Analysis
-
max time kernel
110s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-02-2023 15:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://rapidgator.net/file/0e5e5b017ffc7ae94026040432122235/SUBLIME_TEXT_V4.4143_WIN64.7z.html
Resource
win10v2004-20221111-en
General
-
Target
https://rapidgator.net/file/0e5e5b017ffc7ae94026040432122235/SUBLIME_TEXT_V4.4143_WIN64.7z.html
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\libtomcrypt.dll acprotect C:\Users\Admin\AppData\Local\Temp\libtomcrypt.dll acprotect -
Executes dropped EXE 2 IoCs
Processes:
XF-Sublime-KG.exeXF-Sublime-KG.exepid process 1628 XF-Sublime-KG.exe 2444 XF-Sublime-KG.exe -
Loads dropped DLL 4 IoCs
Processes:
XF-Sublime-KG.exepid process 2444 XF-Sublime-KG.exe 2444 XF-Sublime-KG.exe 2444 XF-Sublime-KG.exe 2444 XF-Sublime-KG.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\libtomcrypt.dll upx C:\Users\Admin\AppData\Local\Temp\libtomcrypt.dll upx behavioral1/memory/2444-151-0x000000006F500000-0x000000006F5E8000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 03810f5f15f6d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\DOMStorage\rapidgator.net IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rapidgator.net\ = "323" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31013649" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1461627838" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rapidgator.net\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rapidgator.net\Total = "25" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d00000000020000000000106600000001000020000000c2345aa1306c2ba2bfa77b4bb2b453ba814d46d4205cd30f1aa82fd94a8d772e000000000e80000000020000200000009839cf7454e192128c67268f913166d765f51ab92dc056cfa88322cb567a854c20000000f8dbe31d7999511273c0c2bba774a3be87e70069d886376547ce424280f09006400000002f6c101ba691fd3964cb0ccad1cf9b265c3bc389a606cb6f9981350425552ac4d7bf73c94f2c05e2696fafac53a2356f47912e25c12338a25538c870cbd5407c iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rapidgator.net\Total = "13" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{880748AF-5AB4-46DC-82A9-DDF62A1971CB}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01afc58113bd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d0000000002000000000010660000000100002000000039f69cf6e5edeaba009d94f9d51483846b03513674761eb4018910d2aa6964b0000000000e8000000002000020000000cdc9b3ce415942f830ed95933a595161ae81c58772bae83a87dabc53216a445a000100008f7d0d6517252fb7c7b7ea85c87ae2a58c9bd75be339f1e2356731e485eace641202f42920ab017341135ccb74f13182705f9106f937a726f8a878b3e25d55531c45eccf60d50c215b3034e9601767f7c3e026ab5799f7f9c6a71a60d0f47ad37e7d109b83439399d600240922f21b50a7c3ee540c0e1da64908d13bd6515e2e571eb5413f177d038a52028e09e0e242ab750c595952fb684d7911fe6aa1459299773b1f8ff8611d354fa026f5db2ac395c36c03e6dc67fb37435ce683ea6f0f49be73a5cecdf0b2c79ad04d56273ada310cf6a821138f3d143c4c8b6b380647283d1ac844d4086e7b152ebeacfa711a4dda778369336ec73cf02890829a1927400000005e91709728eb1fd85e88eec4d4568d6d5c099ca54bbedcbf9efaa78f477bb5f935a8f62ba994d6a1f82228f1f587503bd6d556d094f31cabe13279d88458d17e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rapidgator.net\Total = "90" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31013649" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0560a6c113bd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "13" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31013649" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rapidgator.net\ = "90" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1454102848" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rapidgator.net\ = "13" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rapidgator.net\ = "135" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1454102848" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b4ee67113bd901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "25" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31013649" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\rapidgator.net\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "90" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d00000000020000000000106600000001000020000000d0a21f7c2ac0719557f4297a7b6641774bd5d15c3e5b15a79d2bd37f3452032d000000000e8000000002000020000000bda7d37272bbdce54ebdcb869396d9f17d330ee9a7d67b6f724b60a0e1945eb200010000582d07a2ab4ab12fb3597b9f457ba2061c981ce103145f427cf1527289af749b4b4e1e0d01d6a2575effb255913fe017ca70339f48cf2b186207e8261ddbb39f63401fd6b08aa7c318dc5e0f49ab550704c1239b7d9583236719fe23a68e6d89dc26b657f80826efa0870ea04ff918858daedba5fbc69d6ecb53bb0924d5c0eb5b8b6a323d8aad0bc081b23ef0795ec3c9ac3acaed7cec7e45cf6651b5199e3801cf2bcf8e76cef52ff827a1d4564ba68507ae721888a231c675d0eacc982f34999b9d3ea647e747e247df38e0de9945432e78be1fafb02fd86cad79fd1a981e8eafc630c524a417b2f1ef66ad9f4464791061292c53df1f5fcffd8db268ca3d40000000de1f8e4ad2002ba4864b69d177a7143bb901d5e82e3ffa120497c75c3103bf341af86e434fa8e4c6e93d6d0693b746e6894d52f040a67cf5adfe9407453964ca iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1461627838" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d00000000020000000000106600000001000020000000bbc8dbb00d58c12cb92b95b58e527d39719172314949f4594ad5052c3dac0841000000000e8000000002000020000000005fa769b545e2662107a59c0f9cb259cd5304b48358a5777a33eed8123f84dc200000002adfa1534c091efed9f5749fec5259ba84666adf4c14e0dd6460763afca5d6b340000000a0cf48ad343b08c4477ae8380aba199ddee64f1700fd3ea94b0a33e9c1c6ec93a5f308f1a518b7a8772a5b03cdb139c82e09c81c2997c195c8a670fe236e64e2 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d0000000002000000000010660000000100002000000098cb0218d0041d978bce05bc35b239927adf2bf639c41849b6ef62592415008e000000000e80000000020000200000001f8873002ee55e772465ca938d2b224872e36224dc82179fac3648bf363b4f1520000000dd67eb6efd928a90f3dcd60a446bc710a2d82ecd5585f941e19e978399b2ca2c400000007ff6932ea06f9afd38f9aa5043f0aed69db9512344af49065e759e662ab7883a8855c69884231f88b2cfcc4fa2bb0b4baed577194eda5bffa5ba2623afa2318e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "382552306" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d00000000020000000000106600000001000020000000ee046e7bcb1996fdc6fd9c39e4b53da878df0928ef32078d100acca92af2638b000000000e8000000002000020000000ee9e1a345739682eabfe4e129d3a988554672483e5d0c8aa594cfacbc1369b1620000000dd062104bb142adc494e72634371ce4e4122b0c0ce0572b1283b5dd63270bf0c400000002c6cfc73f43926513bf9be5ba084abcb88d4cc21d20b989fac84cfd0fdf478fc839ac78b881f490ae48ed7f9dff20a78f57a73e6666b5731e4ecfdaee1581662 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{81B67CA1-A704-11ED-B5DD-DE991C57DA8F} = "0" iexplore.exe -
Modifies registry class 57 IoCs
Processes:
IEXPLORE.EXEiexplore.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2971393436-602173351-1645505021-1000\{D738EB5E-A794-4C3F-87D2-42A1D41FF210} IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe1100000053bae494d2f5d801d2291c97d2f5d801f2950a98d2f5d80114000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000 iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14" iexplore.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
7zG.exeAUDIODG.EXEdescription pid process Token: SeRestorePrivilege 3724 7zG.exe Token: 35 3724 7zG.exe Token: SeSecurityPrivilege 3724 7zG.exe Token: SeSecurityPrivilege 3724 7zG.exe Token: 33 2316 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2316 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
iexplore.exe7zG.exepid process 1060 iexplore.exe 1060 iexplore.exe 3724 7zG.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
iexplore.exeIEXPLORE.EXEXF-Sublime-KG.exeXF-Sublime-KG.exepid process 1060 iexplore.exe 1060 iexplore.exe 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1060 iexplore.exe 1628 XF-Sublime-KG.exe 2444 XF-Sublime-KG.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
iexplore.exeXF-Sublime-KG.exedescription pid process target process PID 1060 wrote to memory of 1056 1060 iexplore.exe IEXPLORE.EXE PID 1060 wrote to memory of 1056 1060 iexplore.exe IEXPLORE.EXE PID 1060 wrote to memory of 1056 1060 iexplore.exe IEXPLORE.EXE PID 1628 wrote to memory of 2444 1628 XF-Sublime-KG.exe XF-Sublime-KG.exe PID 1628 wrote to memory of 2444 1628 XF-Sublime-KG.exe XF-Sublime-KG.exe PID 1628 wrote to memory of 2444 1628 XF-Sublime-KG.exe XF-Sublime-KG.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://rapidgator.net/file/0e5e5b017ffc7ae94026040432122235/SUBLIME_TEXT_V4.4143_WIN64.7z.html1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1060 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\SUBLIME_TEXT_V4.4143_WIN64\" -spe -an -ai#7zMap27430:108:7zEvent90891⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\SUBLIME_TEXT_V4.4143_WIN64\Crack\XF-Sublime-KG.exe"C:\Users\Admin\Desktop\SUBLIME_TEXT_V4.4143_WIN64\Crack\XF-Sublime-KG.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XF-Sublime-KG.exeC:\Users\Admin\AppData\Local\Temp\XF-Sublime-KG.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x4c81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5bd813f25b25946e19e7b3acf153b3674
SHA11570516b96c7931bd565ac9102e79e1664216997
SHA2566c744ffa4555b4c92c632743742782df3e1b9c33004c73247574da26a759ea2c
SHA512145c738a3702f08d8d307188a4422e3842bc08aced2190f74601d8398d2001cb722e3c32bb6988e35a44a456fb042e6ae833a121da092d21dc2a04683932b47b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD57d08d0bd7612c3fd39c093209d8cb694
SHA169b66f768c16a35994275c89d1dbc68711a046df
SHA256d7c957f56f4e5fd5d757931a6be2066086738656a952cbf078644a01f8e733ff
SHA512d0c50528fd30c5174de1284ab2d289c906ac3175b4ae752462834f50bfdcbcc74978ca957629cbec3c3c24ac7a35825ee05a01a7eab31272d7d6a042357d2729
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\3mhxqpl\imagestore.datFilesize
3KB
MD5ade5f6ae4eeda1892864cf1da0009c96
SHA1444f14357d805a505fe9d70176b088eab9974a40
SHA25641b4e73574548006b5263de9237a04f2eb939f30a3c78f2671109d4c0e865a71
SHA5121062c615201a4a39c778c8eb72913ae0cd933fce4a7b44c9d6db37122876eb094017a05915d5b64d57c34049ab09481161c56af704d39f8a49338a0b1e3c0529
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GO3L93KT\favicon[1].icoFilesize
3KB
MD5cf1faa2e6cdf8c78f971d5927d28dd99
SHA1ec9454d0ef9fa07eb9dd38d44131574fbb4f84ea
SHA2569cd57803d93fbd183de40d1007606a3c30f90fc82a205c7abf4c12d322b7c144
SHA512cbdab9962c62568ee07aa07a00e270c902b721fe0248b88bcc1ae8dfaa8bfe49bc77c40fe87c06ca1cf786dee786af85a45e13c88dd85a06be4a5e71d4177ff0
-
C:\Users\Admin\AppData\Local\Temp\BASSMOD.dllFilesize
33KB
MD5e4ec57e8508c5c4040383ebe6d367928
SHA1b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA2568ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA51277d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
-
C:\Users\Admin\AppData\Local\Temp\BASSMOD.dllFilesize
33KB
MD5e4ec57e8508c5c4040383ebe6d367928
SHA1b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06
SHA2568ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f
SHA51277d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822
-
C:\Users\Admin\AppData\Local\Temp\XF-Sublime-KG.exeFilesize
110KB
MD5f6dc9bf22ec5259f4428e4b33863e270
SHA1ed3758fcd5b85c30423b613e92f73e775af86f50
SHA256edc3d74fa71b78c8ec482c6c36c7304f619c3cd92f90ad4e4645eebc41524cfb
SHA512833544b7b41924f454498d1f4806898c3d0dab06eaae0aeedc6a99e6d1e080d042eaa86915a540579149ac7d2f9ffc8dc267808ec6daa43d594232eb00fd3ac3
-
C:\Users\Admin\AppData\Local\Temp\XF-Sublime-KG.exeFilesize
110KB
MD5f6dc9bf22ec5259f4428e4b33863e270
SHA1ed3758fcd5b85c30423b613e92f73e775af86f50
SHA256edc3d74fa71b78c8ec482c6c36c7304f619c3cd92f90ad4e4645eebc41524cfb
SHA512833544b7b41924f454498d1f4806898c3d0dab06eaae0aeedc6a99e6d1e080d042eaa86915a540579149ac7d2f9ffc8dc267808ec6daa43d594232eb00fd3ac3
-
C:\Users\Admin\AppData\Local\Temp\libgcc_s_dw2-1.dllFilesize
122KB
MD5e45e405491fe9c857e27ed81ff7cebea
SHA1994b5962e7e6910d5ee0ef1dd5316a3ca77c3f4b
SHA25666ac4ccc4d40be26842cd876659241719525114c3d7bfa93c64198918af1cb27
SHA512409c5fd12099770571168f54af644b5f000cfc416ee12a76f63ebcabe9124cfd3b36aa4cee24d66ec9d0c7762191d14f22740c2585a06eafcbf044cba4589c98
-
C:\Users\Admin\AppData\Local\Temp\libgcc_s_dw2-1.dllFilesize
122KB
MD5e45e405491fe9c857e27ed81ff7cebea
SHA1994b5962e7e6910d5ee0ef1dd5316a3ca77c3f4b
SHA25666ac4ccc4d40be26842cd876659241719525114c3d7bfa93c64198918af1cb27
SHA512409c5fd12099770571168f54af644b5f000cfc416ee12a76f63ebcabe9124cfd3b36aa4cee24d66ec9d0c7762191d14f22740c2585a06eafcbf044cba4589c98
-
C:\Users\Admin\AppData\Local\Temp\libtomcrypt.dllFilesize
365KB
MD577b01dd3263b26e9d85f23b0f3e669c6
SHA130a9c56d53271e93e7d880b2caed0ea771e99d6d
SHA2566a011b173d149e6b667b9da3569bb6b05e6038249ab5f020ad448086e02cedaf
SHA5121f8c5c36696536624b849161ee0777f49485c2fb01464e3d4e5edd131527661140f6ed66ad41892e6a0d1b27b07ced738d8dad1ce2f8bacf58a4aef84db62e98
-
C:\Users\Admin\AppData\Local\Temp\libtomcrypt.dllFilesize
365KB
MD577b01dd3263b26e9d85f23b0f3e669c6
SHA130a9c56d53271e93e7d880b2caed0ea771e99d6d
SHA2566a011b173d149e6b667b9da3569bb6b05e6038249ab5f020ad448086e02cedaf
SHA5121f8c5c36696536624b849161ee0777f49485c2fb01464e3d4e5edd131527661140f6ed66ad41892e6a0d1b27b07ced738d8dad1ce2f8bacf58a4aef84db62e98
-
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dllFilesize
67KB
MD5695d4b0b03267985aa0a74dcbf3e3a0e
SHA12c3093161cef7bb823804bac7099202aad23729d
SHA256b87ceea97753d556c4598776c0ac47e5b11797e82416406b418296bd8159e8b2
SHA512efde8057dd2cd603970a4c5ec27e3e25a6449eb5bb66c2a8ac9df45e65d932852f5e24584a2ca166d73e851da0cc781b8b6a1d40d2a61be0a1321b2d12f12fec
-
C:\Users\Admin\AppData\Local\Temp\libwinpthread-1.dllFilesize
67KB
MD5695d4b0b03267985aa0a74dcbf3e3a0e
SHA12c3093161cef7bb823804bac7099202aad23729d
SHA256b87ceea97753d556c4598776c0ac47e5b11797e82416406b418296bd8159e8b2
SHA512efde8057dd2cd603970a4c5ec27e3e25a6449eb5bb66c2a8ac9df45e65d932852f5e24584a2ca166d73e851da0cc781b8b6a1d40d2a61be0a1321b2d12f12fec
-
C:\Users\Admin\Desktop\SUBLIME_TEXT_V4.4143_WIN64.7z.9p926y1.partialFilesize
493KB
MD5b455a70d02301f66fd91e551979e68e2
SHA1f7365e53e54701475ff02be5a9550ff0a005d19f
SHA256e87fe42a0ab54bfe73420e7cc08d9cc0cc9ab839d2bac1dc286643cf61ba2475
SHA5126d7ab3a7907476cdd6f8c9c2be0b10eb7631f8a7ccc8e33986706a5446e5e52dd62cec0b943e2e6c4b5190e761b62391727b503d8a9dffd597854a627088bb72
-
C:\Users\Admin\Desktop\SUBLIME_TEXT_V4.4143_WIN64\Crack\XF-Sublime-KG.exeFilesize
518KB
MD57302bf749281240439214bcbfb334a5a
SHA1576204f2c01ca78370c25d3147f8cbed73b7c205
SHA256e2ee8ae987d783ec5cd4ee7cc8ac968f0ddd85cbd40eacce0df57dea00dc1417
SHA5129b333ceff330d544326dfbfc546f88823aaf4f2b9649aa3b2df5148ed5904d5437eb08470e12bbd693ac8ca80778cbd8400cfa2298afb95ae13848573051afc4
-
C:\Users\Admin\Desktop\SUBLIME_TEXT_V4.4143_WIN64\Crack\XF-Sublime-KG.exeFilesize
518KB
MD57302bf749281240439214bcbfb334a5a
SHA1576204f2c01ca78370c25d3147f8cbed73b7c205
SHA256e2ee8ae987d783ec5cd4ee7cc8ac968f0ddd85cbd40eacce0df57dea00dc1417
SHA5129b333ceff330d544326dfbfc546f88823aaf4f2b9649aa3b2df5148ed5904d5437eb08470e12bbd693ac8ca80778cbd8400cfa2298afb95ae13848573051afc4
-
memory/2444-139-0x0000000000000000-mapping.dmp
-
memory/2444-150-0x0000000000AC0000-0x0000000000AE3000-memory.dmpFilesize
140KB
-
memory/2444-151-0x000000006F500000-0x000000006F5E8000-memory.dmpFilesize
928KB
-
memory/2444-153-0x0000000000AC0000-0x0000000000AE3000-memory.dmpFilesize
140KB
-
memory/2444-152-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB
-
memory/2444-154-0x0000000010000000-0x0000000010013000-memory.dmpFilesize
76KB