Overview

overview

9

Static

static

1

delfino-g3-sha2.exe

windows10-2004-x64

9

delfino-g3-sha2.exe

windows11-21h2-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251015-en
  • resource tags

    arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22/11/2025, 11:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    delfino-g3-sha2.exe
  • Size 28.1MB
  • Sample251122-ngsxvs1mhr
  • SHA256 e3784efce35fc92066b4e233b9795360e2c7baa2e71f1d68135864a534c00796
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarestealerthemidatrojan

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Themida packer 40 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 8 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 4 IoCs
    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 22 IoCs
  • Executes dropped EXE 27 IoCs
  • Launches sc.exe 6 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    defense_evasiontrojan
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Modifies trusted root certificate store through registry 1 TTPs 4 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • System Location Discovery: System Language Discovery 1 TTPs 33 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 9 IoCs

    Inno Setup installer

    installer
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\delfino-g3-sha2.exe
    "C:\Users\Admin\AppData\Local\Temp\delfino-g3-sha2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5708
    • C:\Users\Admin\AppData\Local\Temp\is-01GGP.tmp\delfino-g3-sha2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-01GGP.tmp\delfino-g3-sha2.tmp" /SL5="$3023E,29037154,118784,C:\Users\Admin\AppData\Local\Temp\delfino-g3-sha2.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3924
      • C:\Users\Admin\AppData\Local\Temp\is-TMCVJ.tmp\delfino-g3-setup-x86.exe
        "C:\Users\Admin\AppData\Local\Temp\is-TMCVJ.tmp\delfino-g3-setup-x86.exe" /VERYSILENT /NORESTART
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Users\Admin\AppData\Local\Temp\is-C06HA.tmp\delfino-g3-setup-x86.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-C06HA.tmp\delfino-g3-setup-x86.tmp" /SL5="$70348,28214378,118784,C:\Users\Admin\AppData\Local\Temp\is-TMCVJ.tmp\delfino-g3-setup-x86.exe" /VERYSILENT /NORESTART
          4⤵
          • Adds Run key to start application
          • Event Triggered Execution: Image File Execution Options Injection
          • Drops file in Program Files directory
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1140
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" stop WizveraPMSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3368
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" stop WizveraPMSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:3396
          • C:\Windows\SysWOW64\CheckNetIsolation.exe
            "CheckNetIsolation" LoopbackExempt -a -n=Microsoft.MicrosoftEdge_8wekyb3d8bbwe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:6132
          • C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\delfinounloader-g3.exe
            "C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\delfinounloader-g3.exe" /link
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:4700
          • C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\wizcertutil.exe
            "C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\wizcertutil.exe" /force /gencert /target delfino
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Modifies trusted root certificate store through registry
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:6092
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -L -d "./"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:440
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -L -d sql:"./"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2156
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d "./"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:4872
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d sql:"./"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:3720
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -L -d "./"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:4792
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -D -n "" -d Delfino-CA"./"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:4772
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -L -d sql:"./"
              6⤵
              • Executes dropped EXE
              PID:568
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -D -n "sql:" -d Delfino-CA"./"
              6⤵
              • Executes dropped EXE
              PID:1264
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d "./"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1752
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d sql:"./"
              6⤵
              • Executes dropped EXE
              PID:1876
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -L -d "./"
              6⤵
              • Executes dropped EXE
              PID:1616
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -L -d sql:"./"
              6⤵
              • Executes dropped EXE
              PID:860
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d "./"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5960
            • \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\certutil.exe
              "c:\users\admin\appdata\local\temp\is-j9nek.tmp\.\nss_new\certutil.exe" -A -n "Delfino-CA" -t "TCu,Cuw,Tuw" -i "C:\ProgramData\Wizvera\Delfino\delfino_ca.crt" -d sql:"./"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:5020
          • C:\Program Files (x86)\Wizvera\Delfino-G3\wizveraregsvr.exe
            "C:\Program Files (x86)\Wizvera\Delfino-G3\wizveraregsvr.exe" delfino.dll
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:1256
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\system32\regsvr32" delfino.dll /s
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:5324
          • C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\wpmsvcsetup.exe
            "C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\wpmsvcsetup.exe" /VERYSILENT
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1868
            • C:\Users\Admin\AppData\Local\Temp\is-PKT3M.tmp\wpmsvcsetup.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-PKT3M.tmp\wpmsvcsetup.tmp" /SL5="$800DE,5451002,118784,C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\wpmsvcsetup.exe" /VERYSILENT
              6⤵
              • Event Triggered Execution: Image File Execution Options Injection
              • Drops file in Program Files directory
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:3732
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\system32\sc.exe" stop WizveraPMSvc
                7⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:1324
              • C:\Program Files (x86)\Wizvera\Common\wpmsvc\WizSvcUtil.exe
                "C:\Program Files (x86)\Wizvera\Common\wpmsvc\WizSvcUtil.exe" -fw add
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • System Location Discovery: System Language Discovery
                PID:2824
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall show rule name="Wizvera-Delfino-G3-in" dir=in
                  8⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:3780
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Wizvera-Delfino-G3-in" dir=in program="C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.exe" action=allow
                  8⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:2888
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall show rule name="Wizvera-Delfino-G3-out" dir=out
                  8⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:5776
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Wizvera-Delfino-G3-out" dir=out program="C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.exe" action=allow
                  8⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  • System Location Discovery: System Language Discovery
                  PID:432
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\system32\sc.exe" config WizveraPMSvc start= auto
                7⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:1508
              • C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe
                "C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe" /i
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • System Location Discovery: System Language Discovery
                PID:5456
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\system32\sc.exe" start WizveraPMSvc
                7⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:4940
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\system32\sc.exe" start WizveraPMSvc
            5⤵
            • Launches sc.exe
            • System Location Discovery: System Language Discovery
            PID:5656
      • C:\Program Files (x86)\wizvera\delfino-g3\delfino.exe
        "C:\Program Files (x86)\wizvera\delfino-g3\delfino.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        PID:4584
  • C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.exe
    "C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.exe" wizvera-delfino-pc://exec/x86/16107/
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5228
  • C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe
    "C:\Program Files (x86)\Wizvera\Common\wpmsvc\wpmsvc.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Modifies trusted root certificate store through registry
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    PID:1964

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Event Triggered Execution

        2
        T1546

        Image File Execution Options Injection

        1
        T1546.012

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        2
        T1543

        Windows Service

        2
        T1543.003

        Event Triggered Execution

        2
        T1546

        Image File Execution Options Injection

        1
        T1546.012

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Impair Defenses

        2
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Modify Registry

        3
        T1112

        Subvert Trust Controls

        2
        T1553

        Install Root Certificate

        2
        T1553.004

        Virtualization/Sandbox Evasion

        1
        T1497

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Query Registry

        3
        T1012

        System Information Discovery

        3
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Virtualization/Sandbox Evasion

        1
        T1497

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Service Stop

        1
        T1489

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        delfino.dll
        • Path C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.dll
        • Size 19.4MB
        • SHA256 179298c734fe5a344090ffa1ceeb2a5f81c21b5371b6cf303abc708a51d617bf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        delfino.exe
        • Path C:\Program Files (x86)\Wizvera\Delfino-G3\delfino.exe
        • Size 4.1MB
        • SHA256 f0f548bb8c4d480040b7ad8d4eb1f000f8d29bdba0e6d5c49089c6fe89a5905c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        delfino_ca.crt
        • Path C:\ProgramData\Wizvera\Delfino\delfino_ca.crt
        • Size 1KB
        • SHA256 e86c1be2353683dc0ad50de64364d8734c66616b6870d05ba6b16fc8007a2e73
        • MD5 SHA1 SHA512
        Submit Download

        delfino-g3-sha2.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\is-01GGP.tmp\delfino-g3-sha2.tmp
        • Size 1.1MB
        • SHA256 61674b90891ca099d5fee62bf063a948a80863530ab6a31e7f9e06f0e5bc7599
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _shfoldr.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\_isetup\_shfoldr.dll
        • Size 22KB
        • SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        delfinounloader-g3.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\delfinounloader-g3.exe
        • Size 4.5MB
        • SHA256 fa28a0b012ec31ce3eccbc30a542e5ae88928abb49729b1c57325a9b347f4051
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        certutil.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\nss_new\certutil.exe
        • Size 112KB
        • SHA256 64ad18f4d9bef01b86e39ca1e774dfa37db46bc8267453c418dd7f723d6d014c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        msvcr120.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\nss_new\msvcr120.dll
        • Size 948KB
        • SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nspr4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\nss_new\nspr4.dll
        • Size 155KB
        • SHA256 2d2096447b366d6640f2670edb474ab208d8d85b5650db5e80cc985d1189f911
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nss3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\nss_new\nss3.dll
        • Size 788KB
        • SHA256 96e068e6162a98d212b57c86b14fc539f1bbdccd363f68efd8cdfecc90c699d3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nssdbm3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\nss_new\nssdbm3.dll
        • Size 100KB
        • SHA256 f64111faa9966d7b7859c6467bedbd64559284b049f55ffadc54dfc50a3a4264
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        plc4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\nss_new\plc4.dll
        • Size 13KB
        • SHA256 09f01488a002915b8472a4e82adb7a3e8cb43bd77db347b0178eae614f846a0a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        plds4.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\nss_new\plds4.dll
        • Size 11KB
        • SHA256 20166e281b31ae60672b9d87cb69fcba0c38cc5e18a8ba081c5601ccfab7589f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        softokn3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\nss_new\softokn3.dll
        • Size 166KB
        • SHA256 b1316e04b3bf464906f4e015d3e71b4e06a65cc6e59a20a96984ee1e862dcb0e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\nss_new\sqlite3.dll
        • Size 467KB
        • SHA256 d2d0b729837574d2eb6adac4f819bc4f8534ac9a43b17663942b2401a02db02a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        wizcertutil.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\wizcertutil.exe
        • Size 6.4MB
        • SHA256 ab39c61c41f15a3ea5651de921d59fc12bf25ffa01a015c7eb4922d88b3eab9c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        wizvera1_ca.crt
        • Path C:\Users\Admin\AppData\Local\Temp\is-J9NEK.tmp\wizvera1_ca.crt
        • Size 1KB
        • SHA256 88dcd9dec617218506c92814c2ab22fa7eaabe51cf8282465d3f70382d1d2cec
        • MD5 SHA1 SHA512
        Submit Download

        delfino-g3-setup-x86.exe
        • Path C:\Users\Admin\AppData\Local\Temp\is-TMCVJ.tmp\delfino-g3-setup-x86.exe
        • Size 27.3MB
        • SHA256 d2ed1030a9de5f108ae9447e1bb786be1384b74569d685264fb7961b6c23a223
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        key4.db
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2em1xcn7.Admin\key4.db
        • Size 9KB
        • SHA256 020b3c13b4dc97a12af70e1330d364ff2b17d08b6e4f607f3527ebcf962a2421
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        key3.db
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\key3.db
        • Size 16KB
        • SHA256 291915631f963fafbde85aa8bfb6e648a35450763cf3fa70003e76dd61cce34f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pkcs11.txt
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\5rm9ff4w.default-release\pkcs11.txt
        • Size 583B
        • SHA256 d7bbe51bd157d384c4523e5c3ffab0e9f6ca7115d459d3f876d4b1e135209b53
        • MD5 SHA1 SHA512
        Submit Download

        freebl3.dll
        • Path \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\freebl3.dll
        • Size 314KB
        • SHA256 f63b2cab4b77ac63a1beca66872a991e1f8233f2c513d42460dbf28c733b138c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nssckbi.dll
        • Path \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\nssckbi.dll
        • Size 426KB
        • SHA256 bfa1de077f19afc7b21feb41891b4200a40b4dda114f483d4eb92ff7a375926d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nssutil3.dll
        • Path \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\nssutil3.dll
        • Size 108KB
        • SHA256 ba9341807b42e90bb0380d51a83d3d6a0de7d57b6820a8b0cbe5e36e978860fa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        smime3.dll
        • Path \??\c:\users\admin\appdata\local\temp\is-j9nek.tmp\nss_new\smime3.dll
        • Size 96KB
        • SHA256 b0104ea7aaa257b111982bd0763c1c47fff76bd70249f84dcad834d50444df1a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1140-211-0x00000000022A0000-0x00000000022A1000-memory.dmp
        Download

        memory/1140-25-0x00000000022A0000-0x00000000022A1000-memory.dmp
        Download

        memory/1140-240-0x0000000000400000-0x000000000052B000-memory.dmp
        Download

        memory/1140-277-0x0000000000400000-0x000000000052B000-memory.dmp
        Download

        memory/1256-237-0x0000000010000000-0x0000000011394000-memory.dmp
        Download

        memory/1868-243-0x0000000000400000-0x0000000000427000-memory.dmp
        Download

        memory/1868-276-0x0000000000400000-0x0000000000427000-memory.dmp
        Download

        memory/1964-273-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-290-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-322-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-319-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-286-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-316-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-293-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-274-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-313-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-296-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-272-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-301-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-310-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-304-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/1964-307-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/2824-261-0x0000000000010000-0x000000000049B000-memory.dmp
        Download

        memory/2824-266-0x0000000000010000-0x000000000049B000-memory.dmp
        Download

        memory/2824-259-0x0000000000010000-0x000000000049B000-memory.dmp
        Download

        memory/2824-260-0x0000000000010000-0x000000000049B000-memory.dmp
        Download

        memory/3732-275-0x0000000000400000-0x000000000052B000-memory.dmp
        Download

        memory/3924-238-0x0000000000400000-0x000000000052B000-memory.dmp
        Download

        memory/3924-13-0x00000000023E0000-0x00000000023E1000-memory.dmp
        Download

        memory/3924-279-0x0000000000400000-0x000000000052B000-memory.dmp
        Download

        memory/3924-6-0x00000000023E0000-0x00000000023E1000-memory.dmp
        Download

        memory/3924-12-0x0000000000400000-0x000000000052B000-memory.dmp
        Download

        memory/4424-239-0x0000000000400000-0x0000000000427000-memory.dmp
        Download

        memory/4424-19-0x0000000000400000-0x0000000000427000-memory.dmp
        Download

        memory/4424-278-0x0000000000400000-0x0000000000427000-memory.dmp
        Download

        memory/4584-283-0x0000000000400000-0x000000000080E000-memory.dmp
        Download

        memory/4700-34-0x0000000000400000-0x0000000000880000-memory.dmp
        Download

        memory/4700-35-0x0000000000400000-0x0000000000880000-memory.dmp
        Download

        memory/5228-265-0x0000000010000000-0x0000000011394000-memory.dmp
        Download

        memory/5228-262-0x0000000000400000-0x000000000080E000-memory.dmp
        Download

        memory/5228-111-0x0000000010000000-0x0000000011394000-memory.dmp
        Download

        memory/5228-101-0x0000000000400000-0x000000000080E000-memory.dmp
        Download

        memory/5324-241-0x0000000010000000-0x0000000011394000-memory.dmp
        Download

        memory/5456-270-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/5456-271-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/5456-269-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/5456-268-0x00000000004E0000-0x0000000000A47000-memory.dmp
        Download

        memory/5708-280-0x0000000000400000-0x0000000000427000-memory.dmp
        Download

        memory/5708-0-0x0000000000400000-0x0000000000427000-memory.dmp
        Download

        memory/5708-11-0x0000000000400000-0x0000000000427000-memory.dmp
        Download

        memory/6092-235-0x0000000000120000-0x0000000000787000-memory.dmp
        Download

        memory/6092-99-0x0000000000120000-0x0000000000787000-memory.dmp
        Download

        memory/6092-103-0x0000000000120000-0x0000000000787000-memory.dmp
        Download

        memory/6092-104-0x0000000000120000-0x0000000000787000-memory.dmp
        Download