blackmoon | b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2025 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe
Size

15.0MB
MD5

38c64fa7d7d7478732b04c42b71afa3a
SHA1

8534bed0e1694a090c7ff9b8f010bcff02bccd3e
SHA256

b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468
SHA512

7079d628c25edb62886eab75a8fe5fec096a584bbdabf68ffba810ea0b9913a9c2e6f2366acc9ccd8859a42cb4768febdc422d23043d4252f4b97d2475aadefb
SSDEEP

196608:iQwfQzHzARHblaR6cnawftA3YTcd1Oc5h2dxDbElK:AQTzuoRbBfQYT042YdBkK

Score

10^/10

blackmoon gh0strat banker defense_evasion discovery persistence privilege_escalation rat trojan upx

Malware Config

Signatures

Blackmoon family
blackmoon
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 3 IoCs

resource	yara_rule
behavioral2/memory/4808-0-0x0000000000400000-0x0000000001300000-memory.dmp	family_blackmoon
behavioral2/files/0x000c000000023b7b-2.dat	family_blackmoon
behavioral2/memory/4808-4-0x0000000000400000-0x0000000001300000-memory.dmp	family_blackmoon

Gh0st RAT payload 7 IoCs

resource	yara_rule
behavioral2/memory/4808-0-0x0000000000400000-0x0000000001300000-memory.dmp	family_gh0strat
behavioral2/files/0x000c000000023b7b-2.dat	family_gh0strat
behavioral2/memory/4808-4-0x0000000000400000-0x0000000001300000-memory.dmp	family_gh0strat
behavioral2/memory/4612-6-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral2/memory/4612-7-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral2/memory/4612-14-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat
behavioral2/memory/4612-5-0x0000000000400000-0x000000000042A000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
33	5008	traffmonetizer.exe

Modifies Windows Firewall 2 TTPs 9 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3676	netsh.exe
1568	netsh.exe
1948	netsh.exe
4568	netsh.exe
1572	netsh.exe
1588	netsh.exe
4012	netsh.exe
3772	netsh.exe
1164	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\GraphicsPerfSvcs\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Roaming\\GraphicsPerfSvcs.dll"	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe

Deletes itself 1 IoCs

pid	Process
2920	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3836	ctfmoon.exe
5008	traffmonetizer.exe
1760	Installer.exe
3152	Traffmonetizer.exe

Loads dropped DLL 1 IoCs

pid	Process
3904	svchost.exe

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	7	124.160.26.219	4612	svchost.exe
Destination IP	3	1.226.84.135	4612	svchost.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api6.my-ip.io

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\Update[1].txt	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\Installer.exe	traffmonetizer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Installer.exe.log	Installer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\storage.json	traffmonetizer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\pid	Traffmonetizer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json	Traffmonetizer.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\pid	traffmonetizer.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json	traffmonetizer.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3904 set thread context of 4612	3904	svchost.exe	103

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4808-0-0x0000000000400000-0x0000000001300000-memory.dmp	upx
behavioral2/memory/4808-4-0x0000000000400000-0x0000000001300000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.Metadata.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Queryable.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Principal.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XPath.XDocument.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.ThreadPool.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Ping.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Net.WebSockets.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Net.NameResolution.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Extensions.dll	Installer.exe
File opened for modification	C:\Windows\Microsoft.NET\traffmonetizer\repair.exe	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Timer.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Expressions.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Resources.ResourceManager.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Xml.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Security.SecureString.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Requests.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Encoding.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Parallel.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encoding.Extensions.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Formatters.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Reflection.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Primitives.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Sockets.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.Parallel.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.Serialization.Primitives.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.ObjectModel.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Security.Cryptography.Algorithms.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XDocument.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlSerializer.dll	svchost.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.dll	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\Uninstall.exe	Installer.exe
File created	C:\Windows\Microsoft.NET\traffmonetizer\System.Xml.XmlDocument.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmoon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	traffmonetizer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Installer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	traffmonetizer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Installer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Traffmonetizer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	traffmonetizer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	traffmonetizer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	traffmonetizer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	traffmonetizer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Installer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3904	svchost.exe
3904	svchost.exe
2920	powershell.exe
2920	powershell.exe
3904	svchost.exe
3904	svchost.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe
1760	Installer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4612	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	5008	traffmonetizer.exe
Token: SeDebugPrivilege	1760	Installer.exe
Token: SeDebugPrivilege	3152	Traffmonetizer.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5008	traffmonetizer.exe
3152	Traffmonetizer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 1568	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	82
PID 4808 wrote to memory of 1568	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	82
PID 4808 wrote to memory of 1568	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	82
PID 4808 wrote to memory of 1164	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	84
PID 4808 wrote to memory of 1164	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	84
PID 4808 wrote to memory of 1164	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	84
PID 4808 wrote to memory of 1948	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	86
PID 4808 wrote to memory of 1948	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	86
PID 4808 wrote to memory of 1948	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	86
PID 4808 wrote to memory of 4568	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	88
PID 4808 wrote to memory of 4568	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	88
PID 4808 wrote to memory of 4568	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	88
PID 4808 wrote to memory of 1572	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	90
PID 4808 wrote to memory of 1572	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	90
PID 4808 wrote to memory of 1572	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	90
PID 4808 wrote to memory of 1588	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	92
PID 4808 wrote to memory of 1588	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	92
PID 4808 wrote to memory of 1588	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	92
PID 4808 wrote to memory of 4012	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	94
PID 4808 wrote to memory of 4012	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	94
PID 4808 wrote to memory of 4012	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	94
PID 4808 wrote to memory of 3772	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	96
PID 4808 wrote to memory of 3772	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	96
PID 4808 wrote to memory of 3772	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	96
PID 4808 wrote to memory of 3676	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	98
PID 4808 wrote to memory of 3676	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	98
PID 4808 wrote to memory of 3676	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	98
PID 4808 wrote to memory of 2920	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	101
PID 4808 wrote to memory of 2920	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	101
PID 4808 wrote to memory of 2920	4808	b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe	101
PID 3904 wrote to memory of 4612	3904	svchost.exe	103
PID 3904 wrote to memory of 4612	3904	svchost.exe	103
PID 3904 wrote to memory of 4612	3904	svchost.exe	103
PID 3904 wrote to memory of 4612	3904	svchost.exe	103
PID 3904 wrote to memory of 4612	3904	svchost.exe	103
PID 3904 wrote to memory of 4612	3904	svchost.exe	103
PID 3904 wrote to memory of 4612	3904	svchost.exe	103
PID 3904 wrote to memory of 4612	3904	svchost.exe	103
PID 3904 wrote to memory of 3836	3904	svchost.exe	104
PID 3904 wrote to memory of 3836	3904	svchost.exe	104
PID 3904 wrote to memory of 3836	3904	svchost.exe	104
PID 3904 wrote to memory of 5008	3904	svchost.exe	106
PID 3904 wrote to memory of 5008	3904	svchost.exe	106
PID 5008 wrote to memory of 1760	5008	traffmonetizer.exe	107
PID 5008 wrote to memory of 1760	5008	traffmonetizer.exe	107
PID 1760 wrote to memory of 3152	1760	Installer.exe	108
PID 1760 wrote to memory of 3152	1760	Installer.exe	108

C:\Users\Admin\AppData\Local\Temp\b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe
"C:\Users\Admin\AppData\Local\Temp\b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe"
1⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=in program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1568
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_ctfmoon dir=out program=C:\Windows\Microsoft.NET\ctfmoon.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1164
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_ctfmoon new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1948
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Dcom dir=in program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4568
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Dcom dir=out program=C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1572
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_Dcom new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1588
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Store dir=in program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4012
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name=Microsoft_Store dir=out program=C:\WINDOWS\Microsoft.Net\Framework\v3.0\WmiPrvSER.exe action=allow
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3772
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall set rule name=Microsoft_Store new enable=yes
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3676
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Start-Sleep -s 2;del "C:\Users\Admin\AppData\Local\Temp\b4496c7be8a9258bf377204b491af1155054fff609ad9fc90966f39d9d7fd468.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2920

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k GraphicsPerfSvcsGroup -s GraphicsPerfSvcs
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Unexpected DNS network traffic destination
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4612
- C:\Windows\Microsoft.NET\ctfmoon.exe
  C:\Windows\Microsoft.NET\ctfmoon.exe [email protected] -password=123456Aa. -device-name=Win32 -accept-tos
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3836
- C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe
  C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\Installer.exe
    "C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\Installer.exe" /u /s /d "C:\Windows\Microsoft.NET\traffmonetizer"
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe
      "C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qtdancx3.vjx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Microsoft.NET\ctfmoon.exe

Filesize
9.1MB

MD5
1de26ef85f7218e1df4ed675fa2b05d4

SHA1
e5217fa3b50f625d84d5e5c4b66c031f7a2446ae

SHA256
fdd762192d351cea051c0170840f1d8d171f334f06313a17eba97cacb5f1e6e1

SHA512
ada80a9f97bec76899eccc40c646387a067a201663d4d0f4537af450ea7c92df877f017862634e32e9e2ba08ca6d41806dc03f0dfd7f811ca303b56b1ac17d92

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\Base.dll

Filesize
106KB

MD5
c3935313bbf380cd8d3cb336a5e3c8e8

SHA1
c09f0b894ee5a6a59dea194e94b42fff29b53f38

SHA256
4d0409c6db0b0af97f5fc57ebe2248c1632aeb836a5ea1eeaad64f57a4eb662b

SHA512
6525f98811cb277fbae75e278fca7997c6a6993b3f3f163a3c98da85055305d7a61917981625f113c448b8a397d3c5a143db2c8b131e5e4395205e34dc7c48a2

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Bcl.AsyncInterfaces.dll

Filesize
20KB

MD5
1ee251645b8a54a116d6d06c83a2bd85

SHA1
5dbf1534ffbff016cc45559eb5eff3dc4252a522

SHA256
075ce79e84041137c78885b3738c1b5a03547d0ae2a79916e844196a9d0ec1db

SHA512
9f67fd0566eac2da4253d08697daab427e4e85780615d940f086a88424dcbb0563abae7e4824088e64ef7024c1bb3bbf324f2d07bc7ba55f79e4af3c9ea88e97

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.NETCore.Client.dll

Filesize
61KB

MD5
d8575dfaae8ed7d421cdf01c8cf5d867

SHA1
ff1c551150fed59f4c972acf88746c08eab7698f

SHA256
c8b9c8e7032a7a4ec4bc2ee68824f20e114cb5fd9002c3dcb58ae98b77c47dd8

SHA512
abe335bb72182daaef65ef4eb428e879aca9f4c8a19a4bfe5619e2d51069767e5d03bc3492b30dda8a37606effa993057d3b3c2120dfb72aa92b468741dd9d71

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Diagnostics.Runtime.dll

Filesize
490KB

MD5
5dfb71a97b10d00dea71f443fdfd732f

SHA1
c7d9b0f37bf40a4677e243a4d16454f3475853a2

SHA256
d9ecb8cd1ac822a14e65f7c7f5f3fcb262fa23fb7c721a59321bdb467bcbad14

SHA512
8e84b1d442e11a5b6c16efe0cd44bc0f27bfd141a7b812ce2e32b3cc0697d8f9b2155bb60ee48934b4a907c2abd181bdcafa5d7bf4ac4dec91120733428d6eba

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\Microsoft.Win32.Primitives.dll

Filesize
20KB

MD5
76b8d417c2f6416fa81eacc45977cea2

SHA1
7b249c6390dfc90ef33f9a697174e363080091ef

SHA256
5eaa2e82a26b0b302280d08f54dc9da25165dd0e286be52440a271285d63f695

SHA512
3b510cdc45c94be383c91687c2cb01a501ba34e3fbb66346214fc576d6f0e63c77d1d09c6419fc907f5b083387a7046c0670377ad2e00c3ec2e731275739f9c7

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.AppContext.dll

Filesize
20KB

MD5
8cc4c7dfeb41b6c227488ce52d1a8e74

SHA1
93702135db0646b893babe030bd8dc15549ff0c2

SHA256
9dc115ac4aadd6a94d87c7a8a3f61803cc25a3d73501d7534867df6b0d8a0d39

SHA512
e4da7e3ae5ca31e566ea0475e83d69d998253fb6d689970703a5ad354a2aad1bb78d49a2c038f0a3c84a188d091696191b04e4a39253deb3b6cb310b72f02f97

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Buffers.dll

Filesize
20KB

MD5
ecdfe8ede869d2ccc6bf99981ea96400

SHA1
2f410a0396bc148ed533ad49b6415fb58dd4d641

SHA256
accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb

SHA512
5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Concurrent.dll

Filesize
20KB

MD5
559c98eb9633c7ba1bc813f8e6e0e9a5

SHA1
311f52b31611e6dc5fd4c0159bfa452c22980ca7

SHA256
cc62f3b867d50083c2932061f20662c698d2e1a741c4d2f9df1fd2d435e3ef3c

SHA512
e241c16869d1cdbb2c6482a7c5b2af93de4ba0cef8185b8826eee35ecb174f35f7585c8ae0320f7f4f6b80f3bb5b3edae2383760f2f35637f03c3a0e38e0875c

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Immutable.dll

Filesize
184KB

MD5
c598080fa777d6e63dfd0370e97ec8f3

SHA1
9d1236dcfb3caa07278a6d4ec751798d67d73cc2

SHA256
646d3b52a4898078f46534727bdb06ff23b72523441458b9f49ecc315bf3ef5c

SHA512
8a5b4afb4363732008c97d53f13ee430401e4a17677af37123da035f15f9e9409a2aeb74ae238379291fd5de07c3cd4e3de2778da5edf83a42649fa5b281cb32

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.NonGeneric.dll

Filesize
20KB

MD5
45ff71114047dbf934c90e17677fa994

SHA1
526c688e71a7d7410007ad5aa6ea8b83cace76c5

SHA256
529943c0cdf24f57e94bf03fac5f40b94a638625027a02df79e1e8cb5d9bc696

SHA512
29684ac5391268eaa276196a6249364f6d23abfe59bdc304a561cf326cea6cd662fa04c05e15924fd6d3f9e9d1607992b8dcad3f817cfe891580f9d9462fe9b7

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.Specialized.dll

Filesize
20KB

MD5
b52c339601cb264f83df72d802e98687

SHA1
8bbb7badaaa912c1f17775e9acdcab389704c772

SHA256
938da38561da54793944e95e94b6e11cf83aacd667487297d428fbce1c06dc9c

SHA512
287f08ab07827570f9f3ef48a6d7e5c186899a2704fb3dbaf36975f6be7b29fb6695a69fab85a6f09bddefb60c79052c3a33cf862651f892eb9d773d880b3af8

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Collections.dll

Filesize
21KB

MD5
1d8aafeca1ea565b257384d3f64864b0

SHA1
4d923b100142afa2e0a8b7acdb3a6de6feb91148

SHA256
c2250e9e51b44d8ab8c5b892592766925f6580ee00b95026621d0afb037c2707

SHA512
99e4a226e1fabb348e7ef7c6fa56ad0ce4e4cf5d8569ce21881703dca8d83a1c113fd5f440a4fc9e9b99a04ae8cf4490e17d62ffc09cfac5a45678a4419efdbb

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.EventBasedAsync.dll

Filesize
21KB

MD5
6067ecbab3c6dddb6bf7c49c7948caa8

SHA1
5f3da777af01dbc159bd8d9d97d5dc105918afc5

SHA256
22108e32e0b6e42f5f52a4cb17b9b6fa3dfd547ecd9eef9c67226dbec54d23e5

SHA512
9f3e834b8342e0c7aa5ccc993b520d664b03f1f0091066c66067923e1d4991efa03f63908552538c05f423aa2b696de7c76993f71a7564f3e87662cb0fc00726

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.Primitives.dll

Filesize
21KB

MD5
2f39655ccfc010e32a7240d9bf5d0852

SHA1
20aeaed12dfb8d71e39687350eb12bc0de372af0

SHA256
bfcd867f71c887429dfe008d7ec5d1853d15b3932d4ce8991694293477b5be37

SHA512
9769e59279a32f29c2f2c6970c81d3ed76fe3421b819ddffc8fa98329f1b45300c737fdf71956672f80f69b3a75727d184f8c421e00b84e94163a86cb744a991

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.TypeConverter.dll

Filesize
22KB

MD5
d1699287934da769fc31e07f80762511

SHA1
bfe2384a92b385665689ad5a72f23abc8c022d82

SHA256
0dbb92ecd5dfa7fc258bc6deed4cecf1b37f895457fd06976496926abdb317bb

SHA512
4fef3e1535f546ffdde0683f32a069beeffe89096524c7068f1f5ce8377824f82ae530d3990c9dd51bccaa9e53fded5613fa1174013325808059276dee771187

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.ComponentModel.dll

Filesize
20KB

MD5
632cc8ad69b76fd9bb5847de1e1439f7

SHA1
2e32d50ec33ec6635681485b754f4e58d434a5ee

SHA256
5e61d755616cb10524f5f31e9b70c65a7fff8e30e25ce711ac8b354d657ab479

SHA512
9ba5cc82573308e5d995ba05bc660fc1c087eb91d8bd7efca6ff838a3c47bd6118d9c92919b2e0dac11a5a27977318c5c819499dc19cd5d6e57122a0749858c6

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Console.dll

Filesize
20KB

MD5
ea9376c17ee0148f0503028ad4501a92

SHA1
9d5686cbf45e90df5e11d87e7b90173a1a64b1a0

SHA256
b537313413f80105f143cc144feeae2ac93f44747727de309a71d57d2650034a

SHA512
18d1bb2d5c469644078d75766dbf04addf7d0c543f7ed15ff522ceeaef960900dd8ec68172f5d684b76b0aa6946bb38d641f021ec04c70ad66a6062c10412e0a

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Data.Common.dll

Filesize
150KB

MD5
d712a5a82a446086443ce00b610d8a5d

SHA1
7add96baa123db819f2f3d5aa62d6f872ce8fe14

SHA256
1c7bff6f16bb618648e699b723aeafe511515cd6aad699c25faae2a507e22811

SHA512
225128e58e2f01b5caada6fe54b1d32ff6a700542ce22b425649ab22da2944f796f04d1a2428c542bcab5348a161cf73f5f9a1e7bbf1f6417c4d507217fe3fd0

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Contracts.dll

Filesize
21KB

MD5
99373ab10858746aad424f28b48277f5

SHA1
5042ee630a6c7c2986e8323a14d052c1d83b6f61

SHA256
9c4ae61e0e8365762efe3d34c5595029f2c12e0079e6070720e2cef0882c84e5

SHA512
e96f8fdd6ffb702d344746ce82de576bba8636ede3e39a7da18ccf8a0178b8346fd31140760b864f1487d7804d931ff1a18de07a4cafa0cf79bdb340421fc03f

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Debug.dll

Filesize
20KB

MD5
8b8c402311d7ab87e588675e736414fd

SHA1
eb8c010a35b461402c1c33133f1b61c78be8425a

SHA256
55a30d92d163cf1807bea6dc13b4c13e70aebbb034dc77eaef4f4394730dcd8e

SHA512
d03f450a3a19320de71145e48cd7c088d9b50d0a683cc9a79d8967dce085a6f63cbe537fca1c6208865eb52eafb10189613c7233047318caeb2fb2c23c34a269

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.FileVersionInfo.dll

Filesize
21KB

MD5
d86b0aca05321569d9383dc7c4e9e934

SHA1
2ef7d0a222c3a3e564b3c72d5b71a5be40a7adea

SHA256
28b165cddb82a2507114394ae398995ef8a50c549214f8678aa66054f6927754

SHA512
5959e1129c983825233a07869dd1b2b1db32830d2b5f6b7f8d869c39a76a241f88f76d37341fdfbf56f000fc6acba19aeb36a7efb94721494b41b65bf4978651

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.StackTrace.dll

Filesize
23KB

MD5
fa98a0f020248c2be1dd40c07092f22a

SHA1
ef6b3ccff90beddab5ce6f60b4cc23f75edfd009

SHA256
cae99f910874288afbf810968d13b79d755cd4b2006609ec036ea4934181cba5

SHA512
554a25c761102dc41a9e421621e329868d1162ab29f47e59754c8fcfae0c12bbe8200e1b5975abf926f1de0977a5407c43202ac8a2801c69a7f01d95b6a1e959

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TextWriterTraceListener.dll

Filesize
20KB

MD5
a964808487e671bb369dbc0e4dc5a947

SHA1
c3848473e42e2f9b4d0a00180ea9ade654432587

SHA256
63eab38ee9f4dcd686c8e6a4f01e1e2a9bb91e52b20ab4dde0c28061e9261860

SHA512
7352368b68835ecc9c5943ae2f2bd5cab775a7fbb018af7683e74fad1731a9738ae14ebe0bccd854a223ab762fca7ec11411fdae865c5c6ddd034900fa55cfd0

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tools.dll

Filesize
20KB

MD5
27c7d752c11c3f43f28eb31968e73e2b

SHA1
51e466218025126c5e524afd2086f4ab0bf3660a

SHA256
260c6250ef9b57dca99b4cecc533f9a34857b5a32b5351202f776163841200aa

SHA512
393d1747911a7f91f4c4f4f363a3782f24e00431478088da454823a223a4e75e51d9b010fc5d9746e2bf0185be90071b6cb70c777337d718b39151eef6b486aa

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.TraceSource.dll

Filesize
21KB

MD5
37be4cce0ed037f8d9a7a3940bd2a2e1

SHA1
96314ec1a59e4bb53c5b609bf79ad4c998a7a988

SHA256
c81a57d0634c462a6cf49844059e9b170f650ccdf0789519ffd4ae7d28e2718d

SHA512
cedac24f414cce5053fdf10779dbd153fcebad69b3960f75a5ab1110da18799c79dc01b30269641022fcd874a331bc2dc7ce1a7d1a60dc90e109dd55b58665db

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Diagnostics.Tracing.dll

Filesize
30KB

MD5
60f59659db517c2f4dd4c5c583d43097

SHA1
87ed79d195d8d93ae1155af08857f751a7eca245

SHA256
b84b93be455cc7d14ec0c88ce08dafac7b6aac2e549c969e7126eb48c31f8b1c

SHA512
90bcea3baa04146f08013a832633957c6d511d5eb52270575ef9a571153384b5a02c5026361b70940775907b5bc710b2c91627eeace432744f3b9e5e1ed509d6

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Drawing.Primitives.dll

Filesize
20KB

MD5
29b0a1554e54611ebba7911049f26fd3

SHA1
d707745e72d2f39374f2d28af52aaab7888b93ab

SHA256
2805a18724a24034ad6acb315dac516e479cecc5f3753204052657e560932d5d

SHA512
17558306a611bfac6982d5650335b05ea407191290b653c028896142ebee2abceb22f7d71926fbbcc3fab8227c61a5fda0e770abfca021ac7f891c9c7ee42e81

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Dynamic.Runtime.dll

Filesize
21KB

MD5
c5cadb1409f25b6a1c7a6dd4c2df236b

SHA1
a994c87352486d433a06943c01329dd721ab343f

SHA256
f600acc811720183c639cebe5618baf9c8135b85b9cbdc0758bc9b2dcc6dd7a9

SHA512
6bd6e482533b9ff8fff8823f84cde7191a0fd5575f76891a95e99cd1f5c1122ef92b436745ec9583089445fd5eac795181759080b1d83ccfa1eed31d9cce3af0

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Calendars.dll

Filesize
21KB

MD5
ac2f4b435ddf0600d7a866f42f3b40d9

SHA1
0564ff7f7e6084bd6d02d8e6a4127d1c878b3fa6

SHA256
b56ffb65b842daae13f3020b0b04646db92f89801d2a2f89087d145a996d43f7

SHA512
dc3e9c3b4d732801dcf43cfd6cdd2672f01e03cb99d804a3f4803fddb9ca9817bcfd2f96fd94b7b33db0994f5478ce200c048db5dbb78d3b24e950262ebf4d28

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.Extensions.dll

Filesize
25KB

MD5
c7c93de0627833900b8379fd181b7351

SHA1
2cb98f9622f57a0a9e037a378519aa6a271302f6

SHA256
c7e91bd148ed22ee1ff8ebd3e58b199a30af90aa37499bcf8da34409672f2ed9

SHA512
1067bacc4495eacbc27937b54780b97da62fed1af66158e2fa492fc82b068d49bb49bc20c3c82c22d8edd300bd7b097e14aa1e317f1789744e188bca15d22b4d

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Globalization.dll

Filesize
20KB

MD5
ae023bb0beee5189a07c7fd4e0cf3fca

SHA1
846711d4161a3950facdef97037898a71f4efda1

SHA256
56bd0c02c734abf4d7fd1ef2e8b6a9e4bf5e4bab4e606cd1023d63b02852fa61

SHA512
62305027ae8bb5b830630fe54f2cf9e607f9b97ffe28912c2cb15d429252668f17eaf2d7ceecf5601c889d5ea52e0b9100f115173bb11b5d6208171792833c85

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.ZipFile.dll

Filesize
20KB

MD5
bb1a520f25bb93ace4dd0a060fba677d

SHA1
92bf07ccf32eb9fdf06f446a256e0271c4028bf0

SHA256
7720ee13405ea8a3c204703a181e67dc6d66835e9df263c09d04d8b48b41eb26

SHA512
9288148ec879ebeafd53c225854ee3bd3768ba5c7b829d6af1251d20ac301fc27a04bebb603fe2cde6949bc5968fde717e8b747337c1ad872450d26f7c36f515

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Compression.dll

Filesize
108KB

MD5
33b8972fa6b00b8922210ca95e5745d1

SHA1
609f31b98831327677e89e08bff7d7322ba0f4a4

SHA256
da18d61bb6b7d35c56cb4f392fae0844cca73f72a043a08994beccb531ff3b77

SHA512
f85f03e20c8ce40bcf28d883ccd80ced755bf75d515fa66986963f0f4f5ad00bb1823d8c100a75323147b28a4916dd6c598102b18999aeb7b358c196af4206da

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.DriveInfo.dll

Filesize
20KB

MD5
2fcb2158fc41d97e2bb71953664b99b9

SHA1
16eb49afca84c9e6160b4e5b36f1ec5c98470c86

SHA256
984575c44cab17d46587af6cc8c22c409b79bec280fd771e6af93a0a0c20e5b0

SHA512
1527a426f8ec9931573468929966e102012b630ec4aa370c196b2b87472bcee696b00355adaeb39b4151b986470f7dada415e3f930d9678b68d3c531c8ac9b52

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Primitives.dll

Filesize
20KB

MD5
51b07204081bde29a1f84a3b48554186

SHA1
fca2f72c039937357099ca6e167330e540f8335d

SHA256
5c84dd40d67c0e59906511d2b09da8e28c454b5979eb5fde74213f9d4bdbc564

SHA512
099ec1b84fcf6bf07142ad8cd34307c80f19a64c754ade505ab55707075a764fbe7bfa4ce2fbaeaa09b3e61ebdb6e3d116608df0cf77bc076c7b3119db37a324

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.Watcher.dll

Filesize
20KB

MD5
3772a3a7e55178ec90ecb607aba28511

SHA1
68c240d1a43de1678ef13107b9300c544e9d5e4e

SHA256
c9e2562f1a1b86acdb6957cf916aced9c4f8b71ebb16dfa0050252146205ad37

SHA512
245f12b4926114ebdb39a54628a1df2501c4a27abd531172cc63bc96298ee0f4be5658ae95fe730c063eadfb1b664c7d201c69c2246cfba23ed5a4fe7ef3d14e

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.FileSystem.dll

Filesize
20KB

MD5
bfceb4faca75681137455cd70f8038b6

SHA1
bfa0e27be1d56ba48918a9b7ca7090af7779a10e

SHA256
9a4595dbb128e2d8f373b3ac45478e7131f4d181b50ec821ec8cb88bd46bd5b8

SHA512
58d7e8d6fa237a6eac018c0a88d6bf76ad9ee49b6a6790b64e68c33ebf80afcb4223881aac6821132b877e7d848bc917eb9490590cdb297f362c9b43143d6713

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.IsolatedStorage.dll

Filesize
20KB

MD5
ab8d293bcd7a13e83565b4afa8438988

SHA1
48f227c62b2001c441bcbc5b570911f096ddf421

SHA256
0e80a2e256d16e487bc847d1857ed7cd088f176254ba2a385d675338b836b0fc

SHA512
443dd75234c043de736423466c1fc2ff2bd9b6b9fe753521c3c225de99f5a7d3828a470cf8ea54678a86681949e5dcd1de1eab35bf0f348f758fa099a9092f54

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.MemoryMappedFiles.dll

Filesize
20KB

MD5
34e21101faf71a27c6819cc051debc9d

SHA1
d9df77b4993418337894ff04c6b813224b9f8543

SHA256
81b6527ac2d18782ac24ae463c11dd1d70ab1bc89f626b7347a592229b371a1d

SHA512
aa339f2489ca9bc9ef7f6121c9586dbd8f5ad2ca5a160a3bcac74b908570ec2fc0bc24e0ec33ae9de9d6a6c3557ec2816fe8e89ffca93e310503f6f83a691f6d

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.Pipes.dll

Filesize
20KB

MD5
58a2e5ac0510b9223236b9317c505b58

SHA1
a00954217ca326c54a863d451820263a6d7ee1af

SHA256
80a229b2917fc3a5d941ff9745a6be0065028afdf9509300410d2721c71f1198

SHA512
18736ecfe0ef0c477bf64f89ca97af4578defc996f0a5bad33d7a29af6e09745e4b10d6d543243b9664e40169ee550c996e783c5ffbb0fc767da7ffc63e13fb6

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.UnmanagedMemoryStream.dll

Filesize
20KB

MD5
d74405753f829e75e89bba5ebc296112

SHA1
474944856db781a34796bfcce18ecd4580275ad1

SHA256
86f1f12e47f260985b08bb966598123578eb5e48bef9bb086f04e16e9d53bb32

SHA512
cdc5d49fcf0249c539e45c9917c152f130c8fee975d97c2f62526f474cb779b2bf273195f4aa7a64f76dd2496528c0d021b56e60aae2635606f9f55092cb47f4

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.IO.dll

Filesize
20KB

MD5
809fdbd7422a3e02c89244dc530a3367

SHA1
a6999c04b243b034f8ee7ad0d79f3ce24df9a9d0

SHA256
c191a43029edd4eb8eee003356f1fe79aa45071c25433a7a3589590e9089eed9

SHA512
5232b7ef2b60a99be2b027112078a7debf58bfa4308f4ae53dd9a96fa7bccbb0927beb7148e7a3944173f7820f9f519767539d1fdfef848b6f1d6668be11fc15

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Linq.dll

Filesize
20KB

MD5
5e33930fe2e0867cb1f9fabeddfbd7b1

SHA1
4d93c7d7e6315ca2195ed73716996ade8e17fbb2

SHA256
349c7fbe9ae2b78c2f90239bddfcea5b16a0faac1fe83553a816c50c3e9089b1

SHA512
8f87b5013e0cf3a776bfb1f1a68f316a28af3cb6c74f0adf3ead6d5063525c6668b42c077549f66267130959a9cb986bf5f8e4242fc4ef36c356d6927f587a0f

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Memory.dll

Filesize
137KB

MD5
6fb95a357a3f7e88ade5c1629e2801f8

SHA1
19bf79600b716523b5317b9a7b68760ae5d55741

SHA256
8e76318e8b06692abf7dab1169d27d15557f7f0a34d36af6463eff0fe21213c7

SHA512
293d8c709bc68d2c980a0df423741ce06d05ff757077e63986d34cb6459f9623a024d12ef35a280f50d3d516d98abe193213b9ca71bfde2a9fe8753b1a6de2f0

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Net.Http.dll

Filesize
193KB

MD5
665e355cbed5fe5f7bebc3cb23e68649

SHA1
1c2cefafba48ba7aaab746f660debd34f2f4b14c

SHA256
b5d20736f84f335ef4c918a5ba41c3a0d7189397c71b166ccc6c342427a94ece

SHA512
5300d39365e84a67010ae4c282d7e05172563119afb84dc1b0610217683c7d110803aef02945034a939262f6a7ecf629b52c0e93c1cd63d52ca7a3b3e607bb7d

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Numerics.Vectors.dll

Filesize
113KB

MD5
aaa2cbf14e06e9d3586d8a4ed455db33

SHA1
3d216458740ad5cb05bc5f7c3491cde44a1e5df0

SHA256
1d3ef8698281e7cf7371d1554afef5872b39f96c26da772210a33da041ba1183

SHA512
0b14a039ca67982794a2bb69974ef04a7fbee3686d7364f8f4db70ea6259d29640cbb83d5b544d92fa1d3676c7619cd580ff45671a2bb4753ed8b383597c6da8

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Runtime.CompilerServices.Unsafe.dll

Filesize
16KB

MD5
9a341540899dcc5630886f2d921be78f

SHA1
bab44612721c3dc91ac3d9dfca7c961a3a511508

SHA256
3cadcb6b8a7335141c7c357a1d77af1ff49b59b872df494f5025580191d1c0d5

SHA512
066984c83de975df03eee1c2b5150c6b9b2e852d9caf90cfd956e9f0f7bd5a956b96ea961b26f7cd14c089bc8a27f868b225167020c5eb6318f66e58113efa37

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Encodings.Web.dll

Filesize
66KB

MD5
e8cdacfd2ef2f4b3d1a8e6d59b6e3027

SHA1
9a85d938d8430a73255a65ea002a7709c81a4cf3

SHA256
edf13ebf2d45152e26a16b947cd953aeb7a42602fa48e53fd7673934e5acea30

SHA512
ee1005270305b614236d68e427263b4b4528ad3842057670fad061867286815577ec7d3ed8176e6683d723f9f592abcbf28d24935ce8a34571ab7f1720e2ffc5

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Text.Json.dll

Filesize
347KB

MD5
38470ca21414a8827c24d8fe0438e84b

SHA1
1c394a150c5693c69f85403f201caa501594b7ab

SHA256
2c7435257690ac95dc03b45a236005124097f08519adf3134b1d1ece4190e64c

SHA512
079f7320cc2f3b97a5733725d3b13dff17b595465159daabca5a166d39777100e5a2d9af2a75989dfabdb2f29eac0710e16c3bb2660621344b7a63c5dbb87ef8

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.Threading.Tasks.Extensions.dll

Filesize
25KB

MD5
e1e9d7d46e5cd9525c5927dc98d9ecc7

SHA1
2242627282f9e07e37b274ea36fac2d3cd9c9110

SHA256
4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6

SHA512
da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\System.ValueTuple.dll

Filesize
77KB

MD5
8c9424e37a28db7d70e7d52f0df33cf8

SHA1
81cd1acb53d493c54c8d56f379d790a901a355ac

SHA256
e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f

SHA512
cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe

Filesize
680KB

MD5
2884fdeaa62f29861ce2645dde0040f6

SHA1
01a775a431f6e4da49f5c5da2dab74cc4d770021

SHA256
2923eacd0c99a2d385f7c989882b7cca83bff133ecf176fdb411f8d17e7ef265

SHA512
470ce2cf25d7ee66f4ceb197e218872ea1b865de7029fadb0d41f3324a213b94c668968f20e228e87a879c1f0c13c9827f3b8881820d02e780d567d791ad159f

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\Traffmonetizer.exe

Filesize
680KB

MD5
e13e53a6c9efc83324751986aa7a5e79

SHA1
b5ab0ca7d2d8d52d4f390ccef67a8597e07ac456

SHA256
317321b56e5a1c635e9ae107116a0594a649d9fa18f781ce7c6034d06aef8770

SHA512
f98810f7123f765ee1a5d4930d50544fbfdb408d34a64120890b1ffc6220472eebe96155bb95b3683c2afd08e43d6b281c3801d5ef494442c5295076b59ef370

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\netstandard.dll

Filesize
96KB

MD5
0adf6f32f4d14f9b0be9aa94f7efb279

SHA1
68e1af02cddd57b5581708984c2b4a35074982a3

SHA256
8be4a2270f8b2bea40f33f79869fdcca34e07bb764e63b81ded49d90d2b720dd

SHA512
f81ac2895048333ac50e550d2b03e90003865f18058ce4a1dfba9455a5bda2485a2d31b0fdc77f6cbdfb1bb2e32d9f8ab81b3201d96d56e060e4a440719502d6

Download Submit
C:\Windows\Microsoft.NET\traffmonetizer\traffmonetizer.exe.config

Filesize
18KB

MD5
e3f86e44d1997122912dd19c93b4cc51

SHA1
55a2abf767061a27d48fc5eda94ba8156add3e81

SHA256
8905f68562e02ca9c686f8bb6edde6643c94b2592240c6ed0d40ca380e69e62d

SHA512
314f97d7889d22d1086682c2abfcf0bcb753c2103a29127407392fa05dabb69f1528c7b8028aeac48e5fd7daf0fb1e4a367e6d83f7ca73bcea8e7c6e1d1b54d5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\traffmonetizer\Installer.exe

Filesize
2.9MB

MD5
cdaeb89bd7de803ac4ca70b02fa2a2f0

SHA1
efd7c395780c29c4620ced02322137dce12a5aea

SHA256
b242e33bbb01070d1e8a573bade9d6125603affbd158bda20a1deb709f170d58

SHA512
b957d69dbdd475dd201d05c85e9b35f6036c411d102fdcd56b20ed3955c5c52abf021bbea4e9715aff5a6cc693fe207eb593614fc6f2ff1eb470bf0637eec90f

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\pid

Filesize
4B

MD5
b3848d61bbbc6207c6668a8a9e2730ed

SHA1
1e86f923a706f617980bad57d7314855c28f92f2

SHA256
8fe5f40fd0363af8853152800205f9992d86fcc57760401a43228f2600af866c

SHA512
304874efe3b8371e99a3315424eb87b896de24b8f3a54c2b18cc0f43ba996ae679ade910deb2b76bfa2cb883669b4881c798c5131b0e6d95ed7d3de32719015c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Roaming\traffmonetizer\settings.json

Filesize
98B

MD5
2e839b7ab87694f72220658502588c41

SHA1
b3996f638b1e00b4bdf5cadeab99d05492313f37

SHA256
376a0ca610d4de58de3887a8700d3e0f64fdc2123846a4f88876751847aef519

SHA512
050fe964fbdfd1a957ef3e8a1c1ce6ada6d5473be890ea318a9720a7c8e42e9fb8afcc723a03ed9deeb3f2ccbff0fe725eb0b831a24e9e4df39b7249da5688a1

Download Submit
\??\c:\users\admin\appdata\roaming\graphicsperfsvcs.dll

Filesize
14.7MB

MD5
a83318068ed77eef71f9d28e4731c179

SHA1
347f97b17ccb4f22a4e201009b6145066b600e1d

SHA256
89cd66e51f490dba5a818525bab15810604b895cebb2a5bfb4fb670ca229f972

SHA512
e790bd6cde5fc3440560d5267f3a50f3ac04ccb123d3b52608579e76877477aa630d94683e84a6cf69ea6cfc862569cc923d216185f19a934797c81eea712fbe

Download Submit
memory/1760-203-0x00000221C5280000-0x00000221C52BC000-memory.dmp

Filesize
240KB

Download
memory/1760-202-0x00000221C5220000-0x00000221C5232000-memory.dmp

Filesize
72KB

Download
memory/1760-200-0x00000221C45D0000-0x00000221C48B2000-memory.dmp

Filesize
2.9MB

Download
memory/1760-244-0x00000221DDC10000-0x00000221DDC22000-memory.dmp

Filesize
72KB

Download
memory/2920-131-0x0000000005DD0000-0x0000000005E36000-memory.dmp

Filesize
408KB

Download
memory/2920-129-0x00000000054E0000-0x0000000005502000-memory.dmp

Filesize
136KB

Download
memory/2920-147-0x0000000006960000-0x0000000006982000-memory.dmp

Filesize
136KB

Download
memory/2920-146-0x0000000007620000-0x00000000076B6000-memory.dmp

Filesize
600KB

Download
memory/2920-145-0x0000000006870000-0x000000000688A000-memory.dmp

Filesize
104KB

Download
memory/2920-144-0x0000000007CA0000-0x000000000831A000-memory.dmp

Filesize
6.5MB

Download
memory/2920-143-0x00000000063C0000-0x000000000640C000-memory.dmp

Filesize
304KB

Download
memory/2920-142-0x0000000006370000-0x000000000638E000-memory.dmp

Filesize
120KB

Download
memory/2920-141-0x0000000005E40000-0x0000000006194000-memory.dmp

Filesize
3.3MB

Download
memory/2920-127-0x0000000002A90000-0x0000000002AC6000-memory.dmp

Filesize
216KB

Download
memory/2920-130-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/2920-148-0x0000000008320000-0x00000000088C4000-memory.dmp

Filesize
5.6MB

Download
memory/2920-128-0x00000000057A0000-0x0000000005DC8000-memory.dmp

Filesize
6.2MB

Download
memory/3152-368-0x00000146C8F00000-0x00000146C8F24000-memory.dmp

Filesize
144KB

Download
memory/3152-367-0x00000146C84F0000-0x00000146C859E000-memory.dmp

Filesize
696KB

Download
memory/4612-5-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4612-14-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4612-7-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4612-6-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4808-0-0x0000000000400000-0x0000000001300000-memory.dmp

Filesize
15.0MB

Download
memory/4808-4-0x0000000000400000-0x0000000001300000-memory.dmp

Filesize
15.0MB

Download
memory/5008-154-0x0000015D85EF0000-0x0000015D85F9C000-memory.dmp

Filesize
688KB

Download
memory/5008-183-0x0000015DA19C0000-0x0000015DA1A3E000-memory.dmp

Filesize
504KB

Download
memory/5008-185-0x0000015DA1980000-0x0000015DA19B2000-memory.dmp

Filesize
200KB

Download
memory/5008-178-0x0000015D9F1D0000-0x0000015D9F1DA000-memory.dmp

Filesize
40KB

Download
memory/5008-175-0x0000015D9F0E0000-0x0000015D9F0EA000-memory.dmp

Filesize
40KB

Download
memory/5008-177-0x0000015D9F350000-0x0000015D9F382000-memory.dmp

Filesize
200KB

Download
memory/5008-172-0x0000015D9F160000-0x0000015D9F17E000-memory.dmp

Filesize
120KB

Download
memory/5008-170-0x0000015D9F0C0000-0x0000015D9F0D4000-memory.dmp

Filesize
80KB

Download
memory/5008-168-0x0000015D86850000-0x0000015D86858000-memory.dmp

Filesize
32KB

Download
memory/5008-166-0x0000015D9F0A0000-0x0000015D9F0B6000-memory.dmp

Filesize
88KB

Download
memory/5008-162-0x0000015D9F070000-0x0000015D9F096000-memory.dmp

Filesize
152KB

Download
memory/5008-164-0x0000015D867E0000-0x0000015D867EA000-memory.dmp

Filesize
40KB

Download
memory/5008-159-0x0000015D9F100000-0x0000015D9F15A000-memory.dmp

Filesize
360KB

Download
memory/5008-156-0x0000015D867F0000-0x0000015D8680E000-memory.dmp

Filesize
120KB

Download