ffdroider | de3e7309a038212864c3f1d717e29cbc3528390f1a8a99b5aee924f1fddc2508

Analysis

max time kernel
78s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

gsam-en-install.exe
Size

884KB
MD5

d4bc14d79adb65d8a03c1043f0c2ff07
SHA1

d454154fe8241eecf2a53f658aaeed805d25fecc
SHA256

de3e7309a038212864c3f1d717e29cbc3528390f1a8a99b5aee924f1fddc2508
SHA512

71f04ad3d96e5d83839cb9effb71ac826cb9ea6e4701c0e744b7d9f80fe029669f8ce06b6080e0c97a94abe1be44f81b09dbd0b57758cd11249ab1e39fc30a29
SSDEEP

24576:n9HmIVL1Tvp/MdafdwXCK0W8R/XJe0oYbdVRcTjCPJrIklTG0Z:RmIVXCafdjJDM0oYbTRejCxrIklTG0Z

Score

10^/10

ffdroider discovery execution persistence privilege_escalation spyware stealer upx

Malware Config

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider
Ffdroider family
ffdroider

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
676	powershell.exe

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\GSDriver64.sys	DrvInst.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET247B.tmp	RUNDLL32.EXE
File created	C:\Windows\system32\DRIVERS\SET247B.tmp	RUNDLL32.EXE
File opened for modification	C:\Windows\system32\DRIVERS\gsInetSecurity.sys	RUNDLL32.EXE
File opened for modification	C:\Windows\system32\DRIVERS\GSDriver64.sys	RUNDLL32.EXE

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE

Downloads MZ/PE file

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	gsam.exe
File opened (read-only)	\??\s:	gsam.exe
File opened (read-only)	\??\s:	gsam.exe
File opened (read-only)	\??\t:	gsam.exe
File opened (read-only)	\??\y:	gsam.exe
File opened (read-only)	\??\o:	gsam.exe
File opened (read-only)	\??\u:	gsam.exe
File opened (read-only)	\??\v:	gsam.exe
File opened (read-only)	\??\w:	gsam.exe
File opened (read-only)	\??\m:	gsam.exe
File opened (read-only)	\??\n:	gsam.exe
File opened (read-only)	\??\m:	gsam.exe
File opened (read-only)	\??\t:	gsam.exe
File opened (read-only)	\??\x:	gsam.exe
File opened (read-only)	\??\y:	gsam.exe
File opened (read-only)	\??\b:	gsam.exe
File opened (read-only)	\??\g:	gsam.exe
File opened (read-only)	\??\h:	gsam.exe
File opened (read-only)	\??\w:	gsam.exe
File opened (read-only)	\??\r:	gsam.exe
File opened (read-only)	\??\z:	gsam.exe
File opened (read-only)	\??\o:	gsam.exe
File opened (read-only)	\??\p:	gsam.exe
File opened (read-only)	\??\q:	gsam.exe
File opened (read-only)	\??\r:	gsam.exe
File opened (read-only)	\??\u:	gsam.exe
File opened (read-only)	\??\g:	gsam.exe
File opened (read-only)	\??\h:	gsam.exe
File opened (read-only)	\??\j:	gsam.exe
File opened (read-only)	\??\a:	gsam.exe
File opened (read-only)	\??\l:	gsam.exe
File opened (read-only)	\??\x:	gsam.exe
File opened (read-only)	\??\a:	gsam.exe
File opened (read-only)	\??\q:	gsam.exe
File opened (read-only)	\??\j:	gsam.exe
File opened (read-only)	\??\k:	gsam.exe
File opened (read-only)	\??\i:	gsam.exe
File opened (read-only)	\??\k:	gsam.exe
File opened (read-only)	\??\l:	gsam.exe
File opened (read-only)	\??\n:	gsam.exe
File opened (read-only)	\??\p:	gsam.exe
File opened (read-only)	\??\i:	gsam.exe
File opened (read-only)	\??\v:	gsam.exe
File opened (read-only)	\??\z:	gsam.exe
File opened (read-only)	\??\b:	gsam.exe
File opened (read-only)	\??\e:	gsam.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	gsam-en-install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	gsam.exe

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}\GSDriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\GSDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}\SET1FF8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\GSDriver64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}\GSDriver64.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}\SET1FF9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\GSDriver64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}\SET1FF7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}\GSDriver.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}\SET1FF8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}\SET1FF9.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\GSDriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{330324a5-87b1-7c46-980b-1aa227e5741a}\SET1FF7.tmp	DrvInst.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3840-0-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/3840-8-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/3840-9-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/3840-145-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/3840-262-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/3840-279-0x0000000000400000-0x0000000000655000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\greek.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver.inf	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\uninst.exe	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\gtkmgmtc.exe	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\offreg.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\libeay32.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\plds4.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\libplds4.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.cat	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\mozcrt19.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\filipino.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\hindi.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\italian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\ukrainian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver64.sys	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\ssleay32.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\albanian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\brazilian portuguese.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\bulgarian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\czech.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\persian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\vietnamese.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\softokn3.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\chinese (Simplified).lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\malaysian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\portuguese.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\russian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\spanish.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\indonesian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\gsam.exe	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\freebl3.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\nepali.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\slovenian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\sqlite3.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\libplc4.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\danish.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\english.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsdriver.cat	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\azerbaijani.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\lithuanian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\swahili.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\swedish.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\libmem.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\bengali.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\croatian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\georgian.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\japanese.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\polish.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\french.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\korean.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\gsInetSecurity.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nspr4.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\smime3.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nssutil3.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\afrikaans.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\amharic.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\turkish.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\urdu.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\thai.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\pFilters.dll	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\whatsnew.dat	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\certutil.exe	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\dutch.lng	qC5N07Vt.4Iq
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\finnish.lng	qC5N07Vt.4Iq

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	RUNDLL32.EXE
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Executes dropped EXE 3 IoCs

pid	Process
3112	qC5N07Vt.4Iq
4456	gsam.exe
1052	gsam.exe

Loads dropped DLL 13 IoCs

pid	Process
3112	qC5N07Vt.4Iq
3112	qC5N07Vt.4Iq
3112	qC5N07Vt.4Iq
4456	gsam.exe
4456	gsam.exe
4996	regsvr32.exe
1048	regsvr32.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gsam-en-install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qC5N07Vt.4Iq
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gsam-en-install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gsam-en-install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gsam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gsam.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\ = "Gridinsoft Anti-Malware"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware\ = "Gridinsoft Anti-Malware"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware\Clsid\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\ProgID\ = "shellext.Gridinsoft Anti-Malware"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ = "C:\\PROGRA~1\\GRIDIN~1\\shellext.dll"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
676	powershell.exe
676	powershell.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe
1052	gsam.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	4456	gsam.exe
Token: SeAuditPrivilege	4032	svchost.exe
Token: SeSecurityPrivilege	4032	svchost.exe
Token: SeRestorePrivilege	1776	DrvInst.exe
Token: SeBackupPrivilege	1776	DrvInst.exe
Token: SeDebugPrivilege	1052	gsam.exe
Token: SeDebugPrivilege	1052	gsam.exe
Token: SeBackupPrivilege	1052	gsam.exe
Token: SeRestorePrivilege	1052	gsam.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3840	gsam-en-install.exe
4456	gsam.exe
1052	gsam.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4456	gsam.exe
1052	gsam.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 3112	3840	gsam-en-install.exe	94
PID 3840 wrote to memory of 3112	3840	gsam-en-install.exe	94
PID 3840 wrote to memory of 3112	3840	gsam-en-install.exe	94
PID 3112 wrote to memory of 2988	3112	qC5N07Vt.4Iq	95
PID 3112 wrote to memory of 2988	3112	qC5N07Vt.4Iq	95
PID 3112 wrote to memory of 2988	3112	qC5N07Vt.4Iq	95
PID 3112 wrote to memory of 676	3112	qC5N07Vt.4Iq	99
PID 3112 wrote to memory of 676	3112	qC5N07Vt.4Iq	99
PID 3112 wrote to memory of 676	3112	qC5N07Vt.4Iq	99
PID 3112 wrote to memory of 4456	3112	qC5N07Vt.4Iq	102
PID 3112 wrote to memory of 4456	3112	qC5N07Vt.4Iq	102
PID 3112 wrote to memory of 5060	3112	qC5N07Vt.4Iq	103
PID 3112 wrote to memory of 5060	3112	qC5N07Vt.4Iq	103
PID 5060 wrote to memory of 3568	5060	RUNDLL32.EXE	104
PID 5060 wrote to memory of 3568	5060	RUNDLL32.EXE	104
PID 3568 wrote to memory of 3068	3568	runonce.exe	105
PID 3568 wrote to memory of 3068	3568	runonce.exe	105
PID 3112 wrote to memory of 3956	3112	qC5N07Vt.4Iq	106
PID 3112 wrote to memory of 3956	3112	qC5N07Vt.4Iq	106
PID 4032 wrote to memory of 3468	4032	svchost.exe	108
PID 4032 wrote to memory of 3468	4032	svchost.exe	108
PID 4032 wrote to memory of 1776	4032	svchost.exe	110
PID 4032 wrote to memory of 1776	4032	svchost.exe	110
PID 3956 wrote to memory of 1580	3956	RUNDLL32.EXE	111
PID 3956 wrote to memory of 1580	3956	RUNDLL32.EXE	111
PID 1580 wrote to memory of 3900	1580	runonce.exe	112
PID 1580 wrote to memory of 3900	1580	runonce.exe	112
PID 3112 wrote to memory of 1336	3112	qC5N07Vt.4Iq	114
PID 3112 wrote to memory of 1336	3112	qC5N07Vt.4Iq	114
PID 1336 wrote to memory of 4488	1336	RUNDLL32.EXE	115
PID 1336 wrote to memory of 4488	1336	RUNDLL32.EXE	115
PID 4488 wrote to memory of 5024	4488	runonce.exe	117
PID 4488 wrote to memory of 5024	4488	runonce.exe	117
PID 3112 wrote to memory of 4996	3112	qC5N07Vt.4Iq	118
PID 3112 wrote to memory of 4996	3112	qC5N07Vt.4Iq	118
PID 3112 wrote to memory of 4996	3112	qC5N07Vt.4Iq	118
PID 4996 wrote to memory of 1048	4996	regsvr32.exe	119
PID 4996 wrote to memory of 1048	4996	regsvr32.exe	119
PID 3840 wrote to memory of 1052	3840	gsam-en-install.exe	121
PID 3840 wrote to memory of 1052	3840	gsam-en-install.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\gsam-en-install.exe
"C:\Users\Admin\AppData\Local\Temp\gsam-en-install.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Users\Admin\AppData\Local\Temp\qC5N07Vt.4Iq
  C:\Users\Admin\AppData\Local\Temp\qC5N07Vt.4Iq /S /I /D=C:\Program Files\GridinSoft Anti-Malware\
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3112
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /u "C:\Program Files\GridinSoft Anti-Malware\shellext.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy bypass -noprofile -command "Add-MpPreference -ControlledFolderAccessAllowedApplications ""C:\Program Files\GridinSoft Anti-Malware\gsam.exe"""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- - C:\Program Files\GridinSoft Anti-Malware\gsam.exe
    "C:\Program Files\GridinSoft Anti-Malware\gsam.exe" -add-shortcut
    3⤵
    - Enumerates connected drives
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4456
- - C:\Windows\system32\RUNDLL32.EXE
    C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver.inf
    3⤵
    - Drops file in Drivers directory
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:3568
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:3068
- - C:\Windows\system32\RUNDLL32.EXE
    C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver.inf
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:3956
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:3900
- - C:\Windows\system32\RUNDLL32.EXE
    C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.inf
    3⤵
    - Drops file in Drivers directory
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:4488
    - - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        5⤵
        
        PID:5024
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GridinSoft Anti-Malware\shellext.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\GridinSoft Anti-Malware\shellext.dll"
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:1048
- C:\Program Files\GridinSoft Anti-Malware\gsam.exe
  "C:\Program Files\GridinSoft Anti-Malware\gsam.exe"
  2⤵
  - Enumerates connected drives
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6786269e-4083-7840-a12e-1e5eba23367a}\GSDriver.inf" "9" "47dc9dfe7" "0000000000000144" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files\GridinSoft Anti-Malware\Driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3468
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\gsdriver.inf" "0" "47dc9dfe7" "0000000000000158" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~1\GRIDIN~1\Driver\GSDriver.cat

Filesize
12KB

MD5
ba975b5e4691509738a152f12a9f8809

SHA1
7579f77aaf9472399fd183c0044e6f26dece8c10

SHA256
a91c7259f7c152910246f17c3510243d8437553fdd6ac7692fd1bb49553c9da5

SHA512
f7d5c21c108873f56aa467b0bb88329b9460ff0d82096d2ae4d5ae0dcece7454c8bb5fca63d5f07990776b4a4c8181c87e8ca47dca1f567961a316696b1681e7

Download Submit
C:\PROGRA~1\GRIDIN~1\Driver\GSDriver64.sys

Filesize
54KB

MD5
5b9839e88655fc22923952eefd14387b

SHA1
3a47805ddaa9bb6060a6be90ba3d8974e235dc6b

SHA256
06ef34bb12349cff3f2989f8f7e406d6723e6dfc5ce51a3d9c30f93d8a994453

SHA512
ec77d2771481f441a541d38aec143a1a67af771c6481e737661f42eb0dc5d004ed84ae1b3bfcb8f19688147797a28d5b726ec8794c6b5d30f5b712734ed01007

Download Submit
C:\PROGRA~1\GRIDIN~1\Driver\gsInetSecurity.sys

Filesize
105KB

MD5
83dc3cea75f4e280beef4d79eaf7d21a

SHA1
2d812761674f2c8a99dcbfc447a0d8a863a91610

SHA256
12770f421d04122957d81739be60485f15dbd52a5b26106bd7891f090675f223

SHA512
5648c208f12a4530ce5eccb5477e406b51358ddcafd23a354d5d56710d61c1a711830e866879604720e95049fbb005e9d34c0861fbeda4403cdf2846d1e609a5

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver.inf

Filesize
2KB

MD5
8735aa35328a538c3184bd14ee15426a

SHA1
3409029a5d4fda513eca0bd9950e9c11ed371024

SHA256
4d726efb201ea421b9a08b3a9bdad17fc2016084fb8ac4b2120cf81f62386848

SHA512
27b7cf0bf1692e4829eeadc8333c7e4c3c7d6e5b280bcfc44fa952550de4aec4c5f7ca4caf9732373275b39692afa206956f0cdc64728db7913b423c06b8be78

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.inf

Filesize
1KB

MD5
88d3fdf585816a72d90ad1e2b78ef3a3

SHA1
18fe9c3d1e7916cc23f2638ee7327d44202a8464

SHA256
89173c7324696d2d38c3e425b3d5b36355be14ac4604dbad7fb4d6479db599f9

SHA512
9c4070bb42f5211b6aff85ecdaa2bd0f24002e0ddaa7958e76f9888e8cab61656b033ac7b32c442e6484cd58d45ca9b4185656749368d937e973b041082cf959

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\afrikaans.lng

Filesize
90KB

MD5
4f7672da725e031424c9c875694fc73b

SHA1
9cbcfaaabfb30ac4bfc4377e3d3ee19725088a95

SHA256
5132b8e7b2104c8fe1c1d4098e97c1217a68353eaa2c33742a7e9ca5746e8f0a

SHA512
750003c02c224537eb533dd5f6b792eea452667c06b14c24561377af014958ab538e351e93cb96d315e316738d26725461f79e68827ac8a14c9841f9fe0dc582

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\albanian.lng

Filesize
95KB

MD5
6bf32a2c2a882d12e1cffe8ed6f69f09

SHA1
85227a789a0a97b4b97fa8e7a73bbd6c7ba7895c

SHA256
45cc241d1628afd67283d73628a03f59f35c5d70768321189b82b92ee3228f08

SHA512
4b477e233445a7f8a52f75492362ad1584dd9b7f72634155d662b6d6e0033a3cb1408ca9afe2bc082a0126e92a791006486c85b74d028878284d31f78fcc05e0

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\amharic.lng

Filesize
115KB

MD5
ce2c38b7934a943f68f20f0a00a67d70

SHA1
4d5dd21d46c818a2f2437a691b070b47fefcdd71

SHA256
bfb16afa5a7f682975c5b2be782ce5906a4aacfa9a40d55daf0cddf6293c88f9

SHA512
f6aef6059addda3161be93b8de8594bdd21e40140231e205cc3ede8c5e104fd6df9d3505ff98388f3b3ab2eb91c5aa5ff564aa8a7f4e152c7906370629557213

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\arabic.lng

Filesize
119KB

MD5
6850b7a5bc81f105c76e92ad3b10cecf

SHA1
cb3ce39dd010aaf7e81c45fba2a303c929e9e465

SHA256
63a3ae1ca5fde6b4a0f043a9c6dacceb47d8d2baabbdc959a69716f52f580a7c

SHA512
76c840650895faa8f223025fbe9bb2b99fa788389683272a714a67885e33bf25b648b7a68e62973f83ab767af038cb0b73bdc0f2355226ebc3afe2bcaa104c9c

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\azerbaijani.lng

Filesize
99KB

MD5
cf05e2ad2ec928f4bb6da69b8f47e9d2

SHA1
bf7e8388e0301c8bc67aea34aaa77a89dfe9abe1

SHA256
627669147b205dccd9af96c330d62ca5b7b0d1d3e82da0639ed469791b15e8fd

SHA512
f9a49177665ec42a0596e11516421c865ae554fedbc41ff2e32bff8588042a53dae83478e27eaacf2896344cfe6ef6f19129dae70ef4fb6b21b8d8013020b955

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\bengali.lng

Filesize
201KB

MD5
9d985560375ceff27447ee62568a6f35

SHA1
ed41b797542ab1a8b88173854070337c74825b24

SHA256
222f4d83668b913cc43731a23ce3d89e0dce407015372beb3376cb995de76b5f

SHA512
a22b19a6c7cc96974a4872813c05886dc7968e800a82fecea11c6a3d23bd841459ef707c6a2aed953d22e11042d61b03c0596a3d18b9a09a24ea8961d3691c7b

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\brazilian portuguese.lng

Filesize
93KB

MD5
d73ac2ba49581b41e4a8bfa365a41fb1

SHA1
dff1f58fabd4eb74d7f42aea74b4dbe263ef5935

SHA256
1b73306fb1ed3ee2ccdf03b2ee05828c075d9a8d8b846dff4d709d218322ac98

SHA512
6fb37e79d3d9fd2454123744885527466730ab1d3d91342a5138a16d504f76267c3142ef1d274e5ec0a847e96c364e1591c54977da9e875942e77d833c8e1c39

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\bulgarian.lng

Filesize
149KB

MD5
b47436f40d241be1f85fc1026c900f7f

SHA1
be7ac6144425b37da62d34ec6c77425d862fb31c

SHA256
dc35e8d33e0f859ee61c02fa5804ff3dd3023e635e559c6a19e3b2400e5dfa4e

SHA512
d31263cc2fc5e4981703e517d406927e30aaadb56f41b4ccb89c914c67a3a8c3fbf0c362b83547320e8cda799404165e332b7d84a219e9040e2272960164042d

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\chinese (Simplified).lng

Filesize
77KB

MD5
182901a5222405d7af25c87ecb2d8091

SHA1
7394202771c16d86a8224d69fceea91d544d82e9

SHA256
c6fcf6fcbcc98de223d7e9e8cb76fba83471ebaa7724e48951c7ff3c8236054b

SHA512
516e3ae8d682bc99492aed2c7445b925993a0c857cdebe6a8a8b3a72b7827b2e8161df92decf7d08715d8ae9ba2d55c257c1c23713cb7bbfefa4308b7f916939

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\chinese (traditional).lng

Filesize
78KB

MD5
1f32a5096389ec561ba8323748e499d5

SHA1
5e050c39350233f13246ea440a4a085fb1e71401

SHA256
c77bc0b421f21436d54de7bd478dc92c72caf2d236723de68ebfad93eb22f9a6

SHA512
a38d0fff91b5cc416d911cdda4eba4ec82596ac509e18feac5b566ea368a6efcbe51d78cee088a2e0dec57e0311a5fe18cefb5548054b74af7d6ad0f5634bcb1

Download Submit
C:\Program Files\GridinSoft Anti-Malware\Languages\croatian.lng

Filesize
91KB

MD5
b115a766b1014992a5c9ad5a62c40d54

SHA1
03c8fd77c658c9997504d45c03c8c0a5673d7354

SHA256
dcc6b8ce8c82a136de033a3ebce987118b1a0412d8217a2298ecfe2ca2d5421a

SHA512
70240a96609cf2f9b2872a0dc76d0a9a47746834c1931a3f91406ff03b11cee1b86eac6868a4afc27cf2c91438f37286ee173b7af5227ff9f912f241944e01b0

Download Submit
C:\Program Files\GridinSoft Anti-Malware\gsam.exe

Filesize
25.8MB

MD5
0be0d977b78c5d97d2ca20079b2237d9

SHA1
eece63dc96534ebcd82a4c39dc63ab0ac9acf605

SHA256
01b0cfb83b7f94c92fe08790637f034e1f8923eb2fe13ab9489d169d72003d2b

SHA512
2ecffeb7c807cf5ccf97d8aa07f674d9cb665dfe55adde8e742443d31959fec9bf3922df7d9ee3d02c12a43085ab046d303faa5b71e389e069112cee7824fade

Download Submit
C:\Program Files\GridinSoft Anti-Malware\libmem.dll

Filesize
255KB

MD5
a91ad44260cb64a971e60ea210d0f9d6

SHA1
3683ff3248c65a19171e4503a13a278adfbc6288

SHA256
8193ef3964ca00c84811aa5baf0cec652e8c89eaaeeadfc5763b2b7922f8ef7f

SHA512
dae0c6e013d3bee715fa060c82afa9e4ececfb69e25ce6842ffc7e044a38605250d3f99aa824ea4c5f41bedd587e99829bd7f664f21f0efc9ab577c078be2460

Download Submit
C:\Program Files\GridinSoft Anti-Malware\offreg.dll

Filesize
74KB

MD5
1eab65173f446a3e116556ce53c7717d

SHA1
3781bf5a8407d7adae6bda741322c13e4e124588

SHA256
54ce76e23156bdb9873014f9da22c023339ee3f1e5a3b7d70c1a9e1016865a50

SHA512
c98f92ac82ab90dd4121860a967a986d07ef848f8d9aa3a5c107857aa78bdb2c82fd62b4731e18dffd6b1267d0e9ddaa940273611158f28fb9aeca74d8b1c415

Download Submit
C:\Program Files\GridinSoft Anti-Malware\shellext.dll

Filesize
1.9MB

MD5
eaa7432098b7f8916a9c59bfb16b295f

SHA1
d910e9ce534687ad6d4003267a148287377070ef

SHA256
d361e1956a02c19a8ce967a9f0ca32d50415017971220115b8b4b6fa22b170a9

SHA512
82e85ec67573757a4e115b367464d2269a9a3259f32c50fecc1689ab8e3b56c17c2906cfcd313c6b9bd6c4cdd52aca4818a1bfe63b43fd9d1197f4eb4b86c2a3

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Adult.1.dbi

Filesize
4KB

MD5
6c6236f58cb1aa8648350abdfd8f71ef

SHA1
da8739e8e88a84e8828ea27c6e9277dc43ad28fb

SHA256
5f17c95630f74d32b540b68df38fbdf6d6a5d6ba0db13bdf6a952433655cb4bd

SHA512
94a8ef6c5b62d3987b1e4ef7a9311c966de90ab36112270de04715d8dcd72a3dcb731b81ff67f642c313f92a923edbc64b240412ba0b7fac7f7998f6e8b62ccf

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Adult.2.dbi

Filesize
320B

MD5
be617f189bddfd82fb6d3605964ea7f8

SHA1
700c091d08b24030a568bceebb6abfad6dfd93c8

SHA256
a90747531a89ed9ea5a62a97a16c7ff3503b2fa62607790a7cfaf7902efa96e5

SHA512
3cca80a0b938a11ff329eaa7378c545f0c142989018e34cd1146a16e07f246d590d915a43844fbe299a2427cbf19e9c44b1a88226e2c216a475fecf84bd677c2

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Adware.1.dbi

Filesize
172KB

MD5
a53a0111f5f9d700851bb9f3a76139d6

SHA1
6416bd6dc1fab59b4924cd1d505dce63f3b70247

SHA256
3937bdb8c0ee10011f9a452a6bed8cb8f386b95092177c1239d389f9a2ae1993

SHA512
69b03170a6356611d3c527e31c5ec116d18ff222a89b5f916b8447e8a89fd03695bbe836bb905e20f63bfd6595215829d72a8a1889e8775d489d4cc276b2ba19

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Adware.2.dbi

Filesize
3KB

MD5
7d6655116b925db3c5c19cfcc52d63f5

SHA1
08d778a23ea289b9cea4821b1c8d79cce69fcf3e

SHA256
48b62f4c9abe23e881fe1dbbe03059f43a2e2d57057d1d0b25710901ccda9a85

SHA512
7ed71ae77e46814c0b6b8ea31e15489d405138725be2e7c0b30cbebf5d2795f7a5dc78bdc4a630b47bd712f99e5401113acdd27c55e2f05deaa3dbb5e3972dd5

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Adware.3.dbi

Filesize
220B

MD5
49ddc645e474b79ee4aacf6486d3672d

SHA1
1c7d7f210f28e5af78eb0276531f7e74d7b752a4

SHA256
bdf109c5eca490816594cfca4519bb99b9c2c1bbce300cea1a46c5fc93e21a09

SHA512
e21445691f8097178325a13bb191f027f4dfd5fed9a472c2d6c500b3d3812639a9eb1b1619e0f3646284ba629f0f12fe4877f3f712d945d0d38628cc51dd7b2c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Adware.4.dbi

Filesize
40B

MD5
d43980eadac153d600783121744c6ea6

SHA1
58769e88e7e2a8df5e62a97d2ea7a192edb8deee

SHA256
8c83003393126e0388c8a0865d08c991e65ce2158a87b82d65d169612e1d577f

SHA512
2b8cf855d85548c60ae0d6d4d065524338ab8092f5d913837af270e74ad16beb6446182b435de866e094288e8cdacf3ec7b398beff1449e04ef244b5840a9eed

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.AppAds.1.dbi

Filesize
20B

MD5
3c73bede6425032494daea9a76cbde73

SHA1
28037184741b7643363be97c376f7f04998584f0

SHA256
8a13985aafca0527d2ea1a8106d7d3eb42ae98a892df8a451ed7eacc2f30010b

SHA512
d62a419ad8034046927e34ad3f5bd0f58458cf2549afb01e0c91baf11729d49927682fd3e4518ee59fcd9815ac1f62cf991519eeb16582a6b8debf65e7f784e2

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.AppAds.2.dbi

Filesize
160B

MD5
1ea9f5108a5706f79ae822ef2b2e3747

SHA1
b84bb17c0b4305b9ae3e675c2aea44a5f4af4147

SHA256
f1580df676fed1de6eef439dadd83c3246d7b92b4e5d0172818d04ac5bc87dc4

SHA512
3936a38cdc41726d0110c60af528ce149bcfd9468982f22b17f27a9ecb97130339f1b40c4dbdf38a2c6cc50ddd90e6206135a757bca53e4cc657ebbadf32cc00

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.AppAds.3.dbi

Filesize
20B

MD5
4670e0db3758907e17c7269d76d7b3a5

SHA1
668c0a10401e2cdd3b62abdb9773ddac496b6ce5

SHA256
da0ae6942b4d542603d1c12aaf2145583bda2b65a3e2f0d66ac64e06079285aa

SHA512
38b2a97c7317072dddc34cbea4a5a35113eddea7229ee348dda42c53c7ab6fe0738116217aa4a03c000484f14583d651bbe9d1b2a10c84112f24f64866388cd4

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.BlockchainCDN.2.dbi

Filesize
360B

MD5
c9c3d0d8c7176ba8e6fb18201c7ec0c5

SHA1
3a427e1545bac11d7a4494a098b29a92614bfff3

SHA256
6f81e992356794dfbb5cfb46de0bc264db82f005360d88b5e4bcdfae96059ce1

SHA512
f3fa805a052dc90183a2d0ad90040c86ec0b8c2c1b9a91a2f83afa1b9675a35bfc9a8f96f42b7fa5542106f33c8d4a54c9f93b1e3b41631b2a8f4de9ba6d138c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.BrowserNotifySpam.1.dbi

Filesize
225KB

MD5
d78fb990eba2ebc9490094d95a5477c6

SHA1
76e63e673edd6c9e60420e80eba0caa2cde73e93

SHA256
9855412cbb02be5fdb54d0960af3af6babe8c0fc52c1c5817c16cda9967de10d

SHA512
555fc35cb80fe2ecefb0be2608819c1809225f735e9ac17d12f447f2f2e4918c88504707bb43bff60691ae5279710bfacacfebe768172eb2acdb7113e7efc97c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.BrowserNotifySpam.2.dbi

Filesize
7KB

MD5
e100f4d1e4f13e1c8447f0520ebfb10b

SHA1
8be0ba96d4e5cbccb66aeba9100de8f46e42cb1d

SHA256
fe3d7ad20c5403922c14452340864e4519fdfae622614e3a574fd07086aa359a

SHA512
4bcd7560137bd729e12a3cd960d375458785aa26368b30178a21529f87e4128bd2a2048908785a29f3ef4904b7608a6c7495e8244fdb47179fa71dcdba663e09

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.BrowserNotifySpam.3.dbi

Filesize
100B

MD5
74ab0f36053f1f1f570e7b0227cc8184

SHA1
f545d7249fed4625c2100a0e59220ec26ce1f5cf

SHA256
8c2b253ace06c83ed204df46e3a6f3bdd5fccc2b5ed9d71017ea979529ec365c

SHA512
4be7df2537c6385c0f16cf5385a5899c3a56d6a0e7bc4361ff4063f4231522b6f9e1f060b7e6962a4f427e9d2ddf63a44f2f1d75cf6ff179e8cf0fd379add14c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.BrowserNotifySpam.4.dbi

Filesize
140B

MD5
4a35e47216014e639a5d69f1c8cb5903

SHA1
72a0ab0f6e4ee26b00826507b0ed1cc2997a08fa

SHA256
1ee90be584c8e2665f95c2d12b16b5e2b97ece38489d515e208eabe49972a728

SHA512
7b4aec3992e33a72911effe6e01046d926ace9222d41a7a47f814431df5c48bf01822218c2045ab941602217406a53be013ae51fd9140a0ce4ab55d7189c055a

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.FakeInvest.1.dbi

Filesize
164KB

MD5
7675823cf6d0655dbd58c65cfe668865

SHA1
a1cc444d07224bf1f436b0b6869453caf6642a46

SHA256
aa977cc22a9c6ae183c2c9c938b19132e5f4a0d641a4f924ad8eacf453aa8c55

SHA512
81a47f4048f5b38d3dc11f4999169714edb01be44d9b7c97d6c5b4e04a95e9bf7db11f539c0901f76c979a25f2f39fc1ff019810a365a34f10316ab95a76cf4b

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.FakeInvest.2.dbi

Filesize
21KB

MD5
b7ec7aaaf226ab9f2dd68d728ffd3d66

SHA1
719300a9862e291f8184f78070ad70afdc2017d5

SHA256
a5a56fb553420295efc6f89d5fa541b94404ce70234c754c78f4b54c3c5c3178

SHA512
344e53090c61ba123eca225a7a668fc84fe754d9c5cf0e01c1baaeb19c5280a402ef48e6179768dbaeeb7759fa052343e3f12b0636c0e7ec534f2905dbc8870f

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.FakeInvest.3.dbi

Filesize
420B

MD5
4f83f353e85731f6c137371d18c48dab

SHA1
35208efb47a702e71956d55f1cb8a3e6208c0127

SHA256
b7d5e016c4a9111fb15d4b4305b93c7f7174b6303c8d785a8c3c65c581c194be

SHA512
78224bcb8e1e08996c6f1ca9d5a49b5a494e8b7805874a6a29b28ff6a8cadd177fc38173b548096fd967b0a9e18668179033b4d998a1f90a0d38b6582ea3951c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.FakeInvest.4.dbi

Filesize
40B

MD5
c4d032b49266de3c8f0b7c87ee352714

SHA1
d6a9de6a5670471f758170aafc280250aac8db34

SHA256
4cd39c908d9bec450aff2095242935b0843a3f32be7e041ede1f7985c0af2618

SHA512
16ffdad1dbd184bfd4661c5e378394833db2639fd81218a6a9e693cddd4fe1e8422fd57dc2ce94553dc589d9277dfa400acb7de3a1a6e3dcc70af9c4a99897f9

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.FakePrizes.1.dbi

Filesize
3KB

MD5
03fba74720a548ebdea6ba62325c4d38

SHA1
d2df8b3f6206ea434f8bd0c5a20fa0d01ef6dbeb

SHA256
aad45ed83377e71b27e0ec3aa91e0039f38db0f2c21323bd6f89c69a3eeb9fdc

SHA512
6598fd9e4cac0bbc43447aeb88f6f78d119478ff6acfb2880157740ec4666335dfcbdedaddb5d6c53f26b46d2172cabc95e5a0685933fb956c4f46e8da46b3ca

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.FakePrizes.2.dbi

Filesize
480B

MD5
f6684e89ab5c3fc712de472cdbada0f0

SHA1
d48e04f92d14a0a98894b78d26f2c6b6858936d3

SHA256
ea7854ccbc3f130517ea8e53040a57161229c919cfee781e5372f3a908a83aef

SHA512
2126ac6a8beb162f546bd4691b19c6c11222a721e57d6cf6cd8f66169688e787865fddb4accc9030800d2dc989ab7f8a8700e13d5118a10c79b3efd1a2812d4b

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.FakePrizes.4.dbi

Filesize
20B

MD5
8389745dbef4fa42275e45ff2574c81f

SHA1
9f92a027887076d712b5b2e048c2f76ee783b9f4

SHA256
dca1127c7022e83967f1396237926bf472768b97c293eeaebcbb088c9caad49e

SHA512
f3d0839f5a892ea2ec20f6d8fa59e836a7fa62c4b17604dfa352ab23c2e176e3b70fdbfac27213309a385e25364ddbb8ef1b4bfda5df5d460a2f06983da38289

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.FalseHiringScam.1.dbi

Filesize
1KB

MD5
02328d1583891a499195a7e14297eb51

SHA1
f476e8c7563ad3cc579f997112159c8cc552141e

SHA256
538e6ebf349b64d0ce51899c63942aaa8daaa83c5d8bbb79d482c1aa821c047e

SHA512
ec8bbae11c83a89e7a15bdc14b666531da6c9cfe2e5d4547c96ee578fbc6daecb43e2484f986223c4c3f86bbd319ca8100e6acdeea7cd1de7491be27435ebb8f

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.FalseHiringScam.2.dbi

Filesize
40B

MD5
7dfa0761febeab81d5b61eed42a9df99

SHA1
c03dfd84435b1577de7cba594f274984382e6e02

SHA256
421675111589508ce3b7a88f66362aee5faae4e2ed25ce13016734a1e61092fb

SHA512
820dde84502011ae27e186f80917893e3bc3add28517182480a3bab3e21b228cf34e96f57a48eb00f3a87dd0d4975391ff6b9b50fc6b0717786e42a6ba314cec

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Finance.1.dbi

Filesize
283KB

MD5
ef50d808fde3b1d553b82711a691db34

SHA1
5c7a8427466a19ec114387ef278662913710a4b5

SHA256
5cd058e5001dec32de15106bffd602ec3be7c3aa2792908d9b071ca1884f126a

SHA512
0bde6ff3f6378d9b76680b85ab2763111849b3a0168634fcef479114fd67f606e243c9a98d42ebbc76a8e55b1d3b410e33fb9f59cc298fd8c83221a85d2f28da

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Finance.2.dbi

Filesize
14KB

MD5
5fff1869b971231fef19819d6eec7c41

SHA1
3b0c6b96591f49cd3a89a806558e35c86e99e6fe

SHA256
62c019e083edae7c932139703117bbe942e373bbb358056536c0e9c0ca1e43df

SHA512
7e6cddad326d7089d4d0c73e0d5ebd02849e4959a966cbc1cea84f8e48faf1a25def44e920c63d607d6a7a941d2f56d1f1f78f457d2c739ccb36167db838eb94

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Finance.3.dbi

Filesize
220B

MD5
19ab5e43897f8d036706ed872417e949

SHA1
4e27507c9383d421c42cdc4f49900f8841a551f6

SHA256
f39e09831b0917de04b7e731bd79c2e8257f3fd7b2b8b08a72dc1f30daf54200

SHA512
3a46cb38c1e0731b4007afe244a90f35f54117a6156d4a0e9f8820736754a75a8f3fb1129be8369396e4b23a4100da07210b39ff1f1505c62bd4b16a95003924

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.LowTrustCasino.1.dbi

Filesize
94KB

MD5
d9bc1a9bb478fc4a3f577cf84ae3315a

SHA1
2c4df0e78edd2245476afab2c00ce287a89dad3e

SHA256
75cc6daef689b585dddc1f9b1ab5b8cdfa91ad6928c5379123d022e47e482e3e

SHA512
7e08f4c8c31cb17b47adbea09b1f065670194f0189084aa2df4ad9e3b7c8f6f95a1590c8cdc137bbfaa00aea84d692be0e996444770f6b705393993d53ba33c5

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.LowTrustCasino.2.dbi

Filesize
3KB

MD5
36254d6a1a8c6fee4468f36937307cd1

SHA1
51a6faf1f9857fa5a3ef3b2c8d1bd2017abff849

SHA256
68953fd88a8bd536a537ae184be11d3b2a081c1ee7a047191ca955080870b87d

SHA512
cea81f2652833cab1a3e2d4929721a8f0da3f5719340b694d7c47e8f79ee0cbbd6f04b4d05135c8e674fd870a8978d5f038a3f4ef836b20f555f3806f068563b

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.LowTrustCasino.3.dbi

Filesize
80B

MD5
e48428bf0baaafae9ee48a85029c312d

SHA1
0b4fddd9e9315990a61246e459c5821a7af1a6fd

SHA256
1f60743a03f7e32f24cd2fb9aae2025fdd60c9574caba7192ec714dbeb95a967

SHA512
6ec9fcadb18f4ef199189e64fd3d195f0802f28b51efab7ce01824602da2bc6644cca3aeb5fa05fc84f07512c7565200b3200c35135ed36e0d87f1af6d0d05f0

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.LowTrustCasino.4.dbi

Filesize
20B

MD5
8c39a5de7d7b009bccb5239565cb7988

SHA1
34104b9573fe0067373934b55fbd97aa9f96f5a8

SHA256
25de669aa8870e2a3afd1444bf38738d0e2fa63ee1f6fa4b01867741a40766c2

SHA512
6bb8365de68da00a1355c3b44a32ff43b0adb69de3c144cfc06560b9f6ea717ec1c5207b4c16e2a496c21c2cd945e636162e530143ce1dd3cf3dc8cfb9f6cbd4

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Malicious.1.dbi

Filesize
1.9MB

MD5
b0b46532655b635436a06ea27f73c1f7

SHA1
f23ab6a34cdd1a0f568f1766b1e86e3cd086e035

SHA256
752f5652eec04d0046c69f68bbb97e1c65a58d0b8e28e483c641b296ac3b9b83

SHA512
cc088e3f5d1db13251abfc68f0e251f5cfeb506d0f2d33537c8a2d184ae0b49b3902666622b665190fcd9fe8e37db4c57db67bab658d5caf73316a4f2eafee11

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Malicious.2.dbi

Filesize
584KB

MD5
4d5f094d860b0b007c6a166d7fc2fd51

SHA1
b724d0596a7541979eaeece07c927876c2ebf011

SHA256
669fdd9ea8b90842ef4de695c0718e7536f7c19837dad0de4e28173bd94e1bc3

SHA512
73d56958f2b7131c3a936f3ff6c0b22f7d5b3a3f991087d714cd4e9eab5a0fbe5e9e3367f0901044f60535499b9c3aa01032e0b3badd666199736bde77d0d75e

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Malicious.3.dbi

Filesize
70KB

MD5
6ab45ad78cf333251e73e9386cf5cc57

SHA1
d7e544fd0d74b0e2f21cefddfa4685b72b32dc31

SHA256
e9230f0eed64fa19a85c04f1ccd5f3c13b9a4ca17cdd4b12ef80ef915bc2a708

SHA512
3e63adaa00b65c2c39965ecec2fae789cf57a967570af8ba3f2f6487db935d8527517217e4d6606eab5653b95b806c0a93256ffbc09070b9534565afbc7b6ccd

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Malicious.4.dbi

Filesize
57KB

MD5
f9e4da6e1e9540eb08dfd85d7a548a79

SHA1
6af46d6c3ef1c5e66efa34b28c4d37248abc1822

SHA256
bad7788246ec2abb7ebfd864bbeab36e95bc2659f6ba11d2c2d671e18b4e4f96

SHA512
1716643b67f30522a1aeae2a058fa99e61f0d006c929637bc6e887471706491273db22c50d54126b98f6ef9ddc6e314742e6b04f6b71e2cf0b594a74a0acbbbc

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Malicious.5.dbi

Filesize
1KB

MD5
64b2d16146775bdaf28e0f72b0efc16a

SHA1
6bd1c4497ddcc98a531906e9e2859da4de37f3fc

SHA256
a350b95bbb74dba581954796de5021fbb3bdb2a980b2b95264687a11b018a0ef

SHA512
5f7349bbf2f4acbe808dbda8943f87881cd4c60ce0ae4ca63dca328fa3011ef3a9e0a29d79fe12029a3d57a3ea168ab90100f6a1d6e36af2a1cf8f3dbfdd16e1

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Malicious.6.dbi

Filesize
340B

MD5
485aaa13f385c96dcb651630263af113

SHA1
66c36fdddbd81504c98edb8cdfd5767d47199144

SHA256
7f289955033d0c25bca835bf4d705f5e2efa94880862694ca10bde01f2fec109

SHA512
8a6f1695aba73f48b28bef6f49ce174692449186961f18dbd69415e2c475074261984fd5f21a23db8c986bdaf2661cfe3b48be79dfad63e5a8abc0dab705236e

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Malicious.7.dbi

Filesize
220B

MD5
5263f49267a7b9e7dd05b9d70d83f5c5

SHA1
556f8bd2dbcfa42ef3780a35c252a05aaa8065d9

SHA256
22f826cd4a38b7038829736059dbecf1aec1e8b470fa1352cbb460f14fce1280

SHA512
990fe24b333c8dc3b978a60df53e8e08fb6ccb894e9753e86c997cf5f8dda4135896d411f6d8152bf22db6c13838b408c4aaaf67ff90acd71a5311052b56c94d

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Malicious.8.dbi

Filesize
20B

MD5
4e27eb5b2628e3a755da7c6e65fb381c

SHA1
db4e237a71a8e5900c9d54ab87c3cfe5bf2e80c0

SHA256
780f82fa69b5239fa948efb289dffc072707d9c305ee299e056d8eda39dc2f39

SHA512
29627d195aa3148532973df704f92ba4133111b9704f510a85cf2cf923ca24c8ee64ccc594833f40edd5f8868c9a30f7d0ea91a7544ef94021df38b054e0d6aa

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Malicious.9.dbi

Filesize
60B

MD5
0fa35dd87cf6047946d5f87be9e4d298

SHA1
49958fc1e156c038f8ec1fe88f84b0e9e54abf74

SHA256
07423ba5703d3c24a52974e33163ea771939be6b17beb13287402bff933372d2

SHA512
2987d451d85b16e186b8c93086b4107616de51402ab8df472d42ba707770c47225d40f5f81f443fae78259a30c3c85c261e35044a4175bae264a3240a408e3ec

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.MiningPools.1.dbi

Filesize
93KB

MD5
03bf3a19dfe36716ee64f75999ac0839

SHA1
d6ca3fe326619553485a20ca5f6cd3555377961b

SHA256
8b882a1e4a7e3e36521458726cc1c78d6a27dedd59414a5d576feae6d977f755

SHA512
c1ff3bf52dffb92818e6c7e56e2de154064f4eb2b7d44e3baf88e3852fcfc5648be31ed975050642b1654a5086fbe4fea5661bc32fc607c09bfd17b89dd86209

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.MiningPools.2.dbi

Filesize
4KB

MD5
f3de238faf57db881bc306f04a34d83e

SHA1
0af35abc1ce36a2c78428eff282b55e9439d1ab7

SHA256
9f8cf6ac9e5b42160874bcf5b1ae1f3d95b46beb81c6888a7fe116b8fadc837c

SHA512
713578bed36bbf4c92d22886f779ba083fe3a2c120cda8f596501ae82f1db01fc6d406a22c04c7a18ff74b96591f9ab479d7291c2eafe20a7a3c70a427e49196

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.MiningPools.3.dbi

Filesize
80B

MD5
6a0176bfc1e427f39ef69d0d4d8c5dc6

SHA1
c2026227a518f49f868685aa9a9d52a9ec55663a

SHA256
99896276f286af79b54b43b2649046e5e28ed568e0fa4bc909b1572568166cd7

SHA512
f6c50fe88b083b1fb976db197031cf43b0dc2ea0b0fe93289d68019da18bd0b607e73576ebb08dfbcfccc97776a8ea08bc16f7d418da33f5a8a07898475513b0

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.OnlineDating.1.dbi

Filesize
5KB

MD5
61a4dd00e0da962d0f2c844c61eb72f5

SHA1
9e2d2ed9a1005ab994e978a02b7144526274af7f

SHA256
76c4ffc460447568d8497ad20db1e682d3ccda1276061920dabc986ca3876d12

SHA512
df32574887808187bb5889c6871c1cd359d84f99caf976c71c5e04be4ceda6c6f62dbf01d1136260889fc832a4c2bae27d408745080185259f83e334d3a0ea3f

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.OnlineDating.2.dbi

Filesize
620B

MD5
d12efb5720ad1fc295d18cecda5aa9c2

SHA1
8ad57d28552d00c1d07ec093442ec98bfc98391f

SHA256
c7f94d5934aefb476a6addfdf4d7db27b4582f2dd6c56d8e41797cbfae54d1a8

SHA512
9f583558774f0a5d42d8e2f21d22485c60607b61ff7594d305fad1365a706f3264ed28b628db763033d152296cf33ec8b9cd32c6f80905acaf4c8d1bf48bfda0

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.PUP.1.dbi

Filesize
15KB

MD5
c96bbe6f02297c06a9ed47b5c67b940a

SHA1
7697da7a58495c0862ef319448642dd8ccc481b5

SHA256
a28570337e439b0a1ffe7dccfd30bc1f593f24bde54d8884cb74e58a2cc07325

SHA512
b91b3d626017d023d5eb2e18b7adb94354a47d05b93c4c96d334bd0d456b42667e6d5f4390e107acf2625d365466de24cb61abd2b30de1a06588e98073940175

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.PUP.2.dbi

Filesize
600B

MD5
deeb0e24d4dff94fa3b64a4f61427f1d

SHA1
60d6fad5b35df251b5339360e77e08cc2803679a

SHA256
cde8bc457942c92d23e678bf9b57d89627803cd21cea4b28203901193795fb1f

SHA512
80a754cc9bc886922e53105bb3a38094b9854071e2afcc3ade8946bf4b7385dc126c568364bc9696d2f59c56f2dcc598ab37d5c583b4ec0481f225a4931a4eb9

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.PUP.3.dbi

Filesize
20B

MD5
d8610a905c9855dcc4a0a3b517368e92

SHA1
9490d27bda36419c6a268aeb3305b625f688ac4a

SHA256
8cefddedf1baae278e35b28f61cb7e7a66152b5e0f60e6b38f524c1c1584c21a

SHA512
a74ce527e8124746e7e2d64f751d257c28a3754ea334586e43c6befe2e7eb4a8230e55d8843081102f442160b79ad6984ce8195ab75954d5b5166ce4107bd90b

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.1.dbi

Filesize
1.7MB

MD5
20695056baf7dcb39effa02f682752a1

SHA1
39546a79fde9a285121c8b5e1eefb4f45c4906a4

SHA256
5196e4bbb12de361aab04ba06e8d6ef8e7ac5b384ec1aff3d8644936cbfbdeb2

SHA512
695c2dd0c68621f10517f48aeeecdb1857783b1cffcf087d897e32e264b29f20d7bf93f6ac5e9f1c933addddac0f4eaed4eed18a21476e061a2b29026ec316d4

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.10.dbi

Filesize
60B

MD5
d298bf28df0e4f66595acfa5ceda6937

SHA1
9f1ca0f858a74b6a1ef41b5cdecc9aacbe4a7def

SHA256
e0b2cd312808090e655eb51768ed77f78aa7cb64082add85dc2a08d36f0946b3

SHA512
dbbd1cf53e0847904d1e82ba8b9c355824ccd525cd12e1eb3cdac7ec5e91caeb73b13bdc5d5b7539f8efa141e0a5a88327995f17b1117ab6c50fa6895d5e70b6

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.11.dbi

Filesize
80B

MD5
444f51b97e45183042df4984e28530a9

SHA1
c85196bae8617828008b2a5e098f323d85b7ec25

SHA256
311a3f74830c65cb4fe496a170f948d929e479e911f29556a2385cf4e3fdefa1

SHA512
6c41d35a06489d0fa0598880adf409f0aa26eaad93baccc1c56f0a7c12f42e7bfaa436790168a66466191f492a6cc5d65e97bc64a1168b6e966d4ae604de7522

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.12.dbi

Filesize
160B

MD5
7ef08e4d96c2e9b4657b474af2a5289e

SHA1
c9fb7bab4a2ee2ff5a60fde09e13f84167bfdfd1

SHA256
e60153b88f81b0b370e1a2ab48b26777d8e33e0a47f7421ddfbedec84a9a4835

SHA512
ad584cd317e08ce38a3484ed0c4237e85bb30cb3caca6cae1fd38ae164c10cb7081fa53db4244809dfb0acf377bb7e0215fa811fae2b8f755ffb8dde9dfe59e8

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.13.dbi

Filesize
20B

MD5
4fcd70cb1dc52fff56853bc1801229cb

SHA1
87964110604e76a2db37e0c7dbd5e02603b926d2

SHA256
51baa2c1984c3ee4c03f0add56ab1c2022ed23b4452cc34f40fd2e0b77646486

SHA512
2413429ad65385c3f4935734540d36e7a6158b0d1c51481ab59f28b6c3f4d20f566b0b77bfdc3a3e8ece3944a024ff9e83084146e4cd6151896e080ac5253df9

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.14.dbi

Filesize
20B

MD5
1a17e884ed0b8000f03cada7841ffbe7

SHA1
35c771d39c332bebbeba241f2a68c09c699ef62e

SHA256
fa1b1725ce4190faee9dd7c4504cf1d1e5e7c98eb841c8b15071559bf442637f

SHA512
e03ff02732e1692f8f8e04fa121ef2359b75bda601e49796b28f0016323f032f7491e74c4c812f23a5326d65c10839165c56bc032efa6b5dcabedc2a37077da4

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.15.dbi

Filesize
20B

MD5
b77f9377b16c7068e779c59f3f511add

SHA1
49e3806bd2defade3ab3ceebbd315ad79dc14617

SHA256
4230c251a9f8428922a2be552d0fa4fa8e3d007022d42823108a3236b26f0e70

SHA512
0a728949756621b854b8edac3df1efb1a8647e91d37c5c3ae77ebb82f747607b68381c0a28bfa07f895a53e319c4eea5ea8a03c76b336cd0cb957bb0e1b1bd90

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.16.dbi

Filesize
20B

MD5
c953e423d795320b4e2e24878e377888

SHA1
05a36e46cae9e1ed3e24ee3a0dde2851408ccd9e

SHA256
bab8226abc5992f47041671a39a2f4897c5c1ab502a056e17f97559709f18449

SHA512
78e95bd47bc96dad2aa909352f19e690c5dc0a35d8b751e1b722c7ff4515279b46bd0ac6036e4fee01c16c7e6d4c85a4e9fefdf84001eee7836344b7fd527488

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.17.dbi

Filesize
20B

MD5
2b97ec8423ffdcd71ac02f30e5558566

SHA1
7982ad51b265e13ed062a539490a270f062d4cdb

SHA256
509632c60a899edcd6f6bb86b72b9080f9ccc3e17d69da37f14d07282ecf5b96

SHA512
30b112e1cd1ff71852fa0b297283b1cd0f2ed8583c3fec52159717f7cde9cd397a2a21a6f42a9b4286a04a252e56904722c9f606d511ca59104ab56a60a6dc8f

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.2.dbi

Filesize
2.4MB

MD5
aef1673e38a78444d42f39154d73cfe9

SHA1
3584848e356c80e935d4a714761438092d1198c3

SHA256
8105cdf6fa7bc9b58e2b86f40e7d8d61adb8846bf5fe378ab0bee9b3a8b7625a

SHA512
874ef3b22cae26cce2068d17df045cb429c40cf7f03f0e35929833d4751221578fbc0a3beeaeb77bc0741f03cb33d7f0fe693ebe378522cf886b0e3ba20d0c1f

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.20.dbi

Filesize
20B

MD5
8dfc2ce2e0c3d58b484ce0f9502848be

SHA1
0d4afc275824995f031ae82b008e0424cf84209b

SHA256
856cb6f2f8cf53228c0064e4291fdfa9b06c6a5cdb0e93a8903510ded3211a3c

SHA512
b7363ef0eecf358cc7fe6fa0c24d12a7285dbd3cedda4df6e502f1204650eba526fe4232cfeece759b03ca03bdafd3a79f72000bbca0a60faa36e411f79af817

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.3.dbi

Filesize
242KB

MD5
d6d27d163833b07b029ef88d14a25e52

SHA1
ccf388c5a38fb6ad73d9cca9a4c4f4c27769f679

SHA256
4de173be7893be90c5ac2178e74e4ef937728c89ffe69939962efc073eb1c0ab

SHA512
9c297a2c8627b73155c498b567d4f173141d33ef6f4a452dabef150d28bc781976fc2b542cf969efecb9d2e2828c40d266be05380910789b0bf7550651ade3f0

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.4.dbi

Filesize
41KB

MD5
5b92ae01cbd75a340fe4aefdb420fd1e

SHA1
f5155a311bcc5a7d7984a637f151325867e329ec

SHA256
c6fa20da40bd477bc74b6035741502abb612ee5b9f53f8599b187fd5a544b75c

SHA512
72bee754c01c9b1c4a4957049aabf7bf8961b2612959183951b6f748180b1d26e44853d397be7d07d37a8275fe7d3a1ebcaf23f9d22d9368ef21611eac6c7baa

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.5.dbi

Filesize
7KB

MD5
aea8bfab25db1b05bd23679b9b37ab1b

SHA1
cbec2df0f951c8e8e6ecfada77bb49cd05b10e82

SHA256
0a28d97b4b43c5bcd4437c10a29c5c062ea498245a5ae05398bd80706271e2fe

SHA512
113adfa1bfe3c145af1e12baa7137e0f4ec26508d70cbcaec08ae615bd7d6cd0cc5ab10f99b3565b306e60ac48a1edd564565eb00f3c0110be99ed7160ec2205

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.6.dbi

Filesize
3KB

MD5
1b1e8ffda2a63e8ffed6fa6455b47972

SHA1
77f1d01677ca317b8bd770ac90a123abd9aa4abf

SHA256
b8de00c3337bff9227d8946a8e35f77fa0cb55221892c522fe9904c609da728b

SHA512
b4c7120690fd0b02170a21260674150dd18c164cf62cf516614bffb014ed62be51ed22476c8484dddf8f547585e3d3233ddf80b11c46f4beb69ffe90870b96f8

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.7.dbi

Filesize
1KB

MD5
8dc5488dcc43074f3cef6c304073a0ac

SHA1
2f596ec4a1364b63fa0cc66f5ac30b104af5751f

SHA256
0446d56a6265e12b70e16c107120dc83df19132e797922f6bf6b5bb17d13d576

SHA512
1a6653193b078aeba188acb4c00ce3d843936211decb0416ceccdaff7c70af26a79b4c4f37e750c65893b562b10b8550bf7f0be6b0632df7351b57e97fde98f8

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.8.dbi

Filesize
320B

MD5
ade50f78192d5d0b7d835e9de5fca88f

SHA1
20a49f5f0fb3e4c8411e9b24075522123476601b

SHA256
a13efc4340fc18f3cb2b2a5fc3e8cebb1e8297292ca90cea6e77b1a50c0dae0a

SHA512
d730a848c82518c79b901c14aec7a6c0dd94394e14b6c3c209c68e39afcf78082a2ae821b6cbb14b9387d9bb0dded832440fab32204547224ce89b0ac0d3d9a8

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Phishing.9.dbi

Filesize
180B

MD5
9931de7d6d652e5a73845b8835857cf6

SHA1
4465025076578f66fc6cc3d9163ed6f6f75d5259

SHA256
014ebecc23b652e7a3d30898a54a0572acc2b47b4f553b24f0335d5a7cedc3ab

SHA512
3afe33fe98cf3d501d21c644199ce37d73fde0944ac9abbfcc844d57d6f61605354f6d7fbf14f1d4a05d0378cf643878d5962b542b47bce8c79f5960adeeb15f

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Propaganda.1.dbi

Filesize
800B

MD5
7c96c394f7a4b332e47f58a533a2c100

SHA1
5af27c7fc52c6ebb8bf6367ea425c848c2f1ec42

SHA256
fbc9720822dfd2c524bedb890e7d55ed0e67cdc5bcee1b20d6aaa0293a13d570

SHA512
d44b5ada8bf3d64ed0755c97e88f29709d2a8182e39235aa00609396600c8b732620d6793ade014e7a7b844812d0a4880a2ef8ebac2e97c13b1a9a9583277cbb

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Scam.1.dbi

Filesize
269KB

MD5
7c15dfc65c94ddf0a3f37a22a398f42a

SHA1
d725826194d092e389ffa8e0f75be5d045f40113

SHA256
eabf65142fc88a9ba69c0e1a186e34009918988c0710b289609e04e4cff4f994

SHA512
44e611603ec403f3e645a5c9d68968073b95a7466c4ee220c60a30b7093abef31c3b3b982d51c596a9c95f5d36748a27d33979984cb580f5ce4734fc564654cf

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Scam.2.dbi

Filesize
66KB

MD5
d49d612784b1326cebe0f1bc3cc92837

SHA1
8bf0005c52433530a5e3127758edd66b19b256fc

SHA256
8f6837da937d586f651c57ed74ceab71685da5452e69f2dcb5a10fd6c7edf8b4

SHA512
c1fba4e4666e93f2296abe85aed16a6fa9992547e8a1e80b314e08bde79c83129cdad814c3a6584dbb50dcbec227dac9cee59a7f9d06c08d2459ef473c29133b

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Scam.3.dbi

Filesize
1KB

MD5
66ba7cbf4c2207942bb2308c21bd87d1

SHA1
5ad00423b72f8f2ef5a9b1dbc4614bd45271edc4

SHA256
c6d92ee5885751ca9acc335b085fa490236302eee3c9c1756bb8cb74c74c166a

SHA512
992225c380c1311c978fb266e629830152175aacf32c520b6c8b2adaf14232378eb847fdee8d2c6bf8d070bf927932700baca0c96d0df76650f37a7cc0bfb67e

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Scam.4.dbi

Filesize
220B

MD5
5e96684bf0c3986d923556198fbf1c1a

SHA1
f2f938e3115e3064fab0347959978a4e79beac3a

SHA256
3128af81441a0cd0dceca08c32dc9522d40d600b4cb7c21fb5c11e0fdf1aa075

SHA512
7de5477258ba882adad370eedebd58b6d54676566e769645076a6329b9338f2e9d9d70f6eac42124b75233deb589337f1a55287789245f0bf4c0cfacae76f950

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Scam.5.dbi

Filesize
840B

MD5
2beeb40d2e7b8386bf7d132d7dbf4ba7

SHA1
e14ee1208db4f5fedabb8adfe2a10570b0514ca3

SHA256
ae0d279952341b68ce67f387ecabbbb650eef7fb0e2c8088418e19c79fb3ca33

SHA512
575d1b157a9df0dca0cc0982af8902bb8d5d99f8c80a00bfb4c54c9ccaceb6c46dda2b9bd73f8e6192d7c36cb2d2304f1ee56b7b86d83976ec6f7a3c70616953

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspShop.1.dbi

Filesize
370KB

MD5
b9b8b0a6b34b873558fdf207cf3deaf8

SHA1
c986af70bdbb19d7620e252f20aaa3210631b74b

SHA256
f9092670cdc347c3f3835ef8956f1822aa79e43f9b5408eccb4c12dba9ca9d1f

SHA512
5ecf7e2a6452713551b3221062328189106f71a3dbe5ec0f01e2bb1de5304a9cd4df9850a6818b8cc5598be7fb54925ab1bace568ee9840cf24afa25b22d5814

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspShop.2.dbi

Filesize
40KB

MD5
0dd92f324c205582bf9e838ad6152561

SHA1
8cd4389d9db5bdcf0aa145c90bc08cd9796f80e2

SHA256
ef03f2400e759ec9be0c997b9ecfc1531b4299788232cd4d5221c387bfd201ed

SHA512
4e43830f6d1de3f31d0dd2f4fb0eb5f478f78cbad9ad02e40966f4e837e5b68a353c49c75d536356775d7c110537afe520500ad0d53c15cab49651a0773c1ef6

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspShop.3.dbi

Filesize
1KB

MD5
aa6fa28033b8a679682fb91e864cb25a

SHA1
96346d8c003ba31e3d2bbebaf8896ec4abcd2715

SHA256
7c557cc7ba917cc64713ac9721e830bcb3cc28dce29f12a9b89e1cafb3033f8a

SHA512
18eda8d319fe3b23e4e89f0bec29682a9db5ccc242a8b5f58982d02bf94ecbae811144c5dae0e0d0abb4ecd2378f70d3a13d9b07f5c894b3a6ec144ee40ee588

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspShop.4.dbi

Filesize
20B

MD5
eb0cce8bc6127fc84b0b37ff3559d3ba

SHA1
1b5a3ec872c4342213ada8b67937933f13984342

SHA256
745aaa7c63e87c05e5952e4a8ab8aa742eb9a38ccacb505654875b393a3c33d2

SHA512
1de0c37fb53d523da015a88470a5ad88bd5a93d0983796a8ef74fb24204a50b58d58adf8db23b3b41076c078ed4f0ad67a26d31b9ada0e5224effd748530df04

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspWebsite.1.dbi

Filesize
868KB

MD5
d7cc49f986254cffd8721fbf7eb89737

SHA1
5a11cc44e4961d06096a9b0d55c9f500c0b942fa

SHA256
fb7dcc37ae9f7cf78743597818907162315d2a338e62585fbd4644368a0c0ec8

SHA512
77c4f0f6fa85365c5093ec6082880abba215bd423792c5a683410747682b9e429087ba2c89400c37ea6711ea5549079392dfac300707d0fb960038692ad8d3d0

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspWebsite.12.dbi

Filesize
20B

MD5
50e43a1ec3ceedf8f70b17c068e63f5b

SHA1
1b601166ca85b07969234fa685da94c19d5e58e9

SHA256
3751718cad1fb4a2edb615a6995efe193b112e92a661771770a049e2cc40247c

SHA512
ad5e157415adea28e04d498f5f6322176b57035d92635cba55d5f4f91644445af3124d1061ea1b6f16e7ac6d5b89a35225bfead2006a1275183d9b6374174816

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspWebsite.2.dbi

Filesize
203KB

MD5
e4e248497800e4d54834305f1513bf78

SHA1
3a9d57e5867a6ec0468aa276a58cb4b664257101

SHA256
3fa36947df4338a2d4d69fd65f17cf03c970807537dacecd413834deee908649

SHA512
a13abaff1978c18c925c11c3a459389ebda5650dd70fdb230541337ec88646b600b23cd8c1e718cb5b7a50789dd2d833cc2cde5fd60a6fbf692a51532770184b

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspWebsite.3.dbi

Filesize
18KB

MD5
408b69cfbfeb2666c099e89e897e2488

SHA1
ae4abb6d09bdb2d738699cabc9b25a7aa89ee6c9

SHA256
3bbffe6ba991627a52c314d7ac83521e6ff84763ea54647c7a0dd10e74620cc4

SHA512
e41192a4df5e1038a88c9ca5b1676970618e781cbf0a70bd3a34c8580a4056ba05f7feb0fa2b1b6a34fde18b38a4c7e34810daa3824d918901348f1822149d92

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspWebsite.4.dbi

Filesize
2KB

MD5
92ad99044313eab40fc6ad98deaeb243

SHA1
a6e8b4d317603f2446a4b2f3f18927fa7992ee66

SHA256
bac28e813e885f32654bccc6520e3dc806fbe4953010292d0f50f70604c6122a

SHA512
5774dee1d50786d37e001ef033f58ef5e4b2109ee63d027c31121d6ff20e4a9dbcdbf983687703b7f7d0610d2956ec308d4ba888eefe43e1d1d91911ca4f4a6c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspWebsite.5.dbi

Filesize
660B

MD5
0f427ee37a12083b1370417b3618633e

SHA1
63b0f2b7dd4c81a01af3c796f5e92fe1debdc143

SHA256
1fa52a67089044c1b34337e1456aaf18190e9faefe9b1c032fddd8da2c98f83b

SHA512
09409dc0125478e0ea29736c68808627705c54bfa993564f0f39588496376055e5c24979648c940aa4dcc449f33b1c89c9e7b800b18a4c9ac4285e9627ffb7c7

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspWebsite.6.dbi

Filesize
480B

MD5
1509ccfe52e5d0773801bccb21699f87

SHA1
254dc1fbc4074aa3838145a86077a3f005b90fb7

SHA256
c02b6b2f439e8ffed38dd96bfbbb5216856ef5d382cea3980edbb17af12c0169

SHA512
e1016a836149d7afc330630c4e8038404f276e2b36b826236d28b9f2464e224650afd42e16eff2785a4e67ad490b22cb77e24cad2c80832fe204b303f0f6e73c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspWebsite.7.dbi

Filesize
160B

MD5
be5345d8c71051a4bb81e3308deb7eb8

SHA1
ba8799f61aa19ef12c11e1c0561caa292d2ee7f2

SHA256
10090ffe94a3c26e82e9f84cf4b852cbb74c4bb3b545f66cfa5bfe1a1632b018

SHA512
1c1906cdd6b6ac4915442c07277fd9e75f5d6e8a3f9761db0f2628d852eb3f8aa8fdc025042b9e896291ca399f29730e12b1ab67cd65d62d81ac54a93d62e384

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.SuspWebsite.9.dbi

Filesize
60B

MD5
1dde86ca8a125433ab2ec3049fd9263f

SHA1
d9a2746c604c9a634357eceb0f8a08544140f0bf

SHA256
bf2c023726d85a7349a4738ad6644a643a89913328a99819f90fdb90a371d889

SHA512
46558161d3d9a866050de19cc4ff0d1b6b164385c7f05f8afdb52b959922d9007cbbf31f0293661400a794b9e46347100193081708fbc68399516826a07321c3

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Torrents.1.dbi

Filesize
640B

MD5
9fd26caadd69ba50cc65abdd5f21d201

SHA1
9a6580a489d6649a5679e5aea155c68ac0fedf20

SHA256
b740ca3f97cd6dce9e7c65ce1cd7946b6fd4e2b8f73d224b7186d30a365e09f6

SHA512
9f955e5eb2194a6e0cab1b89b5a2928b7dc26d24a1fd689836553e99be2118d1dab2661d80be6e5f5bfa4adc7895cf6fe092f17cbd81af0464a907b8f7dc2b52

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Torrents.2.dbi

Filesize
80B

MD5
28231a0614d7334972cc4e37f5444fe1

SHA1
098d81146127dee9129bfe3cf3cdd48050db75bd

SHA256
56f987b8d7a029f576ddcfa4f1155e3154b5643aef8c8900c3a9bb9f55c4026c

SHA512
bd75f7672a7a1734dd5ed2851007adca96c152100a1741d99a466e61ddf92795a51a4af5c13eacd282d6cca57d309d92e49abbd2662b6388737227596bac356a

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Torrents.3.dbi

Filesize
20B

MD5
dce5078111cd06c0aea2e8c84f90507b

SHA1
df91ac0a4a051ab187c882ab488dfe1d9a32f521

SHA256
fbefa881aa44548cb3a0421a5f35ec191cb7db42b17911914959fffe63f547da

SHA512
19d5cb7f223adbd34e448b0591ae31eb1144df4a2889d6236400dee6fefc20627555e8d9aef6ffe94a0302adaf9f501972dd30c37e51aaf049e3e735a2d89969

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Violence.1.dbi

Filesize
40B

MD5
7916a55a3bfe712868870a2751288a13

SHA1
28dedf809fc9f5044be177fa112e281e3d72ac0d

SHA256
51584338cadfb885d032dbb4f7e84a30ad2a515753ec7e5c1e68ab7562df5134

SHA512
da1efb08b4a59be52291f589bae7cd9ee7eb63619bda1ceaef0029590657d1897f018373d9db0cf2397e03b51b5abb9f0fe878f5ce3f2218e0bf7f4809cc927a

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.WhiteList.1.dbi

Filesize
14KB

MD5
678b5264062a90f71589f2b1234e2d51

SHA1
332d61252e82c7face891508623bdb8c558132c3

SHA256
f9c3d84c6bc39ceb99e5152b30f93eecc0e58641b6a4e0f6c4c63c6760dee371

SHA512
72093272f9ae7756b370eabe3654c25d4c36877da9fe30c3ba84a88cb4fb93ed4ec25404237da3bdd5265c8464dca23ddec06bf6ee9d89d5d2e85be89fe54f96

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.WhiteList.2.dbi

Filesize
12KB

MD5
3b727dbc149a3b66b6dc32dd1c574798

SHA1
0285c5282cdbb20b15387ded788790582f416a1d

SHA256
3993911443be93edda3b0069de6348b03100e94496f5220920570ef9426a2c2b

SHA512
e8f654e6bd72e7b4ef43277139b5b5b5104c44bd25bad4458b81ce2156219296b3e65edc1f5d76ecfdfbdc8bb624f588256a2e1a4acf07285dee9adddd19f5c2

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.WhiteList.3.dbi

Filesize
1KB

MD5
b0992880d01244513d01a839c703c3c6

SHA1
619d6a087109f54d77acfc56a1e9dfc0eacef588

SHA256
c9a2bc263096021a385fae45583894fdcf763ab989e8c8c1a93da1e4a00be38f

SHA512
bd7f3a1bda763ea092e25d1b7c17e3c7f24404e8520671e1207b60164019ca6033c0ee3314a725049086615d6201ce6fb74a80a4290b2cab6fd5076b376751f5

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.WhiteList.4.dbi

Filesize
360B

MD5
705887a9d781c96b89b7070106efe7cd

SHA1
5749fc919f4b4f4cbfa902f7cf9fbae263e7a5f9

SHA256
7f608783cd1eed98f9143a3902380e3393b50dee27219671a4c68585eb5f0612

SHA512
4b39ff8b561bda95111af5bceb7eeb892b26c597cb37e1850ffee822b4a27df6e91559852f95a8c1205db206e873d5d25360b329ab9465ea7790c31c5c20343a

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.WhiteList.5.dbi

Filesize
100B

MD5
969762afaf6169998b0b44ca187331a1

SHA1
959c395b65513a6d07b64b625229b58cbfa26480

SHA256
1424788ecb77ad0ca9685f2c5b48cb993839492c8f68e9dc1ccdf14bac3ce62d

SHA512
dfab6257435d46d069a94fc12b7e301c49b297737043d9766dae66f113f1d19aacb05590dbd01de58d00a8216d4db26983acaa3ea240c77de551eecebcd65dce

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.WhiteList.6.dbi

Filesize
180B

MD5
dddefeb3e1289b9f97a8df49e40bd8ac

SHA1
cf5d429b24da0969faf37a8adc17eec07e4962d0

SHA256
ec65977de3cabeacd7988c5931e3562e0aecc46d5dc31576c1299a769c570226

SHA512
dee924c2b784665b28a748f0f6da9c66e0fcf2855636e11161ff628dbf5527d99c71583a59d26bb4771c85e8ca2d946a3366c118ee6dcf158457ba43ce667325

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Young.1.dbi

Filesize
971KB

MD5
964111b404b7a771e524b39a875da386

SHA1
7381c5ff19d661f4d8cc3525b0e6e500d341d224

SHA256
481cd150fd4527dc4a3967679e1f0333a4810d456ca4dd6934e71302967ce6aa

SHA512
0fafcbf5e63e961dd1355c8d7bf0391718f273b522f2dec6ad4500669f1a2da508f13a0bb30788818319415a5585a7f02c5ae213c51468a1be3222e482336364

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Young.2.dbi

Filesize
1KB

MD5
7a5b92cc44003def9f73dda6fa50f022

SHA1
0486e49312d378efd2605897bb51aa794bdc3ad5

SHA256
084cdb4c6ca3ba47c26ccdafa3fae46967ebda34fbe4f7b30850815561972936

SHA512
8809b4aa8cd203d4bac53235cf2d052b6688a5bffb99c8e60a0c6def0f0094ea39893ce7de2789417f3978440f2d861227240564b086ea300d38670d6e7e4661

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.DN.Young.3.dbi

Filesize
40B

MD5
ebaeb874c6bd0fdef9f356273b687bd1

SHA1
ed5518db8e58b7f63ef6de7dc7ef80a99fd27872

SHA256
3760dfe60a3df54eefd0ea18d0bfcaa3ba562bcf896a172d9387d1ddd4eb3a7e

SHA512
49fc21e56a3b1a68576a6a212ac3b2558aed750215f12f607f26f88e700d119fc33824cc0be69b5222469e3b3d5fabb00be1c19c7dd2f06477eda53a0c65eb8b

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.Adware.0.dbi

Filesize
100B

MD5
6520f0b612ffd01f2e37db3e30bb3421

SHA1
28713436cc10ab08ca3e897ebb14dd8d1a2463e6

SHA256
7aad94c95c3cb46dac10199772e22a5b466b39c2e3ea80f8556291e586b68667

SHA512
465acf32c6638725541ac0b8da6b6998e8d728d9f0bdd4496c2dc910d794dda10594996f1d117e50831faccd88f48f360687dce76480cc59cc6eef1f86db1bad

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.LowTrustCasino.0.dbi

Filesize
4B

MD5
e84717570a4c3e6a61170090b34adb0c

SHA1
bbd31a18b77b99bd46c3f31f716d66fd7fbcb282

SHA256
f874716b0667f56375255d33e347f301da5610a586cab62afcd2c78c5e25b99a

SHA512
31fec87083e6c2f14ce95107ada43dfd05c0fa9825996b931bc5a1436a4c207770ffa30aef1cf0f6d3d9b8430cec883fa391cb163dae690941c0c81e69be4b0c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.Malicious.0.dbi

Filesize
1.8MB

MD5
f0b96e98b2d86d59a1043c5d45b78b0f

SHA1
026bda9db84c53433b954050e16180eeb3670dfa

SHA256
26aa4062555dea81d2c04603b3690582853fc4825cdaa2dccb52114414efb74a

SHA512
02d7d23e5a200b5f47c867543f0faf694263fa7615e406d89fe605257e669fc1b70b88f2e1a1ef9fcc600c1f54706db408e1ecaeabe7fc3378a0be9130b21f32

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.MiningPools.0.dbi

Filesize
24B

MD5
2d5e15e4f95ee89a498884c9f1dc521a

SHA1
aab08e125dc62717434e1d1e063b09a8557ed145

SHA256
a95316e2ae1871a1535773705252962197f86a6f0549cbfc7195b18052c15346

SHA512
f8df2511186abb82f3a20f3d3601030df7add6781116b39d272ca4c4e238c253af4f1c7799e98ea815a084ddfb4ff2a5741d841dbe8f3701fa9a35833de01811

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.PUP.0.dbi

Filesize
12B

MD5
7f38888fbd4cd6e59ec7d8016f537611

SHA1
704f0ba93c7ffdc972dcb75730356ceaa8b456cd

SHA256
185e5cd8e026adff7ebe1098bf7212e5f7722844b947f7a10495daf5d42e3734

SHA512
48d40bb04261b5467e7ecd3d80a7032cdb6f3442510958e9ba2b455f71338fbe77f27f3c94ffbb04c61fed7cd64590f6f40a0f4f0d6b7cc58e77c72fc82310ae

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.Phishing.0.dbi

Filesize
4KB

MD5
5e9a92a74598f00ac894c1f7467460aa

SHA1
43b1e64d51673d13101981660f80478d58d38809

SHA256
6336b28e8581482beabf4166a1ae00258a1cdcb0db9a5c22ef4cf757b0347256

SHA512
8bb30b180de46d83275c3d3ff1d099bb1939d2bf5c277595099557ac4614049cfec55854a259324496809c756fe8c691ccb7d84b8ef953c2b2ea3e9f916b08b8

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.Scam.0.dbi

Filesize
44B

MD5
a625c7236aac36d48d69498038816f8a

SHA1
451978cde724b6368524d3bf15e94bc2f2b02829

SHA256
997b7457f16553a81f05455e64b21809a24045bd85eb3da861b3aa2c56a18725

SHA512
712614a70c347097c63319d543ee7a9a5236ce9c8105386e85c8199d7a8ec975102951d921ac10a0e3e912b84dd1305ca0f72ab4aa3bbcc72919921498cb6f63

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.SuspShop.0.dbi

Filesize
6KB

MD5
1bd013246bdae055964e5176a1d84f4f

SHA1
e637d21c3a2b366a4e8e1dff833e8a8ec4178a93

SHA256
2bc4ba373ff2f9cf4d3d32c7e246dd97588398b294eeb303cc9b0883e57ed1c4

SHA512
48a58ac209b983bd59c5bcf506a958d191143b62f71f50b03ead40ac1b01931828668ccd52a78c564ff4277dbe6654b5e6dbcca0f293ab42ed99616f99ce9aa9

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.SuspWebsite.0.dbi

Filesize
1.1MB

MD5
9d7e0f14c6ec4e5fa433376d6621d5aa

SHA1
ea514dcb8d06643e174aa907c9cb75e3f813f17f

SHA256
15c6b2f920ce4d0d49488f76bbad510f3e42445f301c07ca2bdc107a248f5938

SHA512
d4c6b27b28d1cd792f6d8bce28a508fec1a32fe5ff173735d96c69b1e6ca0765fd116a9ac66a2ba711b25489dbc04afaf6b3ae10758c2d4679c04fefed10eb57

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\NF\NF.Active.IP.WhiteList.0.dbi

Filesize
220B

MD5
298786af8aad6718c56bdc20b48bf9b5

SHA1
8f4111d04f147f198f2370b8cd3f90fcf4dc1034

SHA256
2b537d2d8e31223448b44e7b362df13137e4b0e0fc3228f1fdabece054652de1

SHA512
fb6b5d27154486dba67a211aeef99a295a7c2a3e79a0077c7f20851f13f2545c0fa12f2e7c95dc42d337c72460bd1b0c805873d49d8f9a4a76fafca2fec7caae

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\nfd.c

Filesize
80KB

MD5
b26e9f51b0868733656e3005c4a448c5

SHA1
2e08cd16a4f51e13c7c348cc57cf890d260e3d6c

SHA256
4afcc9db60048b5efa985621835bc0bb2e2f3fd767bbf0fb455abe9b30b9833e

SHA512
d04d70be57fdec1f5213cb453ae0d4c950d0f57cd5d207eb65f70474807e64674644185555453026834fc7c64a7d9ed40c543a8d3b552331f755923bd3abecd7

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\nfs.c

Filesize
9.5MB

MD5
4aae9cae53ea3f1f585d3a8a54eb86cb

SHA1
760b6ee15450fb4431e8efa00160407fd26ebc5e

SHA256
bc927f0b91131b72aed8447479feb0ae3ef6ed189dc46f3350cc78a7a0dcbb10

SHA512
acd1fed2e799ff1dd71c20831850b21b8520e60acada3eee7615719c0eb071998bf53021746cd9d68c2e26d8c070e5e469f48e112f028296f1a9b9d140eb112a

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd001.c

Filesize
2.6MB

MD5
1bb388d9a7755994f046ff3d16daf21a

SHA1
2d1f42143217bd390c82d700439cceabd1d6dfa1

SHA256
5977a95f4311d124be13f34b6bc0f994c87c75ded7eb9439e36a26f373022bf2

SHA512
a94c281c2728407cef04223733c2bccd459d8501365d0de1b90acf0414806f370f5ae180d67b11a6ba79829d2046051426db95623f408b740e79b32d0b4750a6

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd002.c

Filesize
9KB

MD5
fd9f1d086093a504c58f445cde02f1e0

SHA1
7a90b2f42bc34c2a19c817ba754a0c33c1eccc81

SHA256
0d739a0d7c0d369a3c0b73cfaa41186166247cee653b4f1721e3a7a213315398

SHA512
89bda3e60df25a3e1f8f2084c3e62f7e901fcb57a570b2c5a305c64c6ed39886b59121c683e280b5cf3e0dc50f9478553182ecc16a2bfb21252a0576d799afb1

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd003.c

Filesize
18KB

MD5
f2d36069ac7de685a50fad684dc06352

SHA1
696e3780db95d27301e14f733d9a6ec0753719f4

SHA256
7d8e81ea11b691a508fff3fe04e31da51dd5263a5c434fce17c0a2a1e08e496a

SHA512
10d5ea07e254e70b708b0f8f8bb1db9a998381309efbdb02df8c6781b84c109515831e662b5004128a4c2f9e8df5f9e0ec62ba6088b56aa1496573db3fd868d8

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd006.c

Filesize
49KB

MD5
fc0acf697471474950375ef09190c19b

SHA1
4f670c15b9d04d2f6c9b6c31dd06bc0f0b59306f

SHA256
7f767b4539fe27456b9267dbf1f2467d82cd88df64c686b9d42189e5b47caa11

SHA512
e2ffaa38e3f0d967ea6ba59cd5caf24e43d16cfb859c177d7ab17181a2e1668e79897e8591c5727b8e1313aacbb9d69530c7178020e68950618e80f3bae62eb1

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd007.c

Filesize
24KB

MD5
1407c1f44d074641a2ad4da8ee646b9a

SHA1
549be436733c3e7fe8aa5c9955238d97dd52288b

SHA256
4f23256ca06d840ca6172c4844999a911d17e8325986dcb719d27a6cfe24a321

SHA512
2e22386553cae53c7ddda935156e1adca2d860e9143938ba61371db8256503d5fd9ba04280bb151c4f91813904c7a13b9b62f2d9cb30aed74332944665280616

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd008.c

Filesize
2.6MB

MD5
dfc7276fca943b512b73857324202c2f

SHA1
32d7de7016e9983593f536fb51eed4ed2ca857e2

SHA256
5660a0e544abc529556626e595628e08c45a54420656a9aba2d1ea7e11574e1a

SHA512
6a963ab27b38d36ce2084ab1ee8caa9e54b384cd3c6251285c2bcba8048502be035ed6ab20b9f76c928cf7b60cd7b557375adae76b272ac5b545cbb47ace9b47

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd009.c

Filesize
109KB

MD5
339c96ae8d643dc53f98a73dc6c966c1

SHA1
d64f218b215890dab496d229cdfab22f6424c17b

SHA256
7d94de3cd12db333ceee470d1a46eb17d4d7d6c5dbc2e070d02a1bdb3e387177

SHA512
ab0f56a9ac90b954bf503254b0b1b88f921484ffcf1c6f2f90881e7b8ff8f5aad0dd6b33f095ba4656afac980d9b9dddcd4229ad08922937441f0245280370e8

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd00A.c

Filesize
492KB

MD5
c1375bb8ee38b70bfa3c3665d9d4f98e

SHA1
486a4c91107d85ebf7341455fb51c2d7e185400d

SHA256
d5b3b072bc089281151dbb8a446d5fa9ce2d106436838708a305185f6b8db381

SHA512
8b97afc1b27e35fc21c6edd504818555149c6f71710a36a82d93bc434329d35d8930ca4238c25b451dc2456ecc3f350a7d73dac8a48597667dfef372a5cda9c0

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd00B.c

Filesize
1KB

MD5
6f3042af6e1dd523503f914ba85fc4b7

SHA1
749a5caab17e0a62e18da5d03a4ff51585153e96

SHA256
e658ac029517d8972b0d1c2d7e91f77882baae4864a3bb0f768369821b7f6678

SHA512
926597d9b906e800be4b6769602ec7025d987d337f22c4db1540f926d9b74a6e3b79a1c6318273c76a0861135e3f27e57c687aa6a4bfa35cd7d6ddf3f86e28c3

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd00D.c

Filesize
102KB

MD5
02e88abb04fd8ad91249984744170c2f

SHA1
86078f519886e0d5d6e5db5ef6e736c438c4c32d

SHA256
c17552bcd44c05889ffe4f41c207bfe5293c3008edc0ffc4778e7f9bf65409bd

SHA512
63d05ad80db0f9fe6b658185d0f496ab3d15416ecb32683b160c3997633d4e1ac12027e4cf8643000318a54d81d2fa979b580075163bbd2862ea5e29d7bb6dcd

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd00E.c

Filesize
83KB

MD5
a9f5b8203b3b2fd8d212daf456972008

SHA1
be5373d063db1920728edd1d82b97654bf11932d

SHA256
7df292eb3b5b3015c51455feed0a57ac0dda3081fe8e90388b3ef8e0723c6def

SHA512
004e659ebcc14aec9e9e4b338d8cf0d82b69f6608ffdbf447a425e62dc4565f9e17fe2bf341f11b469a16005cee62072de2da9a6e9bdbc768620d1e4f8a1213d

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd00F.c

Filesize
27KB

MD5
03112fac2ce8551d80ae0617bb41350c

SHA1
75699ee2c1f0075c29f5398008354ff90cdcc9fa

SHA256
97930a47c8b2f78b3ead612e73f115b11360e497d2d97fed86502a78b19f0082

SHA512
8ad003bad05f175e476515d3265b56c82e74fc1c13864cbbc07af4f2f7ada056765c80ce9002d332aa636d7e4bbfb7583f5edd988b7ee81b28fd13dbff7328fa

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd010.c

Filesize
328B

MD5
7d6357efbb4f6f7916e838871423a4bb

SHA1
e401e1c9d150ae754f0f8a764eb643914fdc7b78

SHA256
5f6708eca9ea285695c64d5a849a1f8d77762cf16374590a20e2f813a672cf18

SHA512
e5ae4bafa8e446022f08d4b9fccbdc36f2e86f0cbedced5d89354664355848d2b39f6744e4c17fbb48141be50e45ddb58a682173ca83a3a92a5cb23ca49c8411

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd011.c

Filesize
76KB

MD5
b49765c67f5a65e5a77498730b8a80db

SHA1
3fafb031681f887b2cec9191e0128f9cbe45c1cc

SHA256
03ba1cb7d542f1ece1aeb8807535b3f3447654d78b15f8c94a5ec1af0359755d

SHA512
8097e5c31e1b96d9c668b704b5933e9873f11969ca35c202530125359f5560086f72eae2c2293ecf29b67190a864011564a1171c947fee867f05a87070cc8aed

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd013.c

Filesize
171KB

MD5
53b53fc468e89b61213971797f6896b3

SHA1
e0d010b481a6559f159b21702f1809dc1e97bfe7

SHA256
ccf1114c64732e923be91cd8d31dfa6a8bd31703867e56bf985da99f18802de3

SHA512
8d2223b71fa30f613da7178da67cbd71c7e5f5d93ab2c16021e411eb8825f6f3836d569d237b0f61aff1736ff2ce70f32f4a20112f184f890baec0082d955776

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd014.c

Filesize
5KB

MD5
ed9670aa0b9aaf01adb5a191ae166aba

SHA1
bd289148626e91aef66a5b16ef5544bbaaef0d7e

SHA256
25438faf126a83b33333b7e409c5d3176e89ed646411ef583085a6a7e17683a3

SHA512
104d214975c16d27e6c64a9a8d27afaebe57623f251161ef4f2fd2ee6b6b0842cdd8e37ada76313a6bf46a45383d9df2fe2eed8bc90643f3b7339a306132770c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd015.c

Filesize
242KB

MD5
fb336f2d46c5329336198c79490e98a2

SHA1
1f0d75f16fd6288d1b41011ff9e142d38f91d9fa

SHA256
31ae8fbebdfce5294742df05bb82a2344ea8edbc4183dc9a0e7b11e5f5c86860

SHA512
95150b69c87030ba667f4c632a3a189654a2834e23aa35b2d77b4020e003e3129d151fc2e43861324b4c786215a62a033dfe063eb49fd2005da30fb6ba954e7c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd101.c

Filesize
28.4MB

MD5
b8c641fdb87b00a65fb327f09a31ce2b

SHA1
97b0e0c02879caac692b7de83f273e85262b0818

SHA256
2f177db70d964310b937536c63b845b8f2c54b9523e718f8edd2eb32ed2dcd72

SHA512
addb3a76ad436e510f05c156652cb1282762674c100d1351addac4087754057bcffc2d5d6034ebf8c5db96f2dcf67b1c01c039a42fe8b4258c80e23188513140

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd102.c

Filesize
24.2MB

MD5
547a15ce25a2770fe6e6a45da427253f

SHA1
d5124076dd5f066694db1a2a578f2c15c487c66f

SHA256
68c323b7004316cb31c0dab516d40b3403dea627c2cc70812550e8233ae7f111

SHA512
df451a180ecfc1d7fc0e2080ee5e7d1f281d1951f6aa0c77e4440c866c920e98a7b4cadb52062c8e45fa3e9d5673ade29bb4e5c7448097e19ab7c49fa9beb951

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd104.c

Filesize
823KB

MD5
799c3565cb347cc06ff545de46bbf785

SHA1
2f3ace739acc6c7fb7df44d8fa651c3ccadb9b49

SHA256
f03b18d43bfd9441f74038fc67a8de98a0a820a84155bc45df1a95ee8f4f24f2

SHA512
2c0021cc53183735103db03783f6b6f131ad031fa2bd81ce361cbbe34a9cec75c3ba0eb8abb70415db89b16298d70be09d2b826aaa546b7eb6b7faf74c9f1c1c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd10B.c

Filesize
949KB

MD5
363e0ff2f9c9d3f87afe40bb5fb5276a

SHA1
d4663c7cb1e890face20e4b9b57d524d4584c49c

SHA256
567a15e1a068488dbb80be8ee5f2c147c5fb60ae4c180fa932d784c0eb0d230f

SHA512
540110a07fb61c41dae3e9b06a31ba47d5311122274cd0fde20d04a6c588eed6d639e6b4b57329d0337ca34eed1656d9d21d1baff134b321c5629804a2863fcd

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\upd10F.c

Filesize
43.0MB

MD5
2b5ba49fccfe7f8c01935c6eaca3ad85

SHA1
e7e819e5760587e548f5e73d0ed4d9871223e730

SHA256
718799e3f8c5a1b61540f11ec00aab8022a385007c08ce976bcdf4ee55e2d7aa

SHA512
d4bf32ac41d91d7bd519f135e27391d8c3f6109ec9cfe8231d8dab40fe8bd2a96098b7c75733e0f4181801539cc7206efc762c6e65494af310374554db2f875c

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\updates\nfd.c

Filesize
292KB

MD5
b2c4242a224d637ad32fb8eb9a755a44

SHA1
a1714ed08f03ff9a4d23d8d8a6a3cce0c0877726

SHA256
41cdec319c01ea9848c4de3a9b0b7368d1303d6e4cc6ae881d924b0ce510f503

SHA512
8c9c698d550fb03748e38f21996c647820ab5314c0e976dea7f7b5e79735214aa798658dd720fe5ef297c349a74002b0790b964a3425073f00f35379fda79e3f

Download Submit
C:\ProgramData\GridinSoft\Anti-Malware\database\vs.c

Filesize
141B

MD5
27383e9a2fce7ad89b53f842aa6995a5

SHA1
21e8384b3936c0e25ce5bdd70963853078e2e460

SHA256
4bd702fa817c43d1e5ae2d317481fc25e97f71bcf35deabb17aeb583f3b6b78a

SHA512
a229093262fc5d5ab1a2615b9b7ed34764c3e636443ab29b002599f71d74f96d2f839c148fc213148c5e05aaf8d7cefc5ac9aff74fd74d65374d063bbb594a62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Filesize
8KB

MD5
062540d8357d1a4730a9deb9c47aa5b9

SHA1
d03a5bfa34e93f686dcdb61136d0fb2e916a3189

SHA256
b32b50c61c80ee178b4785b6b31959b6caef9235aa92f78f1090212c93dca429

SHA512
c7c7c11d70e462da359133c22afeb9c0f1cd9dfa6f9300cc155c5e258ff93282a791f3d223e4ac347408376dcbc677534d31cf8f25b11ee0c04bb5a2d9a8845c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Filesize
8KB

MD5
a83f772042f192863d4fe1b8f3225570

SHA1
98c78912b50365e7084b94941fa3a3cedf8ae685

SHA256
c85b6a353f7a1aaba404a2f12715a2daf7943bced39e3701a08c3b2dd8cd6bfa

SHA512
92ea7be8feb11e74fff1c7208ac63b9b75f7a0371a47bfcdd19916f4cf00b44f3927e269d63089c5e626e09b8f4af7738f87970ab701898104cb60c286153ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oa2fkno1.eh2.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nskF771.tmp\System.dll

Filesize
11KB

MD5
9625d5b1754bc4ff29281d415d27a0fd

SHA1
80e85afc5cccd4c0a3775edbb90595a1a59f5ce0

SHA256
c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448

SHA512
dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nskF771.tmp\nsExec.dll

Filesize
6KB

MD5
35200be9cf105f3defe2ae0ee44cea12

SHA1
3f4a09eeb477d3f048cdfb848b95aa39b20d89dc

SHA256
0096ae873c75f4e4d802dc97eec9893acc0749a7346e63f25a8d52ba8e11c527

SHA512
f8f7d8a844d588c6e2d6dc54e0d4bcbb1c4229a6e8f4d110a5e3d47eb0b8b5e0860ff5d31762229a731e08d7b232468b2a78c29778a9f0c62a7381db89175833

Download Submit
memory/676-160-0x0000000006710000-0x000000000672E000-memory.dmp

Filesize
120KB

Download
memory/676-163-0x000000006EDE0000-0x000000006EE2C000-memory.dmp

Filesize
304KB

Download
memory/676-144-0x0000000005140000-0x0000000005176000-memory.dmp

Filesize
216KB

Download
memory/676-146-0x00000000058B0000-0x0000000005ED8000-memory.dmp

Filesize
6.2MB

Download
memory/676-147-0x0000000005850000-0x0000000005872000-memory.dmp

Filesize
136KB

Download
memory/676-148-0x0000000006050000-0x00000000060B6000-memory.dmp

Filesize
408KB

Download
memory/676-149-0x00000000060C0000-0x0000000006126000-memory.dmp

Filesize
408KB

Download
memory/676-159-0x0000000006130000-0x0000000006484000-memory.dmp

Filesize
3.3MB

Download
memory/676-183-0x0000000007CB0000-0x0000000007CB8000-memory.dmp

Filesize
32KB

Download
memory/676-182-0x0000000007D60000-0x0000000007D7A000-memory.dmp

Filesize
104KB

Download
memory/676-181-0x0000000007C80000-0x0000000007C94000-memory.dmp

Filesize
80KB

Download
memory/676-180-0x0000000007C70000-0x0000000007C7E000-memory.dmp

Filesize
56KB

Download
memory/676-179-0x0000000007C30000-0x0000000007C41000-memory.dmp

Filesize
68KB

Download
memory/676-178-0x0000000007CC0000-0x0000000007D56000-memory.dmp

Filesize
600KB

Download
memory/676-177-0x0000000007A90000-0x0000000007A9A000-memory.dmp

Filesize
40KB

Download
memory/676-176-0x0000000007A30000-0x0000000007A4A000-memory.dmp

Filesize
104KB

Download
memory/676-175-0x0000000008070000-0x00000000086EA000-memory.dmp

Filesize
6.5MB

Download
memory/676-174-0x0000000007910000-0x00000000079B3000-memory.dmp

Filesize
652KB

Download
memory/676-173-0x0000000006CD0000-0x0000000006CEE000-memory.dmp

Filesize
120KB

Download
memory/676-161-0x0000000006740000-0x000000000678C000-memory.dmp

Filesize
304KB

Download
memory/676-162-0x00000000078D0000-0x0000000007902000-memory.dmp

Filesize
200KB

Download
memory/1052-581-0x0000000000400000-0x0000000001E8F000-memory.dmp

Filesize
26.6MB

Download
memory/1052-1258-0x0000000000400000-0x0000000001E8F000-memory.dmp

Filesize
26.6MB

Download
memory/1052-329-0x0000000008660000-0x0000000008875000-memory.dmp

Filesize
2.1MB

Download
memory/1052-1284-0x0000000000400000-0x0000000001E8F000-memory.dmp

Filesize
26.6MB

Download
memory/1052-546-0x0000000000400000-0x0000000001E8F000-memory.dmp

Filesize
26.6MB

Download
memory/1052-566-0x0000000000400000-0x0000000001E8F000-memory.dmp

Filesize
26.6MB

Download
memory/1052-572-0x0000000000400000-0x0000000001E8F000-memory.dmp

Filesize
26.6MB

Download
memory/3840-10-0x00007FFDDEB50000-0x00007FFDDED45000-memory.dmp

Filesize
2.0MB

Download
memory/3840-145-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/3840-280-0x00007FFDDEB50000-0x00007FFDDED45000-memory.dmp

Filesize
2.0MB

Download
memory/3840-279-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/3840-262-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/3840-9-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/3840-8-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/3840-1-0x00007FFDDEB50000-0x00007FFDDED45000-memory.dmp

Filesize
2.0MB

Download
memory/3840-0-0x0000000000400000-0x0000000000655000-memory.dmp

Filesize
2.3MB

Download
memory/4456-194-0x0000000000400000-0x0000000001E8F000-memory.dmp

Filesize
26.6MB

Download