1 e7d7293dad57b7e070a46f45e9c18433e986c5e6
SHA256 9562d4ca59820a117742b81f1304a29f9884d9ce7ceee217078eb15e2e4e6a91
SHA512 051723e9631599e8c475d89b3ac778a805e9bd4e312f432783be5c4081913240e4a7e97b2402aacf7a389691568d83994da638d39d5b800d0df4279a711af1f9

memory/1196-201-0x00000000071E0000-0x00000000071EA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ddda122cf4254b80a7bc45ecadede139

MD5 bde34615ab4dce41e3e02f91b4ff5299
SHA1 e48db653d9713109f0474f2f2af6d51bfc92b5dd
SHA256 355497a6678723c417e611763b88872d5ed2d41a5496ffdf9ef33ca4f4a94f54
SHA512 fdb92f3b9858e38db404a6e1d91fd5f28c517b06c391d62eaeef44c7b7265e89b34565d66c3fc430143994e038abaf96c09fc46f798caa9cd8ea5b99cac38819