azorult | 9c073d5f9dc085ff65075c30d50e39f4baefe334061842ac433fc896f4c17f48

Analysis

max time kernel
1602s
max time network
1604s
platform
windows7_x64
resource
win7v20201028
submitted
12-03-2021 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Diskgetor.Data.Recovery.3.58.crack.exe

Score

10^/10

azorult dcrat fickerstealer pony discovery infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Family

azorult

http://kvaka.li/1210776429.php

Extracted

Family

fickerstealer

deniedfight.com:80

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Downloads MZ/PE file

Executes dropped EXE 19 IoCs

Processes:

keygen-pr.exekeygen-step-1.exekeygen-step-3.exekeygen-step-4.exeSetup.exekey.exekey.exemultitimer.exefile.exeB69D.tmp.exemultitimer.exeB69D.tmp.exeaskinstall20.exemd2_2efs.exegcttt.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exejfiag3g_gg.exe

pid	process
1444	keygen-pr.exe
1608	keygen-step-1.exe
332	keygen-step-3.exe
1248	keygen-step-4.exe
1700	Setup.exe
1468	key.exe
908	key.exe
992	multitimer.exe
1636	file.exe
1044	B69D.tmp.exe
944	multitimer.exe
900	B69D.tmp.exe
956	askinstall20.exe
852	md2_2efs.exe
1988	gcttt.exe
996	jfiag3g_gg.exe
1376	jfiag3g_gg.exe
1164	jfiag3g_gg.exe
808	jfiag3g_gg.exe

Loads dropped DLL 37 IoCs

Processes:

cmd.exekeygen-step-4.exekeygen-pr.exekey.exefile.exegcttt.exe

pid	process
1492	cmd.exe
1492	cmd.exe
1492	cmd.exe
1492	cmd.exe
1492	cmd.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1444	keygen-pr.exe
1444	keygen-pr.exe
1444	keygen-pr.exe
1444	keygen-pr.exe
1468	key.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1636	file.exe
1636	file.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1248	keygen-step-4.exe
1988	gcttt.exe
1988	gcttt.exe
1988	gcttt.exe
1988	gcttt.exe
1988	gcttt.exe
1988	gcttt.exe
1988	gcttt.exe
1988	gcttt.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

gcttt.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	gcttt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

55 ip-api.com
33 api.ipify.org

flow	ioc
55	ip-api.com
33	api.ipify.org

Suspicious use of SetThreadContext 2 IoCs

Processes:

key.exeB69D.tmp.exe

description	pid	process	target process
PID 1468 set thread context of 908	1468	key.exe	key.exe
PID 1044 set thread context of 900	1044	B69D.tmp.exe	B69D.tmp.exe

Drops file in Windows directory 2 IoCs

Processes:

multitimer.exe

description	ioc	process
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new	multitimer.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new	multitimer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

B69D.tmp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	B69D.tmp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	B69D.tmp.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1436 taskkill.exe

pid	process
1436	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

file.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	file.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecision = "0"	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	file.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadNetworkName = "Network"	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	file.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionReason = "1"	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\PegasPc	file.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	file.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecisionTime = 807bc01e4f17d701	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	file.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 2061af224f17d701	file.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecisionReason = "1"	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	file.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\WpadDecisionTime = 2061af224f17d701	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	file.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\MigrateProxy = "1"	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}	file.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecision = "0"	file.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	file.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDetectedUrl	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6CD91550-F1B8-44A7-B169-07A502AE3F35}\32-e2-17-db-d2-77	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	file.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\32-e2-17-db-d2-77\WpadDecisionTime = 807bc01e4f17d701	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	file.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	file.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

Setup.exefile.exegcttt.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	file.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	gcttt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	gcttt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	gcttt.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	gcttt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	file.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	file.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

1004 PING.EXE
512 PING.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

key.exefile.exeB69D.tmp.exejfiag3g_gg.exe

pid process

1468 key.exe
1468 key.exe
1636 file.exe
1636 file.exe
1636 file.exe
1636 file.exe
900 B69D.tmp.exe
1376 jfiag3g_gg.exe

pid	process
1004	PING.EXE
512	PING.EXE

pid	process
1468	key.exe
1468	key.exe
1636	file.exe
1636	file.exe
1636	file.exe
1636	file.exe
900	B69D.tmp.exe
1376	jfiag3g_gg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

Setup.exekey.exefile.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1700	Setup.exe
Token: SeImpersonatePrivilege	1468	key.exe
Token: SeTcbPrivilege	1468	key.exe
Token: SeChangeNotifyPrivilege	1468	key.exe
Token: SeCreateTokenPrivilege	1468	key.exe
Token: SeBackupPrivilege	1468	key.exe
Token: SeRestorePrivilege	1468	key.exe
Token: SeIncreaseQuotaPrivilege	1468	key.exe
Token: SeAssignPrimaryTokenPrivilege	1468	key.exe
Token: SeImpersonatePrivilege	1468	key.exe
Token: SeTcbPrivilege	1468	key.exe
Token: SeChangeNotifyPrivilege	1468	key.exe
Token: SeCreateTokenPrivilege	1468	key.exe
Token: SeBackupPrivilege	1468	key.exe
Token: SeRestorePrivilege	1468	key.exe
Token: SeIncreaseQuotaPrivilege	1468	key.exe
Token: SeAssignPrimaryTokenPrivilege	1468	key.exe
Token: SeDebugPrivilege	1636	file.exe
Token: SeCreateTokenPrivilege	1636	file.exe
Token: SeImpersonatePrivilege	1468	key.exe
Token: SeTcbPrivilege	1468	key.exe
Token: SeChangeNotifyPrivilege	1468	key.exe
Token: SeCreateTokenPrivilege	1468	key.exe
Token: SeBackupPrivilege	1468	key.exe
Token: SeRestorePrivilege	1468	key.exe
Token: SeIncreaseQuotaPrivilege	1468	key.exe
Token: SeAssignPrimaryTokenPrivilege	1468	key.exe
Token: SeImpersonatePrivilege	1468	key.exe
Token: SeTcbPrivilege	1468	key.exe
Token: SeChangeNotifyPrivilege	1468	key.exe
Token: SeCreateTokenPrivilege	1468	key.exe
Token: SeBackupPrivilege	1468	key.exe
Token: SeRestorePrivilege	1468	key.exe
Token: SeIncreaseQuotaPrivilege	1468	key.exe
Token: SeAssignPrimaryTokenPrivilege	1468	key.exe
Token: SeDebugPrivilege	1436	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Diskgetor.Data.Recovery.3.58.crack.execmd.exekeygen-step-4.exekeygen-pr.exekeygen-step-3.exekey.execmd.exeSetup.exe

description	pid	process	target process
PID 384 wrote to memory of 1492	384	Diskgetor.Data.Recovery.3.58.crack.exe	cmd.exe
PID 384 wrote to memory of 1492	384	Diskgetor.Data.Recovery.3.58.crack.exe	cmd.exe
PID 384 wrote to memory of 1492	384	Diskgetor.Data.Recovery.3.58.crack.exe	cmd.exe
PID 384 wrote to memory of 1492	384	Diskgetor.Data.Recovery.3.58.crack.exe	cmd.exe
PID 1492 wrote to memory of 1444	1492	cmd.exe	keygen-pr.exe
PID 1492 wrote to memory of 1444	1492	cmd.exe	keygen-pr.exe
PID 1492 wrote to memory of 1444	1492	cmd.exe	keygen-pr.exe
PID 1492 wrote to memory of 1444	1492	cmd.exe	keygen-pr.exe
PID 1492 wrote to memory of 1444	1492	cmd.exe	keygen-pr.exe
PID 1492 wrote to memory of 1444	1492	cmd.exe	keygen-pr.exe
PID 1492 wrote to memory of 1444	1492	cmd.exe	keygen-pr.exe
PID 1492 wrote to memory of 1608	1492	cmd.exe	keygen-step-1.exe
PID 1492 wrote to memory of 1608	1492	cmd.exe	keygen-step-1.exe
PID 1492 wrote to memory of 1608	1492	cmd.exe	keygen-step-1.exe
PID 1492 wrote to memory of 1608	1492	cmd.exe	keygen-step-1.exe
PID 1492 wrote to memory of 332	1492	cmd.exe	keygen-step-3.exe
PID 1492 wrote to memory of 332	1492	cmd.exe	keygen-step-3.exe
PID 1492 wrote to memory of 332	1492	cmd.exe	keygen-step-3.exe
PID 1492 wrote to memory of 332	1492	cmd.exe	keygen-step-3.exe
PID 1492 wrote to memory of 1248	1492	cmd.exe	keygen-step-4.exe
PID 1492 wrote to memory of 1248	1492	cmd.exe	keygen-step-4.exe
PID 1492 wrote to memory of 1248	1492	cmd.exe	keygen-step-4.exe
PID 1492 wrote to memory of 1248	1492	cmd.exe	keygen-step-4.exe
PID 1248 wrote to memory of 1700	1248	keygen-step-4.exe	Setup.exe
PID 1248 wrote to memory of 1700	1248	keygen-step-4.exe	Setup.exe
PID 1248 wrote to memory of 1700	1248	keygen-step-4.exe	Setup.exe
PID 1248 wrote to memory of 1700	1248	keygen-step-4.exe	Setup.exe
PID 1444 wrote to memory of 1468	1444	keygen-pr.exe	key.exe
PID 1444 wrote to memory of 1468	1444	keygen-pr.exe	key.exe
PID 1444 wrote to memory of 1468	1444	keygen-pr.exe	key.exe
PID 1444 wrote to memory of 1468	1444	keygen-pr.exe	key.exe
PID 1444 wrote to memory of 1468	1444	keygen-pr.exe	key.exe
PID 1444 wrote to memory of 1468	1444	keygen-pr.exe	key.exe
PID 1444 wrote to memory of 1468	1444	keygen-pr.exe	key.exe
PID 332 wrote to memory of 1192	332	keygen-step-3.exe	cmd.exe
PID 332 wrote to memory of 1192	332	keygen-step-3.exe	cmd.exe
PID 332 wrote to memory of 1192	332	keygen-step-3.exe	cmd.exe
PID 332 wrote to memory of 1192	332	keygen-step-3.exe	cmd.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1468 wrote to memory of 908	1468	key.exe	key.exe
PID 1192 wrote to memory of 1004	1192	cmd.exe	PING.EXE
PID 1192 wrote to memory of 1004	1192	cmd.exe	PING.EXE
PID 1192 wrote to memory of 1004	1192	cmd.exe	PING.EXE
PID 1192 wrote to memory of 1004	1192	cmd.exe	PING.EXE
PID 1700 wrote to memory of 992	1700	Setup.exe	multitimer.exe
PID 1700 wrote to memory of 992	1700	Setup.exe	multitimer.exe
PID 1700 wrote to memory of 992	1700	Setup.exe	multitimer.exe
PID 1248 wrote to memory of 1636	1248	keygen-step-4.exe	file.exe
PID 1248 wrote to memory of 1636	1248	keygen-step-4.exe	file.exe

C:\Users\Admin\AppData\Local\Temp\Diskgetor.Data.Recovery.3.58.crack.exe
"C:\Users\Admin\AppData\Local\Temp\Diskgetor.Data.Recovery.3.58.crack.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:384

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
keygen-pr.exe -p83fsase3Ge
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444

C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1468

C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
5⤵
- Executes dropped EXE
PID:908

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
keygen-step-3.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
5⤵
- Runs ping.exe
PID:1004

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
keygen-step-1.exe
3⤵
- Executes dropped EXE
PID:1608

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
keygen-step-4.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1248

C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700

C:\Users\Admin\AppData\Local\Temp\N5V2ITW8AD\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\N5V2ITW8AD\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
5⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:992

C:\Users\Admin\AppData\Local\Temp\N5V2ITW8AD\multitimer.exe
"C:\Users\Admin\AppData\Local\Temp\N5V2ITW8AD\multitimer.exe" 1 101
6⤵
- Executes dropped EXE
PID:944

C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636

C:\Users\Admin\AppData\Roaming\B69D.tmp.exe
"C:\Users\Admin\AppData\Roaming\B69D.tmp.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1044

C:\Users\Admin\AppData\Roaming\B69D.tmp.exe
"C:\Users\Admin\AppData\Roaming\B69D.tmp.exe"
6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
5⤵
PID:788

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
6⤵
- Runs ping.exe
PID:512

C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
4⤵
- Executes dropped EXE
PID:956

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
5⤵
PID:952

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
4⤵
- Executes dropped EXE
PID:852

C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
PID:1988

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:996

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1376

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:1164

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
5⤵
- Executes dropped EXE
PID:808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
1697c7bdbf51be4e8b5eed4bb2d96c99

SHA1
33e7137f57d09c30d99ac934f2f2dfb094e23bd3

SHA256
34458a706a2f38ec2e0d451ba4fc2692024cd23516e0ce136b09b29cfeec96c4

SHA512
294436f9930306e5afe604374eb932aaad1cd238df5e41a360f32ec0ece112e4e5d9ccf00529a36f2ea5010729dbe56e44ee0d52b2f36e4177c5652f3425038c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
034927199c7e953926622c8c8cd8d825

SHA1
baaa734e6c4190c1f76776a62255a7fcb53dd435

SHA256
5ba89a2a31a36583ad6fce08b47fb0eb4d058dacb0969e83bab7b1999e7402ed

SHA512
50d85e70af9ae740dd9c352b5a2c77dc323dec4610378463cdf151367d8b90c926696c29ce7699bbcdf898958fcf86cbebd861428d3f2041524a20820bc23583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
MD5
61a03d15cf62612f50b74867090dbe79

SHA1
15228f34067b4b107e917bebaf17cc7c3c1280a8

SHA256
f9e23dc21553daa34c6eb778cd262831e466ce794f4bea48150e8d70d3e6af6d

SHA512
5fece89ccbbf994e4f1e3ef89a502f25a72f359d445c034682758d26f01d9f3aa20a43010b9a87f2687da7ba201476922aa46d4906d442d56eb59b2b881259d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
ca1458cdb08212fe95b8e013c0bd8dd5

SHA1
86d293812cb804c162e7de0e59c7094a83d92340

SHA256
2d2b9ee023d9b04c6ae09ad11c6963432ee7b3ab8858d42b4470170b749d3e2f

SHA512
3a25602303f7a8eb13f0de44573d57e0b8919ec1a031b3da49cb548d86c1ad9f214b04be22345fad7aca5dc060114c66e2272edfdfd20efd6925c67c43d99f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
ae276fd68eba5e86d75a951ab4fe0725

SHA1
c39c7d75079d2d4af2d8bbaaaeec90a6ef61b7f7

SHA256
d23ebdcdeec048225fb2caa8d5779312127e18ddb5595ccfd128180df6d9f9ea

SHA512
b190b376cf486bb8873df644dfebde3bc6caed6c75008d4304b9bd5de78008c25cf1a0462fcae9fb3d66f24beffae6c2bf8e94fce3025caeae28883e4eeb342c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
MD5
68315eeb4f8b6aa47d75a8f0ca0a5797

SHA1
c4f1f679f54cad43267be4e18bf04f83c77bcee5

SHA256
29ab011f00156ee54491b95ba618fc44d89c121e45287a52a40f216ed276f406

SHA512
07a55bcd8a36b408f85e285f26825805645cc318240f2f5017b1cb0f322a51aafa0e4093ce28974e55f3cee861a7f8f7ef3839a5da3c830a8c4d23703507dfea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
34ee1435edcad1ee3446de33b5e4a818

SHA1
2ad4725c1521b502c60843905413ead9666c2053

SHA256
0df748255fc5b12018d38f3ca98f3b8cfd0ae9b5a1179216007415ef530a9362

SHA512
c6def8501bef6a48900fc41580246e6c430ac5e47688948215842d981218faa502eda506cf212aa7a6f9690b78bdc26a9582873dc97bdc7ae68f9d0e10093017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
54a2f0e55d1b527c167439f41eb20a1b

SHA1
030713cb0a3d1d9aea3db71e59d175f9d0cc288c

SHA256
190790beecbb364a540a603b305215b824e8eb24c2ee4e59dbaecc2965346152

SHA512
ebf62fca1425f22d6fa952f2ba5b79fd0b0a4f6a1498df8cbec79952462ee0ee17ca7e1a3bb8667705c0717e0f306614b187f7f46d1ce1358fbf68f94f4d9e81

Download Submit
C:\Users\Admin\AppData\Local\Temp\N5V2ITW8AD\multitimer.exe
MD5
9028e3b7752e1551d2166e4374afff7d

SHA1
92b27f9002966131c1e11527a4552f8d1832a423

SHA256
8d2a3864a5a91b0242e2c3bb71ef18e34bb31e11c5373860185bcf11ffcce46a

SHA512
e0c519856e7e5d116b8cf8b86bb60868b4831520cc0964136019dc7cbfe88efe4c140a5067775064fb98007927c2b35859ffb063814b3876f21ef89d95c8f50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\N5V2ITW8AD\multitimer.exe
MD5
9028e3b7752e1551d2166e4374afff7d

SHA1
92b27f9002966131c1e11527a4552f8d1832a423

SHA256
8d2a3864a5a91b0242e2c3bb71ef18e34bb31e11c5373860185bcf11ffcce46a

SHA512
e0c519856e7e5d116b8cf8b86bb60868b4831520cc0964136019dc7cbfe88efe4c140a5067775064fb98007927c2b35859ffb063814b3876f21ef89d95c8f50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\N5V2ITW8AD\multitimer.exe
MD5
9028e3b7752e1551d2166e4374afff7d

SHA1
92b27f9002966131c1e11527a4552f8d1832a423

SHA256
8d2a3864a5a91b0242e2c3bb71ef18e34bb31e11c5373860185bcf11ffcce46a

SHA512
e0c519856e7e5d116b8cf8b86bb60868b4831520cc0964136019dc7cbfe88efe4c140a5067775064fb98007927c2b35859ffb063814b3876f21ef89d95c8f50d

Download Submit
C:\Users\Admin\AppData\Local\Temp\N5V2ITW8AD\multitimer.exe.config
MD5
3f1498c07d8713fe5c315db15a2a2cf3

SHA1
ef5f42fd21f6e72bdc74794f2496884d9c40bbfb

SHA256
52ca39624f8fd70bc441d055712f115856bc67b37efb860d654e4a8909106dc0

SHA512
cb32ce5ef72548d1b0d27f3f254f4b67b23a0b662d0ef7ae12f9e3ef1b0a917b098368b434caf54751c02c0f930e92cffd384f105d8d79ee725df4d97a559a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
MD5
65b49b106ec0f6cf61e7dc04c0a7eb74

SHA1
a1f4784377c53151167965e0ff225f5085ebd43b

SHA256
862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

SHA512
e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
MD5
65b49b106ec0f6cf61e7dc04c0a7eb74

SHA1
a1f4784377c53151167965e0ff225f5085ebd43b

SHA256
862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

SHA512
e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
MD5
c615d0bfa727f494fee9ecb3f0acf563

SHA1
6c3509ae64abc299a7afa13552c4fe430071f087

SHA256
95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

SHA512
d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
MD5
c615d0bfa727f494fee9ecb3f0acf563

SHA1
6c3509ae64abc299a7afa13552c4fe430071f087

SHA256
95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

SHA512
d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
MD5
9aaafaed80038c9dcb3bb6a532e9d071

SHA1
4657521b9a50137db7b1e2e84193363a2ddbd74f

SHA256
e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5

SHA512
9d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
MD5
9aaafaed80038c9dcb3bb6a532e9d071

SHA1
4657521b9a50137db7b1e2e84193363a2ddbd74f

SHA256
e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5

SHA512
9d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
MD5
ebdfcd546979ba7d04227fc14baa911c

SHA1
54c3f86d8fceb8511dd01c56ab79c87abfeac6f6

SHA256
85d6376b1c4d04625a318dfa3f59b47023c0112f0d1ae9fc2dbd5b5c2c59012b

SHA512
befa9e7da5f375b84386269a8e9bb3ef0808d7fb5bb5eb387c1c9aff16c65ec959c1700a9477cbcaa8c70d7a02ee805ad2cc2a811696b6a27eb7c83e2c3dfbf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
MD5
ebdfcd546979ba7d04227fc14baa911c

SHA1
54c3f86d8fceb8511dd01c56ab79c87abfeac6f6

SHA256
85d6376b1c4d04625a318dfa3f59b47023c0112f0d1ae9fc2dbd5b5c2c59012b

SHA512
befa9e7da5f375b84386269a8e9bb3ef0808d7fb5bb5eb387c1c9aff16c65ec959c1700a9477cbcaa8c70d7a02ee805ad2cc2a811696b6a27eb7c83e2c3dfbf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat
MD5
f2632c204f883c59805093720dfe5a78

SHA1
c96e3aa03805a84fec3ea4208104a25a2a9d037e

SHA256
f9458a661ecd6c7e8fae669be72497288472a11ac3e823d3074e58f7fe98cd68

SHA512
5a19c4a777899889381be64f190e50a23cceee0abb78776b6d041e2384ba88e692972e40cefa34c03ca1b7d029475a0afbc5ce006ce833a1665e52008671bae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
MD5
a311895f5ca19b0627715f2bc657641e

SHA1
fc3142713a5847184541721999c03be82ecca75d

SHA256
163861a40c9c1c3666bfc935aa187ea997bb5a97bacc11a83c2bea0e2d643b60

SHA512
e7c8945b5624e40f35c16f801fb06fdb0a1d5c9a74e52fbdaba74e5ecb77f441dcf5c303d1a0fc63140d91ca42e941f364c559c87a6a18a5f696623f2bb9d900

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
MD5
a311895f5ca19b0627715f2bc657641e

SHA1
fc3142713a5847184541721999c03be82ecca75d

SHA256
163861a40c9c1c3666bfc935aa187ea997bb5a97bacc11a83c2bea0e2d643b60

SHA512
e7c8945b5624e40f35c16f801fb06fdb0a1d5c9a74e52fbdaba74e5ecb77f441dcf5c303d1a0fc63140d91ca42e941f364c559c87a6a18a5f696623f2bb9d900

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
MD5
053c5f41c8349bbcfe81bb717b688dce

SHA1
635cb20191b633ba13120b6afd4f936852419f72

SHA256
835b3c9748afd3a64242033040df57c6d15616bfa1ae898a6259357bc54a7148

SHA512
829bb89bb650524203b132a8096b8fa94de696efb3cb993125146e4ca4b2725e738bcb9f487fc6ed013ee71633dab9095965427c31a862563f362bd6a35d73ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
MD5
1743533d63a8ba25142ffa3efc59b50b

SHA1
c770a27df5e4f002039528bf639cca1ce564b8f5

SHA256
e17f635114df8991b10f9611c3b1fcfaee87a98a11ad9623e894df9492c5a09e

SHA512
c5f9e2463598ab49b9f4ec87c7e8b427de52982b1bb7fc27c4182f36fcd27127fe4da11dbf44ad00e320169144cd3732dc8d62861403f57b8321010a1ab59b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
MD5
1743533d63a8ba25142ffa3efc59b50b

SHA1
c770a27df5e4f002039528bf639cca1ce564b8f5

SHA256
e17f635114df8991b10f9611c3b1fcfaee87a98a11ad9623e894df9492c5a09e

SHA512
c5f9e2463598ab49b9f4ec87c7e8b427de52982b1bb7fc27c4182f36fcd27127fe4da11dbf44ad00e320169144cd3732dc8d62861403f57b8321010a1ab59b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
MD5
e5770e11e313cb8802bbf0e001f49ee9

SHA1
94f88a6d416036a4d2cb155774ec0c1f70473a02

SHA256
560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

SHA512
a766e7863c09a145259c17e7d9c6f3065567ba96e9c527ffb9fb23bd7b216f6c537b81a678cc14877ccfee6279fd4055adce1f9fe8ff9e7207ac4dd05bd75cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
MD5
e5770e11e313cb8802bbf0e001f49ee9

SHA1
94f88a6d416036a4d2cb155774ec0c1f70473a02

SHA256
560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

SHA512
a766e7863c09a145259c17e7d9c6f3065567ba96e9c527ffb9fb23bd7b216f6c537b81a678cc14877ccfee6279fd4055adce1f9fe8ff9e7207ac4dd05bd75cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\JOzWR.dat
MD5
12476321a502e943933e60cfb4429970

SHA1
c71d293b84d03153a1bd13c560fca0f8857a95a7

SHA256
14a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29

SHA512
f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\potato.dat
MD5
235c88fb4c9754f96c17207831c1163d

SHA1
188f22d57a834a01345936fd7ba569ec26df49a2

SHA256
90438881a2e9f8f223c0863e40d332fa2c3a514851e5813e2571c9366df3a5ea

SHA512
051ea06b5ec73c3b88079c11f61192dafd8268cdbb55904118e5210e8f2f5543f3d32bffa1e2863ba52cd2486cdc30d0deb54ca435bf4bc2fa5d6e019d3bb636

Download Submit
C:\Users\Admin\AppData\Roaming\B69D.tmp.exe
MD5
79079f3c88f97e9b3cf4dde9aadc5908

SHA1
6178a76270888ac89ade5e8e0204b972826e30a1

SHA256
41d0db109cb698f1c7a39b28298a7a1325e0b04a7e142af179a68b8af30a6b01

SHA512
673f5e520994ec71d3bb3610ffb7c32778be1d39e94a7d3c92061cf84d2c49167c82b41cee56806a2619db8aa80672e622b2d4cdda6161ee09d00be46096edcd

Download Submit
C:\Users\Admin\AppData\Roaming\B69D.tmp.exe
MD5
79079f3c88f97e9b3cf4dde9aadc5908

SHA1
6178a76270888ac89ade5e8e0204b972826e30a1

SHA256
41d0db109cb698f1c7a39b28298a7a1325e0b04a7e142af179a68b8af30a6b01

SHA512
673f5e520994ec71d3bb3610ffb7c32778be1d39e94a7d3c92061cf84d2c49167c82b41cee56806a2619db8aa80672e622b2d4cdda6161ee09d00be46096edcd

Download Submit
C:\Users\Admin\AppData\Roaming\B69D.tmp.exe
MD5
79079f3c88f97e9b3cf4dde9aadc5908

SHA1
6178a76270888ac89ade5e8e0204b972826e30a1

SHA256
41d0db109cb698f1c7a39b28298a7a1325e0b04a7e142af179a68b8af30a6b01

SHA512
673f5e520994ec71d3bb3610ffb7c32778be1d39e94a7d3c92061cf84d2c49167c82b41cee56806a2619db8aa80672e622b2d4cdda6161ee09d00be46096edcd

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
MD5
65b49b106ec0f6cf61e7dc04c0a7eb74

SHA1
a1f4784377c53151167965e0ff225f5085ebd43b

SHA256
862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

SHA512
e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
MD5
c615d0bfa727f494fee9ecb3f0acf563

SHA1
6c3509ae64abc299a7afa13552c4fe430071f087

SHA256
95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

SHA512
d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
MD5
c615d0bfa727f494fee9ecb3f0acf563

SHA1
6c3509ae64abc299a7afa13552c4fe430071f087

SHA256
95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

SHA512
d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
MD5
9aaafaed80038c9dcb3bb6a532e9d071

SHA1
4657521b9a50137db7b1e2e84193363a2ddbd74f

SHA256
e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5

SHA512
9d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
MD5
ebdfcd546979ba7d04227fc14baa911c

SHA1
54c3f86d8fceb8511dd01c56ab79c87abfeac6f6

SHA256
85d6376b1c4d04625a318dfa3f59b47023c0112f0d1ae9fc2dbd5b5c2c59012b

SHA512
befa9e7da5f375b84386269a8e9bb3ef0808d7fb5bb5eb387c1c9aff16c65ec959c1700a9477cbcaa8c70d7a02ee805ad2cc2a811696b6a27eb7c83e2c3dfbf9

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
MD5
a311895f5ca19b0627715f2bc657641e

SHA1
fc3142713a5847184541721999c03be82ecca75d

SHA256
163861a40c9c1c3666bfc935aa187ea997bb5a97bacc11a83c2bea0e2d643b60

SHA512
e7c8945b5624e40f35c16f801fb06fdb0a1d5c9a74e52fbdaba74e5ecb77f441dcf5c303d1a0fc63140d91ca42e941f364c559c87a6a18a5f696623f2bb9d900

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
MD5
a311895f5ca19b0627715f2bc657641e

SHA1
fc3142713a5847184541721999c03be82ecca75d

SHA256
163861a40c9c1c3666bfc935aa187ea997bb5a97bacc11a83c2bea0e2d643b60

SHA512
e7c8945b5624e40f35c16f801fb06fdb0a1d5c9a74e52fbdaba74e5ecb77f441dcf5c303d1a0fc63140d91ca42e941f364c559c87a6a18a5f696623f2bb9d900

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
MD5
a311895f5ca19b0627715f2bc657641e

SHA1
fc3142713a5847184541721999c03be82ecca75d

SHA256
163861a40c9c1c3666bfc935aa187ea997bb5a97bacc11a83c2bea0e2d643b60

SHA512
e7c8945b5624e40f35c16f801fb06fdb0a1d5c9a74e52fbdaba74e5ecb77f441dcf5c303d1a0fc63140d91ca42e941f364c559c87a6a18a5f696623f2bb9d900

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
MD5
a311895f5ca19b0627715f2bc657641e

SHA1
fc3142713a5847184541721999c03be82ecca75d

SHA256
163861a40c9c1c3666bfc935aa187ea997bb5a97bacc11a83c2bea0e2d643b60

SHA512
e7c8945b5624e40f35c16f801fb06fdb0a1d5c9a74e52fbdaba74e5ecb77f441dcf5c303d1a0fc63140d91ca42e941f364c559c87a6a18a5f696623f2bb9d900

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
MD5
053c5f41c8349bbcfe81bb717b688dce

SHA1
635cb20191b633ba13120b6afd4f936852419f72

SHA256
835b3c9748afd3a64242033040df57c6d15616bfa1ae898a6259357bc54a7148

SHA512
829bb89bb650524203b132a8096b8fa94de696efb3cb993125146e4ca4b2725e738bcb9f487fc6ed013ee71633dab9095965427c31a862563f362bd6a35d73ae

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
MD5
053c5f41c8349bbcfe81bb717b688dce

SHA1
635cb20191b633ba13120b6afd4f936852419f72

SHA256
835b3c9748afd3a64242033040df57c6d15616bfa1ae898a6259357bc54a7148

SHA512
829bb89bb650524203b132a8096b8fa94de696efb3cb993125146e4ca4b2725e738bcb9f487fc6ed013ee71633dab9095965427c31a862563f362bd6a35d73ae

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
MD5
053c5f41c8349bbcfe81bb717b688dce

SHA1
635cb20191b633ba13120b6afd4f936852419f72

SHA256
835b3c9748afd3a64242033040df57c6d15616bfa1ae898a6259357bc54a7148

SHA512
829bb89bb650524203b132a8096b8fa94de696efb3cb993125146e4ca4b2725e738bcb9f487fc6ed013ee71633dab9095965427c31a862563f362bd6a35d73ae

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
MD5
1743533d63a8ba25142ffa3efc59b50b

SHA1
c770a27df5e4f002039528bf639cca1ce564b8f5

SHA256
e17f635114df8991b10f9611c3b1fcfaee87a98a11ad9623e894df9492c5a09e

SHA512
c5f9e2463598ab49b9f4ec87c7e8b427de52982b1bb7fc27c4182f36fcd27127fe4da11dbf44ad00e320169144cd3732dc8d62861403f57b8321010a1ab59b3b

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
MD5
1743533d63a8ba25142ffa3efc59b50b

SHA1
c770a27df5e4f002039528bf639cca1ce564b8f5

SHA256
e17f635114df8991b10f9611c3b1fcfaee87a98a11ad9623e894df9492c5a09e

SHA512
c5f9e2463598ab49b9f4ec87c7e8b427de52982b1bb7fc27c4182f36fcd27127fe4da11dbf44ad00e320169144cd3732dc8d62861403f57b8321010a1ab59b3b

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
MD5
1743533d63a8ba25142ffa3efc59b50b

SHA1
c770a27df5e4f002039528bf639cca1ce564b8f5

SHA256
e17f635114df8991b10f9611c3b1fcfaee87a98a11ad9623e894df9492c5a09e

SHA512
c5f9e2463598ab49b9f4ec87c7e8b427de52982b1bb7fc27c4182f36fcd27127fe4da11dbf44ad00e320169144cd3732dc8d62861403f57b8321010a1ab59b3b

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
MD5
60ecade3670b0017d25075b85b3c0ecc

SHA1
52b10f266b86bde95ddb10bb5ea71b8ee0c91a56

SHA256
fcb7e4ef69e4738ccae7181384b4eb27fbea2330224ac5b8c3fada06644cd0af

SHA512
559d200db1d11d7ff4375e4075a1d0d5cb26650255b0dfab605bdb1e314f5274bb5e62f5799eb1171d74d67d7893bc5c558a44bc0b6510c81a9ea888674393a9

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
MD5
60ecade3670b0017d25075b85b3c0ecc

SHA1
52b10f266b86bde95ddb10bb5ea71b8ee0c91a56

SHA256
fcb7e4ef69e4738ccae7181384b4eb27fbea2330224ac5b8c3fada06644cd0af

SHA512
559d200db1d11d7ff4375e4075a1d0d5cb26650255b0dfab605bdb1e314f5274bb5e62f5799eb1171d74d67d7893bc5c558a44bc0b6510c81a9ea888674393a9

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
MD5
e5770e11e313cb8802bbf0e001f49ee9

SHA1
94f88a6d416036a4d2cb155774ec0c1f70473a02

SHA256
560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

SHA512
a766e7863c09a145259c17e7d9c6f3065567ba96e9c527ffb9fb23bd7b216f6c537b81a678cc14877ccfee6279fd4055adce1f9fe8ff9e7207ac4dd05bd75cd1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
MD5
e5770e11e313cb8802bbf0e001f49ee9

SHA1
94f88a6d416036a4d2cb155774ec0c1f70473a02

SHA256
560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

SHA512
a766e7863c09a145259c17e7d9c6f3065567ba96e9c527ffb9fb23bd7b216f6c537b81a678cc14877ccfee6279fd4055adce1f9fe8ff9e7207ac4dd05bd75cd1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
MD5
e5770e11e313cb8802bbf0e001f49ee9

SHA1
94f88a6d416036a4d2cb155774ec0c1f70473a02

SHA256
560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

SHA512
a766e7863c09a145259c17e7d9c6f3065567ba96e9c527ffb9fb23bd7b216f6c537b81a678cc14877ccfee6279fd4055adce1f9fe8ff9e7207ac4dd05bd75cd1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
MD5
e5770e11e313cb8802bbf0e001f49ee9

SHA1
94f88a6d416036a4d2cb155774ec0c1f70473a02

SHA256
560d1fe318e00059a8b9b0c71f7b728e750af8e375c9de6e4239bc7f5066180f

SHA512
a766e7863c09a145259c17e7d9c6f3065567ba96e9c527ffb9fb23bd7b216f6c537b81a678cc14877ccfee6279fd4055adce1f9fe8ff9e7207ac4dd05bd75cd1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
MD5
51ef03c9257f2dd9b93bfdd74e96c017

SHA1
3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

SHA256
82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

SHA512
2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

Download Submit
\Users\Admin\AppData\Roaming\B69D.tmp.exe
MD5
79079f3c88f97e9b3cf4dde9aadc5908

SHA1
6178a76270888ac89ade5e8e0204b972826e30a1

SHA256
41d0db109cb698f1c7a39b28298a7a1325e0b04a7e142af179a68b8af30a6b01

SHA512
673f5e520994ec71d3bb3610ffb7c32778be1d39e94a7d3c92061cf84d2c49167c82b41cee56806a2619db8aa80672e622b2d4cdda6161ee09d00be46096edcd

Download Submit
\Users\Admin\AppData\Roaming\B69D.tmp.exe
MD5
79079f3c88f97e9b3cf4dde9aadc5908

SHA1
6178a76270888ac89ade5e8e0204b972826e30a1

SHA256
41d0db109cb698f1c7a39b28298a7a1325e0b04a7e142af179a68b8af30a6b01

SHA512
673f5e520994ec71d3bb3610ffb7c32778be1d39e94a7d3c92061cf84d2c49167c82b41cee56806a2619db8aa80672e622b2d4cdda6161ee09d00be46096edcd

Download Submit
memory/316-51-0x000007FEF7300000-0x000007FEF757A000-memory.dmp

Filesize
2.5MB

Download
memory/332-18-0x0000000000000000-mapping.dmp

Download
memory/384-2-0x0000000076241000-0x0000000076243000-memory.dmp

Filesize
8KB

Download
memory/512-101-0x0000000000000000-mapping.dmp

Download
memory/788-95-0x0000000000000000-mapping.dmp

Download
memory/808-133-0x0000000000000000-mapping.dmp

Download
memory/852-117-0x0000000000000000-mapping.dmp

Download
memory/852-120-0x0000000074190000-0x0000000074333000-memory.dmp

Filesize
1.6MB

Download
memory/852-121-0x0000000000512000-0x0000000000513000-memory.dmp

Filesize
4KB

Download
memory/900-93-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/900-87-0x0000000000401480-mapping.dmp

Download
memory/900-86-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/908-47-0x0000000000400000-0x0000000000983000-memory.dmp

Filesize
5.5MB

Download
memory/908-48-0x000000000066C0BC-mapping.dmp

Download
memory/908-54-0x0000000000400000-0x0000000000983000-memory.dmp

Filesize
5.5MB

Download
memory/944-83-0x0000000002020000-0x0000000002022000-memory.dmp

Filesize
8KB

Download
memory/944-79-0x0000000000000000-mapping.dmp

Download
memory/944-81-0x000007FEF4840000-0x000007FEF51DD000-memory.dmp

Filesize
9.6MB

Download
memory/944-82-0x000007FEF4840000-0x000007FEF51DD000-memory.dmp

Filesize
9.6MB

Download
memory/952-111-0x0000000000000000-mapping.dmp

Download
memory/956-99-0x0000000000000000-mapping.dmp

Download
memory/992-72-0x000007FEF4840000-0x000007FEF51DD000-memory.dmp

Filesize
9.6MB

Download
memory/992-69-0x000007FEF4840000-0x000007FEF51DD000-memory.dmp

Filesize
9.6MB

Download
memory/992-71-0x00000000005C0000-0x00000000005C2000-memory.dmp

Filesize
8KB

Download
memory/992-58-0x0000000000000000-mapping.dmp

Download
memory/996-127-0x0000000000000000-mapping.dmp

Download
memory/1004-52-0x0000000000000000-mapping.dmp

Download
memory/1044-84-0x0000000000BA0000-0x0000000000BB1000-memory.dmp

Filesize
68KB

Download
memory/1044-92-0x0000000000220000-0x0000000000265000-memory.dmp

Filesize
276KB

Download
memory/1044-76-0x0000000000000000-mapping.dmp

Download
memory/1164-131-0x0000000000000000-mapping.dmp

Download
memory/1192-44-0x0000000000000000-mapping.dmp

Download
memory/1248-23-0x0000000000000000-mapping.dmp

Download
memory/1376-129-0x0000000000000000-mapping.dmp

Download
memory/1436-112-0x0000000000000000-mapping.dmp

Download
memory/1444-9-0x0000000000000000-mapping.dmp

Download
memory/1468-53-0x00000000025C0000-0x000000000275C000-memory.dmp

Filesize
1.6MB

Download
memory/1468-39-0x0000000000000000-mapping.dmp

Download
memory/1468-70-0x0000000000B60000-0x0000000000C4F000-memory.dmp

Filesize
956KB

Download
memory/1468-91-0x0000000000100000-0x000000000011B000-memory.dmp

Filesize
108KB

Download
memory/1468-90-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1492-5-0x0000000000000000-mapping.dmp

Download
memory/1608-14-0x0000000000000000-mapping.dmp

Download
memory/1636-78-0x0000000003820000-0x00000000038F2000-memory.dmp

Filesize
840KB

Download
memory/1636-66-0x0000000000020000-0x000000000002D000-memory.dmp

Filesize
52KB

Download
memory/1636-64-0x0000000000000000-mapping.dmp

Download
memory/1700-34-0x000007FEF5190000-0x000007FEF5B7C000-memory.dmp

Filesize
9.9MB

Download
memory/1700-31-0x0000000000000000-mapping.dmp

Download
memory/1700-57-0x000000001AE00000-0x000000001AE02000-memory.dmp

Filesize
8KB

Download
memory/1700-55-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/1988-125-0x0000000000000000-mapping.dmp

Download