Overview

overview

10

Static

static

5

Passware K...er.exe

windows7-x64

10

Passware K...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    303s
  • max time network
    304s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12-11-2024 22:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Passware Kit Forensic 2021 Pre-patched retail installer.exe

  • Size

    381.5MB

  • MD5

    298faa0669e7d439d1ba4a3d641cc619

  • SHA1

    093f271f3c1b4b6e6b948ee61b01ac2c7c02a0fd

  • SHA256

    344b9876db6b8649b9d65448a715b1923011ea9146e116908eb4d35bd8fa3af6

  • SHA512

    0cca0f0e1f1fae77eba6f438ce53c9542811533d9015a24bebaf4fce4ba936a7642c51f25bec74171e60591f10d8bdf7f76e8e49f27e640209b81bdfcfcbda01

  • SSDEEP

    6291456:hVqIbo0MM0kYOnyEBVToKg+IKiwA4kB88xU+WDyb/B/22aMBb7WDnexkq50NguO2:6Is0XRBV3LR4B8vm/hqMdWLeW00NgBa

Score
10/10
quasardefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 5 IoCs
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 3 IoCs

    Abuse Regasm to proxy execution of malicious code.

    defense_evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 49 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 18 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 2 IoCs
    defense_evasionprivilege_escalation
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies data under HKEY_USERS 43 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Passware Kit Forensic 2021 Pre-patched retail installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Passware Kit Forensic 2021 Pre-patched retail installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Users\Admin\AppData\Local\Temp\NvTelemetry\Passware Kit Forensic 2021 Pre-patched retail installer.exe
      "C:\Users\Admin\AppData\Local\Temp\NvTelemetry\Passware Kit Forensic 2021 Pre-patched retail installer.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Windows\system32\msiexec.exe
        msiexec.exe /i C:\Users\Admin\AppData\Local\Temp\MSI168D.tmp
        3⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2332
        • C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe
          "C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1704
          • C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe
            "C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe" --type=gpu-process --field-trial-handle=1080,15233452073931603820,16634458866778948008,131072 --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --service-request-channel-token=8884917715466876583 --mojo-platform-channel-handle=1088 --ignored=" --type=renderer " /prefetch:2
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:920
          • C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe
            "C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe" --type=utility --field-trial-handle=1080,15233452073931603820,16634458866778948008,131072 --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --service-request-channel-token=1685524464626796508 --mojo-platform-channel-handle=1368 /prefetch:8
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:3036
          • C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe
            "C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe" --type=renderer --field-trial-handle=1080,15233452073931603820,16634458866778948008,131072 --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-path="C:\Program Files\Passware\Passware Kit 2021\resources\app.asar" --node-integration --webview-tag --no-sandbox --no-zygote --background-color=#fff --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=6041817204133817049 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1552 /prefetch:1
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:960
          • C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe
            "C:\Program Files\Passware\Passware Kit 2021\PasswareKitForensic.exe" "C:\Program Files\Passware\Passware Kit 2021\resources\app.asar\engine-initializer.js"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            PID:3012
    • C:\Users\Admin\AppData\Local\Temp\NvTelemetry\ConsoleApp3.exe
      C:\Users\Admin\AppData\Local\Temp\NvTelemetry\ConsoleApp3.exe
      2⤵
      • System Binary Proxy Execution: Regsvcs/Regasm
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2988
      • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Access Token Manipulation: Create Process with Token
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
          "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 2124
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2284
      • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Access Token Manipulation: Create Process with Token
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:588
        • C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
          "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 588
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1436
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Mjtbwkkhvk.vbs"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Passware Kit Forensic\KitForensic.exe'
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2096
      • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
        C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1788
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\G3RUW2G69PaM.bat" "
          4⤵
          • System Binary Proxy Execution: Regsvcs/Regasm
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1640
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2404
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 10 localhost
            5⤵
            • System Location Discovery: System Language Discovery
            • System Network Configuration Discovery: Internet Connection Discovery
            • Runs ping.exe
            PID:1580
          • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
            "C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2084
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 1500
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1740
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Loads dropped DLL
    • Blocklisted process makes network request
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding E9D0A00E17C47D4DDFADD081D05149E1 C
      2⤵
      • Loads dropped DLL
      PID:1224
    • C:\Windows\system32\MsiExec.exe
      C:\Windows\system32\MsiExec.exe -Embedding 8581A31B9A3147B68503DB2334BB91F4
      2⤵
      • Loads dropped DLL
      PID:2284
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 57A45CC7ACA8157476D7F1082924A41B
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:2464
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
      PID:2708
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000003D4" "00000000000003D0"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:2948

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Command and Scripting Interpreter

    1
    T1059

    PowerShell

    1
    T1059.001

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Access Token Manipulation

    1
    T1134

    Create Process with Token

    1
    T1134.002

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Access Token Manipulation

    1
    T1134

    Create Process with Token

    1
    T1134.002

    Modify Registry

    1
    T1112

    System Binary Proxy Execution

    1
    T1218

    Regsvcs/Regasm

    1
    T1218.009

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    2
    T1012

    Remote System Discovery

    1
    T1018

    System Information Discovery

    3
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    System Network Configuration Discovery

    1
    T1016

    Internet Connection Discovery

    1
    T1016.001

    Lateral Movement

    Collection

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Config.Msi\f7a65a8.rbs
      Filesize

      201KB

      MD5

      fe2f6e930930085ac66b2e852571af69

      SHA1

      16b817aeebe9c2f698baf801f03d2933078dd1e8

      SHA256

      8ea90ec42f3c76f64a4890da8dbc90090ba28e472de17f0d7e9ea6a78f8ae725

      SHA512

      411c1643957ab8230626e4476022f9f52dc015f465a562be1dbe719b2b2f5d6e3e4edf4e562b09f990784dffb9dc7a47b3dcc1188e6e5a6ae024f38778229415

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      342B

      MD5

      fce8f305c654a31e5dbb0731f3854d7a

      SHA1

      0581a9c2b66b79d3a46c9d8c893c662cc50c235a

      SHA256

      9aea3aaa80cca99d57afd8d7965c900a3f204635423338d0dea3195d6c1414cd

      SHA512

      7ba8bf480c134f072927bb92006aa53f67eede5e3fea559c15158503be09f340db0f5e1d92235225f9bcdc6e1cb4cfbdbe0b6e13f13a3049569ddabff5be5cb9

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Cab2416.tmp
      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\G3RUW2G69PaM.bat
      Filesize

      203B

      MD5

      50f7a469dc9fd84731433193b7e02f86

      SHA1

      2b114ced6383e89664e145650ed7756c55e0f850

      SHA256

      34b49774b38ac542dd55b2514f9c9918925c225f85aeef80556288a46a376e57

      SHA512

      6372007ed5c7ed8a33d464ad3755417bc9a00c3d19e1e4c1e84c3489f31bd6f3fb2fec9f51bfc8fe50706fe7aac9c050593e1cdef9d938d4102074795edfcfe0

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\MSI25F4.tmp
      Filesize

      3.4MB

      MD5

      4bef1140a7cadc194f2c20bff8f3b71d

      SHA1

      fa0e79b3dd1bad013c47ac8e0ded03216d044635

      SHA256

      a40a496fcfb6ab3935098e2158681e095dc83a66f3984aa01e1f0997208749da

      SHA512

      c2551a9b758d74d203c49c9bc185bd1dfc022d090718004536757fede4c6e4b8a014f385acc713ab94c83c45b1fbf0c6d5a6f559d4c0c29114344f1200ea0c32

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar2429.tmp
      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\_Mjtbwkkhvk.vbs
      Filesize

      201B

      MD5

      037e1750f892c1bc7d7e45d0e7735d57

      SHA1

      32d9b435ac76f32271fed9d602e723a64621bf36

      SHA256

      a1c60aeef9648ffc3619215635803794319570461d1c51994ad39610aeb6ad59

      SHA512

      59734b5e8f8ffe76288820ef5a538a3243a23fc085418d69015704372282b59d87c2a8c5a927d87db5bd53e6985f66db6c13d93409da7ea28fb96e7c178d8c82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Passware\Passware Kit\2018\config.json
      Filesize

      76B

      MD5

      10d9c9508ddeb211d66ac44bbead244a

      SHA1

      25091f6d195875aa8746a5add7476e613124122a

      SHA256

      e5237d0cbea9dff358ec391de53c272813ba7fcb71d9d16179e2478cf9326e5d

      SHA512

      d223982b4bd11da7f6ae8391d30c20a1e5949edbf78460951862037c5dc6e0303a7c31039a5f55e7b6d57ce7dc4ef629582c71c712debe42dabda1e91e170304

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Passware\Passware Kit\2018\config.json
      Filesize

      1KB

      MD5

      1df99297e6f395c777e96a277bcad6d0

      SHA1

      cbaf37de2293a2437ca7108146d3ed1f3d27de10

      SHA256

      519e9c6abd9771e5b99fe2a2d3a8976ea4697eb6b323212292647f7b85e854b1

      SHA512

      2f56b630e3f5bbdac9d822553bdfe1d3fe5e586ee4fee198dd70041c6e1cac0e8b75891658761c3006e91e4442eb0f06f6970cd533558fe9d4f8660cce288be8

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Passware\Passware Kit\2018\config.json
      Filesize

      1KB

      MD5

      095e544838516f78ac19c36c72fc6106

      SHA1

      b000c21be3478c6e80f9e0321ce546aa85a54947

      SHA256

      0123e3c5ccceafb7b849652e542250d373492ff74a63aa394e6cabde83f3f0a0

      SHA512

      7fa59c47fe5af0be91a66355fb2385de9db73d5c42e19720cc3ee82d7b2c70c0ea4b2d066a9fec0f51ed0adf1965bf6feb1c7e4a27ef9caeb31d8207e39c3ecd

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Passware\Passware Kit\2018\config.json
      Filesize

      1KB

      MD5

      241845117e07d01f8d46839156f9dc2d

      SHA1

      a1f5b0eaa65ccaf2ca3d5fd4315074f60abd9ba0

      SHA256

      73073069da05d89bf656597473e23761b0bfc2df4aa305b9a011678a72c6b52f

      SHA512

      5dc8b0bcf5e77d3c177ec6f6ef099693146938bdab801f1c26638499323cb9e42372f7e9078858c2e0d31d1e130939273a1a43f2858020a84a7f44414193aa30

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Passware\Passware Kit\2018\config.json
      Filesize

      1KB

      MD5

      11201b4b7ac63bdabe0762c8962939f2

      SHA1

      a5a029f11811cbdf4e091b08a660d1b91393a581

      SHA256

      506e22b00f5c20178a5eb2c9a633674522e0beed65bde106345aa01be2fae741

      SHA512

      09aac8033fe84141862f7f9c412d1d55b4cb05c85a34d119aeb2a9eaf6df572803fbc11220abcdc19370a7898e0c389a9d8e2ed5ac45ec9c56068bae2bf893bd

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Passware\Passware Kit\2018\config.json
      Filesize

      2B

      MD5

      99914b932bd37a50b983c5e7c90ae93b

      SHA1

      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

      SHA256

      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

      SHA512

      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Passware\Passware Kit\2018\config.json.1731047310
      Filesize

      47B

      MD5

      8094d9ebb783e84793317facca3dfe06

      SHA1

      f63c277555ca0ea03c05c6e699c458f23f3588e9

      SHA256

      d155fae558bc9d9f7a88ca3e6df3f9cfd82a5aea1dd47875a6e593ea29d144a2

      SHA512

      dbfe3735aa090535eb9bfa07371b9e1008a204a3335a62e2feb849496df557a0c33912a65ff037d511df7cfe14bc0bba3c81a611f3e325485d47a628b541d985

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Passware\Passware Kit\2018\config.json.3886554126
      Filesize

      1KB

      MD5

      b68ce014a5a12f0e9f5472cf3d47f50f

      SHA1

      322dbd881b98dd1198290afb38b6baf613b3c38f

      SHA256

      89bdd4969cab2b55c69b64cbb254b6840097a6d4bbe8bb91b974ab13dd496a01

      SHA512

      3c7da88ff7ed0095ec628e51cb6412d5966f00a9f940321bbf9e2ff1b753af98af8deefa628aa92000e6244e14fe9c4a7384a0191df64cbe7f84a1f96bd0e674

      Download Submit

    • C:\Windows\Installer\MSI6E76.tmp
      Filesize

      118KB

      MD5

      0a0213ab2116de22ff1eca662f74ed53

      SHA1

      a6a96f7ab19f72f7ad068b285ab87a28d5a9331a

      SHA256

      33eac3284885cc1b6709f7c29ed596fc1494a395281105cd3efb2f6c9c91a678

      SHA512

      4dbb7d4942993f7da5b969a5361c59ba3be064cbdd15425948a0625632cc0ee6af16b0866aadb179818c67bda5dab13aac0c977f423eac785094075a14398d89

      Download Submit

    • \Users\Admin\AppData\Local\Temp\AdvancedRun.exe
      Filesize

      88KB

      MD5

      17fc12902f4769af3a9271eb4e2dacce

      SHA1

      9a4a1581cc3971579574f837e110f3bd6d529dab

      SHA256

      29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

      SHA512

      036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

      Download Submit

    • \Users\Admin\AppData\Local\Temp\RegAsm.exe
      Filesize

      63KB

      MD5

      b58b926c3574d28d5b7fdd2ca3ec30d5

      SHA1

      d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

      SHA256

      6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

      SHA512

      b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

      Download Submit

    • memory/920-1014-0x0000000000060000-0x0000000000061000-memory.dmp

      Filesize

      4KB

      Download

    • memory/920-1050-0x0000000077D70000-0x0000000077D71000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1788-126-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1788-124-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1788-120-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1788-122-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1788-127-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1788-129-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1788-130-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1788-118-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2084-151-0x0000000000B80000-0x0000000000B92000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2988-23-0x00000000010F0000-0x0000000001140000-memory.dmp

      Filesize

      320KB

      Download

    • memory/2988-83-0x0000000000910000-0x000000000092C000-memory.dmp

      Filesize

      112KB

      Download

    • memory/2988-24-0x00000000003E0000-0x00000000003EA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/3012-1086-0x00000000044C0000-0x00000000054C0000-memory.dmp

      Filesize

      16.0MB

      Download