Behavioral Report

Resubmissions

19-01-2021 19:24

210119-s26yznnqsn 10

19-11-2020 13:14

201119-s41ec6lt86 10

Analysis

max time kernel
1803s
max time network
447s
platform
windows10_x64
resource
win10v20201028
submitted
19-11-2020 13:14

Sharing

Copy URL

Twitter E-mail

Report Files Registry Network Processes Mutex Misc

General

Target

Magic_File_v3_keygen_by_KeygenNinja.exe

Score

10^/10

pony bootkit discovery evasion persistence rat rezer0 spyware stealer trojan upx

Malware Config

Signatures

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

Nirsoft ⋅ 6 IoCs

Processes:

resource	yara_rule
behavioral27/files/0x000200000001abb8-44.dat	Nirsoft
behavioral27/files/0x000200000001abb8-43.dat	Nirsoft
behavioral27/files/0x000100000001abd5-59.dat	Nirsoft
behavioral27/files/0x000100000001abd5-60.dat	Nirsoft
behavioral27/files/0x000200000001a2df-92.dat	Nirsoft
behavioral27/files/0x000200000001a2df-93.dat	Nirsoft

ReZer0 packer ⋅ 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
rezer0

Processes:

resource yara_rule

behavioral27/memory/1440-65-0x0000000004DD0000-0x0000000004DD9000-memory.dmp rezer0
Blocklisted process makes network request ⋅ 1 IoCs

Processes:

rundll32.exe

flow pid process

12 200 rundll32.exe

resource	yara_rule
behavioral27/memory/1440-65-0x0000000004DD0000-0x0000000004DD9000-memory.dmp	rezer0

flow	pid	process
12	200	rundll32.exe

Executes dropped EXE ⋅ 18 IoCs

Processes:

keygen-pr.exekeygen-step-3.exekeygen-step-4.exekey.exeSetup.exekey.exe1605791984389.exeBTRSetp.exe1605791987088.exeBTRSetp.exeBTRSetp.exejuppp.exejfiag_gg.exejfiag_gg.exeid6.exelcx.exesetup_full.exewyfdggaa.exe

pid	process
3284	keygen-pr.exe
3596	keygen-step-3.exe
3908	keygen-step-4.exe
2052	key.exe
984	Setup.exe
4084	key.exe
864	1605791984389.exe
1440	BTRSetp.exe
4220	1605791987088.exe
4364	BTRSetp.exe
4376	BTRSetp.exe
4396	juppp.exe
4480	jfiag_gg.exe
4608	jfiag_gg.exe
4684	id6.exe
4736	lcx.exe
816	setup_full.exe
4408	wyfdggaa.exe

UPX packed file ⋅ 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral27/files/0x000100000001abc1-74.dat	upx
behavioral27/files/0x000100000001abc1-73.dat	upx
behavioral27/files/0x000200000001a2df-76.dat	upx
behavioral27/files/0x000200000001a2df-77.dat	upx

Checks computer location settings ⋅ 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

TTPs:

Query Registry System Information Discovery

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation cmd.exe
Reads data files stored by FTP clients ⋅ 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

TTPs:

Data from Local System Credentials in Files
Reads user/profile data of web browsers ⋅ 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

TTPs:

Data from Local System Credentials in Files
Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
spyware

TTPs:

Data from Local System Credentials in Files

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\International\Geo\Nation	cmd.exe

Adds Run key to start application ⋅ 2 TTPs 1 IoCs

persistence

TTPs:

Registry Run Keys / Startup Folder Modify Registry

Processes:

juppp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kissq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kissq.exe"	juppp.exe

Checks installed software on the system ⋅ 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

TTPs:

Query Registry

Checks whether UAC is enabled ⋅ 1 TTPs 2 IoCs

evasion trojan

TTPs:

System Information Discovery

Processes:

Setup.exewyfdggaa.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wyfdggaa.exe

Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs

TTPs:

Web Service
Looks up external IP address via web service ⋅ 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 ip-api.com
Writes to the Master Boot Record (MBR) ⋅ 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

TTPs:

Bootkit

Processes:

Setup.exerundll32.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Setup.exe
File opened for modification \??\PhysicalDrive0 rundll32.exe
Suspicious use of NtSetInformationThreadHideFromDebugger ⋅ 1 IoCs

Processes:

Setup.exe

pid process

984 Setup.exe

flow	ioc
20	ip-api.com

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Setup.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe

pid	process
984	Setup.exe

Suspicious use of SetThreadContext ⋅ 6 IoCs

Processes:

key.exeSetup.exerundll32.exeBTRSetp.exe

description	pid	process	target process
PID 2052 set thread context of 4084	2052	key.exe	key.exe
PID 984 set thread context of 200	984	Setup.exe	rundll32.exe
PID 984 set thread context of 1716	984	Setup.exe	rundll32.exe
PID 984 set thread context of 568	984	Setup.exe	rundll32.exe
PID 568 set thread context of 4252	568	rundll32.exe	rundll32.exe
PID 1440 set thread context of 4376	1440	BTRSetp.exe	BTRSetp.exe

Drops file in Windows directory ⋅ 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices ⋅ 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

TTPs:

System Information Discovery
Program crash ⋅ 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4536 4376 WerFault.exe BTRSetp.exe
Kills process with taskkill ⋅ 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

2144 taskkill.exe
2120 taskkill.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

pid	pid_target	process	target process
4536	4376	WerFault.exe	BTRSetp.exe

pid	process
2144	taskkill.exe
2120	taskkill.exe

Modifies Internet Explorer settings ⋅ 1 TTPs 3 IoCs

adware spyware

TTPs:

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class ⋅ 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org\NumberOfSubdomai = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org\ = "669"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$Discuz!	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658B = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = b053313aa9bed601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 21c3fdda76bed601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org\Total = "651"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 6c3a3b6c55add601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\iplogger.org\Total = "669"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{BDB76443-E6F3-4EA7-9893-8F806D3E17B9} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{85A24B7A-FD81-4617-910A-0C0A1F9DE8CE}"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompleted = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "651"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8e27e1da76bed601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\5FF1348C80820F2A98 = 0300000001000000140000005ff1348c80820f2a988d0c0c7abea0ea394b5e6c040000000100000010000000fd42404f68fae3f0d490e8d19d08ab1d0f00000001000000200000005546bb2210de2560292e6f4610af4ffbdb453f9bf9983e62942c35959e16038d140000000100000014000000b3b30880146b0eb235e8e136e7d15c9c4847f5f3190000000100000010000000e142e209d34bfb2eac257eb76a2b61e15c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000e5050000308205e1308203c9a0030201020213330000016fd585f24b93e88a0700000000016f300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3139313231323030303333315a170d3231303331323030303333315a3081a3310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3121301f06092a864886f70d010901161271666265406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfb24782c35c66c63688c01ed857df9a4330b81628c86831de4d577f8cb2155b880ee41953a18ac28de644bacfa97558ec6f522490f103b7fa0092430f8e0ba55c36dd91f6f1f91baec6eb3581d89133141e1580e02ec2445e5380b178f92f81e97193be8be1223d36e5f2be070a3db6ac17987ea3b42d15994c73a10e64794da4660a5d875e179c567bb06ecfd7cbf4c1ee4fe453284e72877d746a3e178788a1bd540ba9250a931a11105bb98f1b2b757fa6c5ade16e7cc1d1628fedb716018526f5b56630b54cd5f75f938e9b4a956609cc441aac84a10a101f6429b6fceb9434a41b24f0ca9781bf72b010f14bd13dc5d996b6ed6c4d53156969dd04f7390203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414b3b30880146b0eb235e8e136e7d15c9c4847f5f3301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038202010064d81278e224099c122690412271d5f2d92ae1c00f7135d64f63663ccc0588826bf24cc6cffa0d6666b7e3f989825dd1021fd1bdc6a9d4a492c0f46198534382204d8668b0f3c8d85f9f614f7fff47e391a4fdc89dba1b423f1d2a8d4986ff42bac032a21224b246b03ffef26e7da49d3ef381ff9d669cda0234445bff395be1b70627f013ccde692280d75d690b4f4c5e3a123b379bd30bdc6cf1af0c69d97eb0aa4f580eb4e876465b2c62514a612a3971f6bc6ace33f569e0cbcbd5498caf2af949952c310221a382d0a7fbc4594b0bfe96a1c81d26639b249beea28179ead8377bf70e9a09596997af2b405c5425a1e5e6e46b065016901b7cd120e2389d47924b1f834955135461f7592c9487e3910bf0de382ad5906dd8c46b321b176698caaec19d1ee10aa6679981d8f2f5c40d69240a7075ce4341305d2bbd082e03c81c41baeb557b41904482ae88d0566f339ab517ae2f84223d567f9ec734c1c5a2be39aa24c49930b6428bbe2fa300f2369e1c8cc554c14010f1ee518afa32e4bf0a15cb251d37791338f5ade8ced4b67ca5fc56320c2c2973f9b13e250dabe4a373580becf787afd552c6b293dfc7bfb1f67739c64df74ae3d373e2db9c27090fe15e58591824e4f150602af628917a6d1353919cd0a8489596f97070833a98b34c2d3a0ebafda2f81096533b773c5914d7f05e66cb17af2bcd11ad517440b5	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\RulesFileNextUpdateDate = "312565665"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BingPageData\Enabled = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe

Runs ping.exe ⋅ 1 TTPs 3 IoCs

TTPs:

Remote System Discovery

Processes:

PING.EXEPING.EXEPING.EXE

pid process

1476 PING.EXE
696 PING.EXE
1212 PING.EXE

pid	process
1476	PING.EXE
696	PING.EXE
1212	PING.EXE

Suspicious behavior: EnumeratesProcesses ⋅ 27 IoCs

Processes:

1605791984389.exe1605791987088.exekey.exeBTRSetp.exeWerFault.exejfiag_gg.exe

pid	process
864	1605791984389.exe
864	1605791984389.exe
4220	1605791987088.exe
4220	1605791987088.exe
2052	key.exe
2052	key.exe
1440	BTRSetp.exe
1440	BTRSetp.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4536	WerFault.exe
4608	jfiag_gg.exe
4608	jfiag_gg.exe

Suspicious behavior: MapViewOfSection ⋅ 2 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

3820 MicrosoftEdgeCP.exe
3820 MicrosoftEdgeCP.exe

pid	process
3820	MicrosoftEdgeCP.exe
3820	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken ⋅ 58 IoCs

Processes:

taskkill.exetaskkill.exekey.exeBTRSetp.exeWerFault.exeMicrosoftEdge.exeMicrosoftEdgeCP.exewyfdggaa.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	2144	taskkill.exe
Token: SeDebugPrivilege	2120	taskkill.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeImpersonatePrivilege	2052	key.exe
Token: SeTcbPrivilege	2052	key.exe
Token: SeChangeNotifyPrivilege	2052	key.exe
Token: SeCreateTokenPrivilege	2052	key.exe
Token: SeBackupPrivilege	2052	key.exe
Token: SeRestorePrivilege	2052	key.exe
Token: SeIncreaseQuotaPrivilege	2052	key.exe
Token: SeAssignPrimaryTokenPrivilege	2052	key.exe
Token: SeDebugPrivilege	1440	BTRSetp.exe
Token: SeRestorePrivilege	4536	WerFault.exe
Token: SeBackupPrivilege	4536	WerFault.exe
Token: SeDebugPrivilege	4536	WerFault.exe
Token: SeDebugPrivilege	4312	MicrosoftEdge.exe
Token: SeDebugPrivilege	4312	MicrosoftEdge.exe
Token: SeDebugPrivilege	4312	MicrosoftEdge.exe
Token: SeDebugPrivilege	4312	MicrosoftEdge.exe
Token: SeDebugPrivilege	4696	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4696	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4696	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4696	MicrosoftEdgeCP.exe
Token: SeManageVolumePrivilege	4408	wyfdggaa.exe
Token: SeManageVolumePrivilege	4408	wyfdggaa.exe
Token: SeDebugPrivilege	1896	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1896	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx ⋅ 10 IoCs

Processes:

rundll32.exeid6.exeMicrosoftEdge.exewyfdggaa.exeMicrosoftEdgeCP.exe

pid	process
4252	rundll32.exe
4684	id6.exe
4684	id6.exe
4312	MicrosoftEdge.exe
4408	wyfdggaa.exe
3820	MicrosoftEdgeCP.exe
3820	MicrosoftEdgeCP.exe
4408	wyfdggaa.exe
4408	wyfdggaa.exe
4408	wyfdggaa.exe

Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes:

Magic_File_v3_keygen_by_KeygenNinja.execmd.exekeygen-step-3.exekeygen-pr.execmd.exekeygen-step-4.exekey.exeSetup.exerundll32.exe

description	pid	process	target process
PID 912 wrote to memory of 196	912	Magic_File_v3_keygen_by_KeygenNinja.exe	cmd.exe
PID 912 wrote to memory of 196	912	Magic_File_v3_keygen_by_KeygenNinja.exe	cmd.exe
PID 912 wrote to memory of 196	912	Magic_File_v3_keygen_by_KeygenNinja.exe	cmd.exe
PID 196 wrote to memory of 3284	196	cmd.exe	keygen-pr.exe
PID 196 wrote to memory of 3284	196	cmd.exe	keygen-pr.exe
PID 196 wrote to memory of 3284	196	cmd.exe	keygen-pr.exe
PID 196 wrote to memory of 3596	196	cmd.exe	keygen-step-3.exe
PID 196 wrote to memory of 3596	196	cmd.exe	keygen-step-3.exe
PID 196 wrote to memory of 3596	196	cmd.exe	keygen-step-3.exe
PID 3596 wrote to memory of 3904	3596	keygen-step-3.exe	cmd.exe
PID 3596 wrote to memory of 3904	3596	keygen-step-3.exe	cmd.exe
PID 3596 wrote to memory of 3904	3596	keygen-step-3.exe	cmd.exe
PID 196 wrote to memory of 3908	196	cmd.exe	keygen-step-4.exe
PID 196 wrote to memory of 3908	196	cmd.exe	keygen-step-4.exe
PID 196 wrote to memory of 3908	196	cmd.exe	keygen-step-4.exe
PID 3284 wrote to memory of 2052	3284	keygen-pr.exe	key.exe
PID 3284 wrote to memory of 2052	3284	keygen-pr.exe	key.exe
PID 3284 wrote to memory of 2052	3284	keygen-pr.exe	key.exe
PID 3904 wrote to memory of 1476	3904	cmd.exe	PING.EXE
PID 3904 wrote to memory of 1476	3904	cmd.exe	PING.EXE
PID 3904 wrote to memory of 1476	3904	cmd.exe	PING.EXE
PID 3908 wrote to memory of 984	3908	keygen-step-4.exe	Setup.exe
PID 3908 wrote to memory of 984	3908	keygen-step-4.exe	Setup.exe
PID 3908 wrote to memory of 984	3908	keygen-step-4.exe	Setup.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 2052 wrote to memory of 4084	2052	key.exe	key.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 200	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 1716	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 568	984	Setup.exe	rundll32.exe
PID 984 wrote to memory of 2004	984	Setup.exe	cmd.exe
PID 984 wrote to memory of 2004	984	Setup.exe	cmd.exe
PID 984 wrote to memory of 2004	984	Setup.exe	cmd.exe
PID 200 wrote to memory of 864	200	rundll32.exe	1605791984389.exe

C:\Users\Admin\AppData\Local\Temp\Magic_File_v3_keygen_by_KeygenNinja.exe

"C:\Users\Admin\AppData\Local\Temp\Magic_File_v3_keygen_by_KeygenNinja.exe"

Suspicious use of WriteProcessMemory

PID:912

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "

Suspicious use of WriteProcessMemory

PID:196

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe

keygen-pr.exe -p83fsase3Ge

Executes dropped EXE
Suspicious use of WriteProcessMemory

PID:3284

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"

Executes dropped EXE
Suspicious use of SetThreadContext
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory

PID:2052

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe

C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat

Executes dropped EXE

PID:4084

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe

keygen-step-3.exe

Executes dropped EXE
Suspicious use of WriteProcessMemory

PID:3596

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"

Suspicious use of WriteProcessMemory

PID:3904

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

Runs ping.exe

PID:1476

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe

keygen-step-4.exe

Executes dropped EXE
Suspicious use of WriteProcessMemory

PID:3908

C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"

Executes dropped EXE
Checks whether UAC is enabled
Writes to the Master Boot Record (MBR)
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory

PID:984

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe 001 install5

Blocklisted process makes network request
Writes to the Master Boot Record (MBR)
Suspicious use of WriteProcessMemory

PID:200

C:\Users\Admin\AppData\Roaming\1605791984389.exe

"C:\Users\Admin\AppData\Roaming\1605791984389.exe" /sjson "C:\Users\Admin\AppData\Roaming\1605791984389.txt"

Executes dropped EXE
Suspicious behavior: EnumeratesProcesses

PID:864

C:\Users\Admin\AppData\Roaming\1605791987088.exe

"C:\Users\Admin\AppData\Roaming\1605791987088.exe" /sjson "C:\Users\Admin\AppData\Roaming\1605791987088.txt"

Executes dropped EXE
Suspicious behavior: EnumeratesProcesses

PID:4220

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe 002 install5

PID:1716

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c taskkill /f /im chrome.exe

PID:3444

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im chrome.exe

Kills process with taskkill
Suspicious use of AdjustPrivilegeToken

PID:2144

C:\Windows\SysWOW64\cmd.exe

cmd.exe /c taskkill /f /im firefox.exe

PID:796

C:\Windows\SysWOW64\taskkill.exe

taskkill /f /im firefox.exe

Kills process with taskkill
Suspicious use of AdjustPrivilegeToken

PID:2120

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.exe 003 install5

Suspicious use of SetThreadContext

PID:568

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe"

Suspicious use of SetWindowsHookEx

PID:4252

C:\Windows\SysWOW64\cmd.exe

cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"

PID:2004

C:\Windows\SysWOW64\PING.EXE

ping 127.0.0.1 -n 3

Runs ping.exe

PID:696

C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"

Executes dropped EXE
Suspicious use of SetThreadContext
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:1440

C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

"{path}"

Executes dropped EXE

PID:4364

C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

"{path}"

Executes dropped EXE

PID:4376

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 1408

Program crash
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken

PID:4536

C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe"

Executes dropped EXE
Adds Run key to start application

PID:4396

C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe

C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt

Executes dropped EXE

PID:4480

C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe

C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt

Executes dropped EXE
Suspicious behavior: EnumeratesProcesses

PID:4608

C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe"

Executes dropped EXE
Suspicious use of SetWindowsHookEx

PID:4684

C:\Users\Admin\AppData\Local\Temp\RarSFX2\lcx.exe

lcx.exe version2.txt

Executes dropped EXE

PID:4736

C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe"

Executes dropped EXE

PID:816

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe"

PID:2056

C:\Windows\SysWOW64\PING.EXE

ping 1.1.1.1 -n 1 -w 3000

Runs ping.exe

PID:1212

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX2\DreamTrips.bat" "

Checks computer location settings

PID:1428

C:\Users\Admin\AppData\Local\Temp\RarSFX2\wyfdggaa.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX2\wyfdggaa.exe"

Executes dropped EXE
Checks whether UAC is enabled
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx

PID:4408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca

Drops file in Windows directory
Modifies Internet Explorer settings
Modifies registry class
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx

PID:4312

C:\Windows\system32\browser_broker.exe

C:\Windows\system32\browser_broker.exe -Embedding

Modifies Internet Explorer settings

PID:3840

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

Modifies registry class
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx

PID:3820

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

Modifies Internet Explorer settings
Modifies registry class
Suspicious use of AdjustPrivilegeToken

PID:4696

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

Modifies registry class
Suspicious use of AdjustPrivilegeToken

PID:1896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

Modifies registry class

PID:3648

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca

Modifies registry class

PID:4720

Network

MITRE ATT&CK Matrix

Collection

Data from Local System

Command and Control

Credential Access

Credentials in Files

Defense Evasion

Discovery

Execution

Exfiltration

Impact

Initial Access

Lateral Movement

Persistence

Privilege Escalation

Replay Monitor

00:00 00:00

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\InetCookies\BPNKC7V0.cookie

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.dat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\potato.dat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Config.ini

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\DreamTrips.bat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe
MD5
4daaeeeba9222078c92a61b2dabbe1d3

SHA1
0efc3cf265a697995a318eb2ac1ea2854af4d4cd

SHA256
a3d1bbbae88dc886822c41503e47fb2d475160d81f99ab6621d60cfa59b3effd

SHA512
2f8b73a414f96a36b54ed703054fb2a43ea2799d21076a2be75b8c5e7b49245d9a836a9dc1b5413f08366927a4839d158aa8f2c8b3b7589b5f0639b5a807dde4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\juppp.exe
MD5
4daaeeeba9222078c92a61b2dabbe1d3

SHA1
0efc3cf265a697995a318eb2ac1ea2854af4d4cd

SHA256
a3d1bbbae88dc886822c41503e47fb2d475160d81f99ab6621d60cfa59b3effd

SHA512
2f8b73a414f96a36b54ed703054fb2a43ea2799d21076a2be75b8c5e7b49245d9a836a9dc1b5413f08366927a4839d158aa8f2c8b3b7589b5f0639b5a807dde4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\lcx.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\lcx.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\setup_full.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\version2.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\wyfdggaa.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\wyfdggaa.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
MD5
4d4c98eca32b14aeb074db34cd0881e4

SHA1
92f213d609bba05d41d6941652a88c44936663a4

SHA256
4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

SHA512
959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
MD5
4d4c98eca32b14aeb074db34cd0881e4

SHA1
92f213d609bba05d41d6941652a88c44936663a4

SHA256
4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

SHA512
959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

Download Submit
C:\Users\Admin\AppData\Roaming\1605791984389.exe
MD5
ef6f72358cb02551caebe720fbc55f95

SHA1
b5ee276e8d479c270eceb497606bd44ee09ff4b8

SHA256
6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5

SHA512
ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90

Download Submit
C:\Users\Admin\AppData\Roaming\1605791984389.exe
MD5
ef6f72358cb02551caebe720fbc55f95

SHA1
b5ee276e8d479c270eceb497606bd44ee09ff4b8

SHA256
6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5

SHA512
ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90

Download Submit
C:\Users\Admin\AppData\Roaming\1605791984389.txt

Download Submit
C:\Users\Admin\AppData\Roaming\1605791987088.exe
MD5
ef6f72358cb02551caebe720fbc55f95

SHA1
b5ee276e8d479c270eceb497606bd44ee09ff4b8

SHA256
6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5

SHA512
ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90

Download Submit
C:\Users\Admin\AppData\Roaming\1605791987088.exe
MD5
ef6f72358cb02551caebe720fbc55f95

SHA1
b5ee276e8d479c270eceb497606bd44ee09ff4b8

SHA256
6562bdcbf775e04d8238c2b52a4e8df5afa1e35d1d33d1e4508cfe040676c1e5

SHA512
ea3f0cf40ed3aa3e43b7a19ed6412027f76f9d2d738e040e6459415aa1e5ef13c29ca830a66430c33e492558f7c5f0cc86e1df9474322f231f8506e49c3a1a90

Download Submit
C:\Users\Admin\AppData\Roaming\1605791987088.txt

Download Submit
memory/196-0-0x0000000000000000-mapping.dmp

Download
memory/200-31-0x0000000010000000-0x00000000101FE000-memory.dmp

Download
memory/200-29-0x0000000000035FB0-mapping.dmp

Download
memory/200-32-0x00000000045B0000-0x00000000047A0000-memory.dmp

Download
memory/568-41-0x0000000004370000-0x0000000004560000-memory.dmp

Download
memory/568-33-0x0000000000035FB0-mapping.dmp

Download
memory/696-48-0x0000000000000000-mapping.dmp

Download
memory/796-42-0x0000000000000000-mapping.dmp

Download
memory/816-232-0x0000000000000000-mapping.dmp

Download
memory/864-37-0x0000000000000000-mapping.dmp

Download
memory/984-28-0x0000000010000000-0x0000000010196000-memory.dmp

Download
memory/984-20-0x0000000000000000-mapping.dmp

Download
memory/984-23-0x0000000073FE0000-0x0000000074073000-memory.dmp

Download
memory/1212-237-0x0000000000000000-mapping.dmp

Download
memory/1428-236-0x0000000000000000-mapping.dmp

Download
memory/1440-57-0x0000000004F90000-0x0000000004F91000-memory.dmp

Download
memory/1440-54-0x00000000027E0000-0x00000000027F7000-memory.dmp

Download
memory/1440-47-0x0000000071220000-0x000000007190E000-memory.dmp

Download
memory/1440-65-0x0000000004DD0000-0x0000000004DD9000-memory.dmp

Download
memory/1440-66-0x0000000005A50000-0x0000000005A51000-memory.dmp

Download
memory/1440-49-0x0000000000520000-0x0000000000521000-memory.dmp

Download
memory/1440-40-0x0000000000000000-mapping.dmp

Download
memory/1440-52-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download
memory/1440-55-0x0000000002800000-0x000000000280B000-memory.dmp

Download
memory/1476-15-0x0000000000000000-mapping.dmp

Download
memory/1716-30-0x0000000000035FB0-mapping.dmp

Download
memory/1716-36-0x0000000004280000-0x0000000004470000-memory.dmp

Download
memory/2004-35-0x0000000000000000-mapping.dmp

Download
memory/2052-16-0x0000000000000000-mapping.dmp

Download
memory/2056-235-0x0000000000000000-mapping.dmp

Download
memory/2120-53-0x0000000000000000-mapping.dmp

Download
memory/2144-50-0x0000000000000000-mapping.dmp

Download
memory/3284-2-0x0000000000000000-mapping.dmp

Download
memory/3284-3-0x0000000000000000-mapping.dmp

Download
memory/3444-38-0x0000000000000000-mapping.dmp

Download
memory/3596-7-0x0000000000000000-mapping.dmp

Download
memory/3596-6-0x0000000000000000-mapping.dmp

Download
memory/3904-10-0x0000000000000000-mapping.dmp

Download
memory/3908-12-0x0000000000000000-mapping.dmp

Download
memory/3908-11-0x0000000000000000-mapping.dmp

Download
memory/4084-27-0x0000000000400000-0x0000000000983000-memory.dmp

Download
memory/4084-25-0x000000000066C0BC-mapping.dmp

Download
memory/4084-24-0x0000000000400000-0x0000000000983000-memory.dmp

Download
memory/4220-58-0x0000000000000000-mapping.dmp

Download
memory/4252-62-0x0000000000035FB0-mapping.dmp

Download
memory/4252-63-0x0000000010000000-0x0000000010051000-memory.dmp

Download
memory/4376-68-0x0000000000400000-0x0000000000405000-memory.dmp

Download
memory/4376-83-0x0000000000401A01-mapping.dmp

Download
memory/4376-253-0x0000000000401A01-mapping.dmp

Download
memory/4376-252-0x0000000000401A01-mapping.dmp

Download
memory/4376-84-0x0000000000401A01-mapping.dmp

Download
memory/4376-249-0x0000000000401A01-mapping.dmp

Download
memory/4376-85-0x0000000000401A01-mapping.dmp

Download
memory/4376-86-0x0000000000401A01-mapping.dmp

Download
memory/4376-87-0x0000000000401A01-mapping.dmp

Download
memory/4376-180-0x0000000000401A01-mapping.dmp

Download
memory/4376-181-0x0000000000401A01-mapping.dmp

Download
memory/4376-179-0x0000000000401A01-mapping.dmp

Download
memory/4376-182-0x0000000000401A01-mapping.dmp

Download
memory/4376-184-0x0000000000401A01-mapping.dmp

Download
memory/4376-183-0x0000000000401A01-mapping.dmp

Download
memory/4376-185-0x0000000000401A01-mapping.dmp

Download
memory/4376-187-0x0000000000401A01-mapping.dmp

Download
memory/4376-188-0x0000000000401A01-mapping.dmp

Download
memory/4376-186-0x0000000000401A01-mapping.dmp

Download
memory/4376-251-0x0000000000401A01-mapping.dmp

Download
memory/4376-88-0x0000000000401A01-mapping.dmp

Download
memory/4376-250-0x0000000000401A01-mapping.dmp

Download
memory/4376-82-0x0000000000401A01-mapping.dmp

Download
memory/4376-81-0x0000000000401A01-mapping.dmp

Download
memory/4376-80-0x0000000000401A01-mapping.dmp

Download
memory/4376-79-0x0000000000401A01-mapping.dmp

Download
memory/4376-247-0x0000000000401A01-mapping.dmp

Download
memory/4376-248-0x0000000000401A01-mapping.dmp

Download
memory/4376-246-0x0000000000401A01-mapping.dmp

Download
memory/4376-245-0x0000000000401A01-mapping.dmp

Download
memory/4376-69-0x0000000000401A01-mapping.dmp

Download
memory/4376-72-0x0000000000400000-0x0000000000405000-memory.dmp

Download
memory/4396-71-0x0000000000000000-mapping.dmp

Download
memory/4408-239-0x0000000000000000-mapping.dmp

Download
memory/4480-75-0x0000000000000000-mapping.dmp

Download
memory/4536-78-0x0000000004740000-0x0000000004741000-memory.dmp

Download
memory/4536-189-0x0000000005430000-0x0000000005431000-memory.dmp

Download
memory/4536-91-0x0000000005340000-0x0000000005341000-memory.dmp

Download
memory/4608-90-0x0000000000000000-mapping.dmp

Download
memory/4684-104-0x0000000000000000-mapping.dmp

Download
memory/4736-242-0x0000000010000000-0x00000000100E3000-memory.dmp

Download
memory/4736-112-0x0000000000000000-mapping.dmp

Download