asyncrat | d8f37e199f10881b2045823553fd64f3f52ec616e24f2235a47dae7c435a3c72

Analysis

max time kernel
78s
max time network
151s
platform
windows10_x64
resource
win10v200722
submitted
08-10-2020 12:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6818329ca33d751d13a0cba07212488f.exe
Size

763KB
MD5

6818329ca33d751d13a0cba07212488f
SHA1

cb36680452e108e41625671a76f49902933d1338
SHA256

d8f37e199f10881b2045823553fd64f3f52ec616e24f2235a47dae7c435a3c72
SHA512

60a8f87a5688dc8c48fdcf3f08864ca65e7304e0e6051260a4c94ade0514fb66e53e74f4f2b5f93ca35b31f1b1a37c8c4506c8c29c2546667bdbe8097b3a5e49

Score

10^/10

asyncrat azorult oski raccoon ee3b370277b98939f8098234def6cb188c03591f discovery evasion infostealer rat spyware stealer trojan

Malware Config

Extracted

Family

raccoon

Botnet

ee3b370277b98939f8098234def6cb188c03591f

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

oski

malarcvgs.ac.ug

Extracted

Family

azorult

http://195.245.112.115/index.php

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Contains code to disable Windows Defender 6 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/memory/3864-96-0x0000000000400000-0x000000000040C000-memory.dmp	disable_win_def
behavioral2/memory/3192-97-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral2/memory/3192-98-0x0000000000403BEE-mapping.dmp	disable_win_def
behavioral2/memory/3864-99-0x000000000040616E-mapping.dmp	disable_win_def
C:\Windows\Temp\3qwzf0nx.exe	disable_win_def
C:\Windows\temp\3qwzf0nx.exe	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
Downloads MZ/PE file

Executes dropped EXE 14 IoCs

Processes:

Liski.exeLiski.exeLima.exeLima.exeLima.exeLima.exercRCJIXbsB.exeEhFwYNGVQz.exeWjrJAgnPkE.exeu4LeQhQQrp.exercRCJIXbsB.exeWjrJAgnPkE.exeu4LeQhQQrp.exe3qwzf0nx.exe

pid	process
3160	Liski.exe
3420	Liski.exe
736	Lima.exe
2488	Lima.exe
2596	Lima.exe
196	Lima.exe
924	rcRCJIXbsB.exe
1492	EhFwYNGVQz.exe
3980	WjrJAgnPkE.exe
1204	u4LeQhQQrp.exe
3816	rcRCJIXbsB.exe
3864	WjrJAgnPkE.exe
3192	u4LeQhQQrp.exe
2820	3qwzf0nx.exe

Loads dropped DLL 9 IoCs

Processes:

Liski.exe6818329ca33d751d13a0cba07212488f.exe

pid	process
3420	Liski.exe
3420	Liski.exe
3420	Liski.exe
3232	6818329ca33d751d13a0cba07212488f.exe
3232	6818329ca33d751d13a0cba07212488f.exe
3232	6818329ca33d751d13a0cba07212488f.exe
3232	6818329ca33d751d13a0cba07212488f.exe
3232	6818329ca33d751d13a0cba07212488f.exe
3232	6818329ca33d751d13a0cba07212488f.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

u4LeQhQQrp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	u4LeQhQQrp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	u4LeQhQQrp.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 1 IoCs

Processes:

6818329ca33d751d13a0cba07212488f.exe

description ioc process

File created C:\Users\Admin\AppData\LocalLow\FLesFFxEsEs\desktop.ini 6818329ca33d751d13a0cba07212488f.exe

description	ioc	process
File created	C:\Users\Admin\AppData\LocalLow\FLesFFxEsEs\desktop.ini	6818329ca33d751d13a0cba07212488f.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

6818329ca33d751d13a0cba07212488f.exeLiski.exeLima.exercRCJIXbsB.exeWjrJAgnPkE.exeu4LeQhQQrp.exe

description	pid	process	target process
PID 3908 set thread context of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3160 set thread context of 3420	3160	Liski.exe	Liski.exe
PID 736 set thread context of 196	736	Lima.exe	Lima.exe
PID 924 set thread context of 3816	924	rcRCJIXbsB.exe	rcRCJIXbsB.exe
PID 3980 set thread context of 3864	3980	WjrJAgnPkE.exe	WjrJAgnPkE.exe
PID 1204 set thread context of 3192	1204	u4LeQhQQrp.exe	u4LeQhQQrp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Liski.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Liski.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3904 timeout.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

1016 taskkill.exe
2172 taskkill.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Liski.exe

pid	process
3904	timeout.exe

pid	process
1016	taskkill.exe
2172	taskkill.exe

Modifies registry class 2 IoCs

Processes:

6818329ca33d751d13a0cba07212488f.exeLiski.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	6818329ca33d751d13a0cba07212488f.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	Liski.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Lima.exeWjrJAgnPkE.exePowershell.exepowershell.exe

pid	process
736	Lima.exe
736	Lima.exe
736	Lima.exe
736	Lima.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3516	Powershell.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3444	powershell.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

6818329ca33d751d13a0cba07212488f.exeLiski.exetaskkill.exeLima.exercRCJIXbsB.exeu4LeQhQQrp.exeWjrJAgnPkE.exepowershell.exePowershell.exeWjrJAgnPkE.exetaskkill.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3908	6818329ca33d751d13a0cba07212488f.exe
Token: SeDebugPrivilege	3160	Liski.exe
Token: SeDebugPrivilege	1016	taskkill.exe
Token: SeDebugPrivilege	736	Lima.exe
Token: SeDebugPrivilege	924	rcRCJIXbsB.exe
Token: SeDebugPrivilege	1204	u4LeQhQQrp.exe
Token: SeDebugPrivilege	3980	WjrJAgnPkE.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeDebugPrivilege	3516	Powershell.exe
Token: SeDebugPrivilege	3864	WjrJAgnPkE.exe
Token: SeDebugPrivilege	2172	taskkill.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeIncreaseQuotaPrivilege	3596	powershell.exe
Token: SeSecurityPrivilege	3596	powershell.exe
Token: SeTakeOwnershipPrivilege	3596	powershell.exe
Token: SeLoadDriverPrivilege	3596	powershell.exe
Token: SeSystemProfilePrivilege	3596	powershell.exe
Token: SeSystemtimePrivilege	3596	powershell.exe
Token: SeProfSingleProcessPrivilege	3596	powershell.exe
Token: SeIncBasePriorityPrivilege	3596	powershell.exe
Token: SeCreatePagefilePrivilege	3596	powershell.exe
Token: SeBackupPrivilege	3596	powershell.exe
Token: SeRestorePrivilege	3596	powershell.exe
Token: SeShutdownPrivilege	3596	powershell.exe
Token: SeDebugPrivilege	3596	powershell.exe
Token: SeSystemEnvironmentPrivilege	3596	powershell.exe
Token: SeRemoteShutdownPrivilege	3596	powershell.exe
Token: SeUndockPrivilege	3596	powershell.exe
Token: SeManageVolumePrivilege	3596	powershell.exe
Token: 33	3596	powershell.exe
Token: 34	3596	powershell.exe
Token: 35	3596	powershell.exe
Token: 36	3596	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	3448	powershell.exe
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeDebugPrivilege	728	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WjrJAgnPkE.exe

pid process

3864 WjrJAgnPkE.exe
3864 WjrJAgnPkE.exe

pid	process
3864	WjrJAgnPkE.exe
3864	WjrJAgnPkE.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6818329ca33d751d13a0cba07212488f.exeWScript.exeLiski.exeWScript.exeLiski.execmd.exeLima.exe6818329ca33d751d13a0cba07212488f.exe

description	pid	process	target process
PID 3908 wrote to memory of 3856	3908	6818329ca33d751d13a0cba07212488f.exe	WScript.exe
PID 3908 wrote to memory of 3856	3908	6818329ca33d751d13a0cba07212488f.exe	WScript.exe
PID 3908 wrote to memory of 3856	3908	6818329ca33d751d13a0cba07212488f.exe	WScript.exe
PID 3908 wrote to memory of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3908 wrote to memory of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3908 wrote to memory of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3908 wrote to memory of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3908 wrote to memory of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3908 wrote to memory of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3908 wrote to memory of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3908 wrote to memory of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3908 wrote to memory of 3232	3908	6818329ca33d751d13a0cba07212488f.exe	6818329ca33d751d13a0cba07212488f.exe
PID 3856 wrote to memory of 3160	3856	WScript.exe	Liski.exe
PID 3856 wrote to memory of 3160	3856	WScript.exe	Liski.exe
PID 3856 wrote to memory of 3160	3856	WScript.exe	Liski.exe
PID 3160 wrote to memory of 3628	3160	Liski.exe	WScript.exe
PID 3160 wrote to memory of 3628	3160	Liski.exe	WScript.exe
PID 3160 wrote to memory of 3628	3160	Liski.exe	WScript.exe
PID 3160 wrote to memory of 3420	3160	Liski.exe	Liski.exe
PID 3160 wrote to memory of 3420	3160	Liski.exe	Liski.exe
PID 3160 wrote to memory of 3420	3160	Liski.exe	Liski.exe
PID 3160 wrote to memory of 3420	3160	Liski.exe	Liski.exe
PID 3160 wrote to memory of 3420	3160	Liski.exe	Liski.exe
PID 3160 wrote to memory of 3420	3160	Liski.exe	Liski.exe
PID 3160 wrote to memory of 3420	3160	Liski.exe	Liski.exe
PID 3160 wrote to memory of 3420	3160	Liski.exe	Liski.exe
PID 3160 wrote to memory of 3420	3160	Liski.exe	Liski.exe
PID 3628 wrote to memory of 736	3628	WScript.exe	Lima.exe
PID 3628 wrote to memory of 736	3628	WScript.exe	Lima.exe
PID 3628 wrote to memory of 736	3628	WScript.exe	Lima.exe
PID 3420 wrote to memory of 2428	3420	Liski.exe	cmd.exe
PID 3420 wrote to memory of 2428	3420	Liski.exe	cmd.exe
PID 3420 wrote to memory of 2428	3420	Liski.exe	cmd.exe
PID 2428 wrote to memory of 1016	2428	cmd.exe	taskkill.exe
PID 2428 wrote to memory of 1016	2428	cmd.exe	taskkill.exe
PID 2428 wrote to memory of 1016	2428	cmd.exe	taskkill.exe
PID 736 wrote to memory of 2488	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 2488	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 2488	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 2596	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 2596	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 2596	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 196	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 196	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 196	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 196	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 196	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 196	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 196	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 196	736	Lima.exe	Lima.exe
PID 736 wrote to memory of 196	736	Lima.exe	Lima.exe
PID 3232 wrote to memory of 924	3232	6818329ca33d751d13a0cba07212488f.exe	rcRCJIXbsB.exe
PID 3232 wrote to memory of 924	3232	6818329ca33d751d13a0cba07212488f.exe	rcRCJIXbsB.exe
PID 3232 wrote to memory of 924	3232	6818329ca33d751d13a0cba07212488f.exe	rcRCJIXbsB.exe
PID 3232 wrote to memory of 1492	3232	6818329ca33d751d13a0cba07212488f.exe	EhFwYNGVQz.exe
PID 3232 wrote to memory of 1492	3232	6818329ca33d751d13a0cba07212488f.exe	EhFwYNGVQz.exe
PID 3232 wrote to memory of 1492	3232	6818329ca33d751d13a0cba07212488f.exe	EhFwYNGVQz.exe
PID 3232 wrote to memory of 3980	3232	6818329ca33d751d13a0cba07212488f.exe	WjrJAgnPkE.exe
PID 3232 wrote to memory of 3980	3232	6818329ca33d751d13a0cba07212488f.exe	WjrJAgnPkE.exe
PID 3232 wrote to memory of 3980	3232	6818329ca33d751d13a0cba07212488f.exe	WjrJAgnPkE.exe
PID 3232 wrote to memory of 1204	3232	6818329ca33d751d13a0cba07212488f.exe	u4LeQhQQrp.exe
PID 3232 wrote to memory of 1204	3232	6818329ca33d751d13a0cba07212488f.exe	u4LeQhQQrp.exe
PID 3232 wrote to memory of 1204	3232	6818329ca33d751d13a0cba07212488f.exe	u4LeQhQQrp.exe
PID 3232 wrote to memory of 2472	3232	6818329ca33d751d13a0cba07212488f.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6818329ca33d751d13a0cba07212488f.exe
"C:\Users\Admin\AppData\Local\Temp\6818329ca33d751d13a0cba07212488f.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3908

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Cwkusquk.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:3856

C:\Users\Admin\AppData\Local\Temp\Liski.exe
"C:\Users\Admin\AppData\Local\Temp\Liski.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Sbqmcozvu.vbs"
4⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Users\Admin\AppData\Local\Temp\Lima.exe
"C:\Users\Admin\AppData\Local\Temp\Lima.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:736

C:\Users\Admin\AppData\Local\Temp\Lima.exe
"C:\Users\Admin\AppData\Local\Temp\Lima.exe"
6⤵
- Executes dropped EXE
PID:2488

C:\Users\Admin\AppData\Local\Temp\Lima.exe
"C:\Users\Admin\AppData\Local\Temp\Lima.exe"
6⤵
- Executes dropped EXE
PID:2596

C:\Users\Admin\AppData\Local\Temp\Lima.exe
"C:\Users\Admin\AppData\Local\Temp\Lima.exe"
6⤵
- Executes dropped EXE
PID:196

C:\Users\Admin\AppData\Local\Temp\Liski.exe
"C:\Users\Admin\AppData\Local\Temp\Liski.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /pid 3420 & erase C:\Users\Admin\AppData\Local\Temp\Liski.exe & RD /S /Q C:\\ProgramData\\276637936296342\\* & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\taskkill.exe
taskkill /pid 3420
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Users\Admin\AppData\Local\Temp\6818329ca33d751d13a0cba07212488f.exe
"C:\Users\Admin\AppData\Local\Temp\6818329ca33d751d13a0cba07212488f.exe"
2⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:3232

C:\Users\Admin\AppData\Local\Temp\rcRCJIXbsB.exe
"C:\Users\Admin\AppData\Local\Temp\rcRCJIXbsB.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\ddvlc.exe"'
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516

C:\Users\Admin\AppData\Local\Temp\rcRCJIXbsB.exe
"C:\Users\Admin\AppData\Local\Temp\rcRCJIXbsB.exe"
4⤵
- Executes dropped EXE
PID:3816

C:\Users\Admin\AppData\Local\Temp\EhFwYNGVQz.exe
"C:\Users\Admin\AppData\Local\Temp\EhFwYNGVQz.exe"
3⤵
- Executes dropped EXE
PID:1492

C:\Users\Admin\AppData\Local\Temp\WjrJAgnPkE.exe
"C:\Users\Admin\AppData\Local\Temp\WjrJAgnPkE.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Users\Admin\AppData\Local\Temp\WjrJAgnPkE.exe
"C:\Users\Admin\AppData\Local\Temp\WjrJAgnPkE.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3864

\??\c:\windows\SysWOW64\cmstp.exe
"c:\windows\system32\cmstp.exe" /au C:\Windows\temp\jcxxn4ri.inf
5⤵
PID:2704

C:\Users\Admin\AppData\Local\Temp\u4LeQhQQrp.exe
"C:\Users\Admin\AppData\Local\Temp\u4LeQhQQrp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Users\Admin\AppData\Local\Temp\u4LeQhQQrp.exe
"C:\Users\Admin\AppData\Local\Temp\u4LeQhQQrp.exe"
4⤵
- Executes dropped EXE
- Windows security modification
PID:3192

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6818329ca33d751d13a0cba07212488f.exe"
3⤵
PID:2472

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:3904

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
cmd /c start C:\Windows\temp\3qwzf0nx.exe
2⤵
PID:496

C:\Windows\temp\3qwzf0nx.exe
C:\Windows\temp\3qwzf0nx.exe
3⤵
- Executes dropped EXE
PID:2820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3596

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
4⤵
PID:3916

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
4⤵
PID:2436

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
4⤵
PID:4148

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
4⤵
PID:4236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
4⤵
PID:4360

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM cmstp.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\WjrJAgnPkE.exe.log

MD5
957779c42144282d8cd83192b8fbc7cf

SHA1
de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

SHA256
0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

SHA512
f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\rcRCJIXbsB.exe.log

MD5
957779c42144282d8cd83192b8fbc7cf

SHA1
de83d08d2cca06b9ff3d1ef239d6b60b705d25fe

SHA256
0d7ca7ba65e2b465e4878e324ceab8f8981f5ec06dcf5bc32559a4467a9c7d51

SHA512
f1549c61b4f2906d13b2aabb74772c2bc826cd42373d7bb6c48cbb125d5aa2ec17617e6b5e67e8aae3bb5790cc831cdba48a45008ed01df4fba8be448cce39fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cwkusquk.vbs

MD5
1cf4b99e9c62a7882cabff58cbded4cf

SHA1
bcd138d6f7215b898e197e89a7f5f4213b209c74

SHA256
87730ffae7cc475bfe082fdcbf55c809b31a9321c5957f2c324b91d5f0fe1288

SHA512
d25bc5ceea5ba3166461827582211e0f695afcd7867c6cb75206eca52ff2ab16f81d847a2c3493806c200ea3a650ba49c8d27aec38059a434bc3e688ddae8c70

Download Submit
C:\Users\Admin\AppData\Local\Temp\EhFwYNGVQz.exe

MD5
dad40f576369577702d6723053cc6621

SHA1
bea65eec8d3b3cb9c29eefb5825403ace42020be

SHA256
c1e9a93d4333300e178c7ea651b23149aa206c96f4c985e02e65406d813764ea

SHA512
d97859073f2b7ff1ff83cbc5c5c85c4099e3582464df98481649e0c1b7310c0f404ddb56ae80d7bce5cf7b5d183384a8ecaf47cfb1f48c43a98e64157cdad179

Download Submit
C:\Users\Admin\AppData\Local\Temp\EhFwYNGVQz.exe

MD5
dad40f576369577702d6723053cc6621

SHA1
bea65eec8d3b3cb9c29eefb5825403ace42020be

SHA256
c1e9a93d4333300e178c7ea651b23149aa206c96f4c985e02e65406d813764ea

SHA512
d97859073f2b7ff1ff83cbc5c5c85c4099e3582464df98481649e0c1b7310c0f404ddb56ae80d7bce5cf7b5d183384a8ecaf47cfb1f48c43a98e64157cdad179

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lima.exe

MD5
1f9a65ffd58276503a818ef5674a469e

SHA1
52da20bce143c060c9eb8e26b0c7b7fa4a14ef1d

SHA256
4d49aeda8442476ee7231f827263ff1fa9b8d2e1aea5f3a37a63361404e293e0

SHA512
427e62b9a70e3087423c0b573de1fba948ccdc490ffa728f377013e35fe2fb592791419e3cebbac5bcecf1102459dfd9a71dc35ea45753ef2d6afd41a77c0e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lima.exe

MD5
1f9a65ffd58276503a818ef5674a469e

SHA1
52da20bce143c060c9eb8e26b0c7b7fa4a14ef1d

SHA256
4d49aeda8442476ee7231f827263ff1fa9b8d2e1aea5f3a37a63361404e293e0

SHA512
427e62b9a70e3087423c0b573de1fba948ccdc490ffa728f377013e35fe2fb592791419e3cebbac5bcecf1102459dfd9a71dc35ea45753ef2d6afd41a77c0e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lima.exe

MD5
1f9a65ffd58276503a818ef5674a469e

SHA1
52da20bce143c060c9eb8e26b0c7b7fa4a14ef1d

SHA256
4d49aeda8442476ee7231f827263ff1fa9b8d2e1aea5f3a37a63361404e293e0

SHA512
427e62b9a70e3087423c0b573de1fba948ccdc490ffa728f377013e35fe2fb592791419e3cebbac5bcecf1102459dfd9a71dc35ea45753ef2d6afd41a77c0e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lima.exe

MD5
1f9a65ffd58276503a818ef5674a469e

SHA1
52da20bce143c060c9eb8e26b0c7b7fa4a14ef1d

SHA256
4d49aeda8442476ee7231f827263ff1fa9b8d2e1aea5f3a37a63361404e293e0

SHA512
427e62b9a70e3087423c0b573de1fba948ccdc490ffa728f377013e35fe2fb592791419e3cebbac5bcecf1102459dfd9a71dc35ea45753ef2d6afd41a77c0e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lima.exe

MD5
1f9a65ffd58276503a818ef5674a469e

SHA1
52da20bce143c060c9eb8e26b0c7b7fa4a14ef1d

SHA256
4d49aeda8442476ee7231f827263ff1fa9b8d2e1aea5f3a37a63361404e293e0

SHA512
427e62b9a70e3087423c0b573de1fba948ccdc490ffa728f377013e35fe2fb592791419e3cebbac5bcecf1102459dfd9a71dc35ea45753ef2d6afd41a77c0e75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Liski.exe

MD5
a36a4c72554fcd7b9822de16f96fa9a9

SHA1
a3a52242554941101f33a704b1069cd8ca499d4d

SHA256
5c12a00420f991356a0f6b678594078c33e9f3f3a0ef0622519da1c8920a97a5

SHA512
321787edfc9a774fd9d5c9f6e5c40aedf6756a06b574e10dab66e4d47b6c5a9cfd606fecd080425b8556f252a5d571b03600fc4360109ab0937ffc7a92b47f0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Liski.exe

MD5
a36a4c72554fcd7b9822de16f96fa9a9

SHA1
a3a52242554941101f33a704b1069cd8ca499d4d

SHA256
5c12a00420f991356a0f6b678594078c33e9f3f3a0ef0622519da1c8920a97a5

SHA512
321787edfc9a774fd9d5c9f6e5c40aedf6756a06b574e10dab66e4d47b6c5a9cfd606fecd080425b8556f252a5d571b03600fc4360109ab0937ffc7a92b47f0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Liski.exe

MD5
a36a4c72554fcd7b9822de16f96fa9a9

SHA1
a3a52242554941101f33a704b1069cd8ca499d4d

SHA256
5c12a00420f991356a0f6b678594078c33e9f3f3a0ef0622519da1c8920a97a5

SHA512
321787edfc9a774fd9d5c9f6e5c40aedf6756a06b574e10dab66e4d47b6c5a9cfd606fecd080425b8556f252a5d571b03600fc4360109ab0937ffc7a92b47f0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sbqmcozvu.vbs

MD5
772ee29b82b3727c11e2412a25a78fea

SHA1
0eae474455c4e0c645263d6944c6def429f9f96a

SHA256
632e2835e59d6d5096e4a20f92a4d8b210048324a6425ffa298c30361a88987b

SHA512
6c803706812b3badd9065103587dbf26cfcb01660d8d2071a49d39f89877b1d3db2a1620f7d40110c86bf5582bd1f937e032fdebfbab8f635ad835c31e315edb

Download Submit
C:\Users\Admin\AppData\Local\Temp\WjrJAgnPkE.exe

MD5
51ab466b7973a25da110584522dc4011

SHA1
759f944cd579d8d55df3c81c0bd75d0e27936eed

SHA256
ed184e1c76f982d9537a281ac7cc805179e72d9ca538e7ff202e7be38bfee6ae

SHA512
54cbbf109e6fef2836432d4381eab73df066b239f66b9ff0392b68bf8c71870d843d9a960949bf0f9ef89ed8eda73aa403d6c5b2d16253a699326851c4e8ce35

Download Submit
C:\Users\Admin\AppData\Local\Temp\WjrJAgnPkE.exe

MD5
51ab466b7973a25da110584522dc4011

SHA1
759f944cd579d8d55df3c81c0bd75d0e27936eed

SHA256
ed184e1c76f982d9537a281ac7cc805179e72d9ca538e7ff202e7be38bfee6ae

SHA512
54cbbf109e6fef2836432d4381eab73df066b239f66b9ff0392b68bf8c71870d843d9a960949bf0f9ef89ed8eda73aa403d6c5b2d16253a699326851c4e8ce35

Download Submit
C:\Users\Admin\AppData\Local\Temp\WjrJAgnPkE.exe

MD5
51ab466b7973a25da110584522dc4011

SHA1
759f944cd579d8d55df3c81c0bd75d0e27936eed

SHA256
ed184e1c76f982d9537a281ac7cc805179e72d9ca538e7ff202e7be38bfee6ae

SHA512
54cbbf109e6fef2836432d4381eab73df066b239f66b9ff0392b68bf8c71870d843d9a960949bf0f9ef89ed8eda73aa403d6c5b2d16253a699326851c4e8ce35

Download Submit
C:\Users\Admin\AppData\Local\Temp\rcRCJIXbsB.exe

MD5
39a8f34ef7a1eb4a0d1b11d625027e75

SHA1
c60a6bd2674ca37e6495fe8bef8c385732b158dd

SHA256
2e4775c5d181f37f4a0802a9982601352f0a7de1ffd74909024150572ed6522b

SHA512
317e248cc956af7bae34376ab956f25687b6146777862fba12df28609d3d8d3dabdf63f64e249824c3ba9f31672116029d3c987f5f26e4ee85960b2ff8c0376a

Download Submit
C:\Users\Admin\AppData\Local\Temp\rcRCJIXbsB.exe

MD5
39a8f34ef7a1eb4a0d1b11d625027e75

SHA1
c60a6bd2674ca37e6495fe8bef8c385732b158dd

SHA256
2e4775c5d181f37f4a0802a9982601352f0a7de1ffd74909024150572ed6522b

SHA512
317e248cc956af7bae34376ab956f25687b6146777862fba12df28609d3d8d3dabdf63f64e249824c3ba9f31672116029d3c987f5f26e4ee85960b2ff8c0376a

Download Submit
C:\Users\Admin\AppData\Local\Temp\rcRCJIXbsB.exe

MD5
39a8f34ef7a1eb4a0d1b11d625027e75

SHA1
c60a6bd2674ca37e6495fe8bef8c385732b158dd

SHA256
2e4775c5d181f37f4a0802a9982601352f0a7de1ffd74909024150572ed6522b

SHA512
317e248cc956af7bae34376ab956f25687b6146777862fba12df28609d3d8d3dabdf63f64e249824c3ba9f31672116029d3c987f5f26e4ee85960b2ff8c0376a

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4LeQhQQrp.exe

MD5
816a22f036e9479e6c5c21a66fb994c9

SHA1
5a7ba12257eeaa7fd8939f0b3f3d0f72312f8b09

SHA256
b4267cab9e3e8255b44e1947b4c6bb40901d9f0654c2d0ab40690851fcacf16c

SHA512
83e388487e06402a39b3c8c6c10381a53bb822b82ac0f04a50705caed6743acf3e452dc5338828fba8adef5a61189f2b98a293f468d29525312ce65a4fff9a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4LeQhQQrp.exe

MD5
816a22f036e9479e6c5c21a66fb994c9

SHA1
5a7ba12257eeaa7fd8939f0b3f3d0f72312f8b09

SHA256
b4267cab9e3e8255b44e1947b4c6bb40901d9f0654c2d0ab40690851fcacf16c

SHA512
83e388487e06402a39b3c8c6c10381a53bb822b82ac0f04a50705caed6743acf3e452dc5338828fba8adef5a61189f2b98a293f468d29525312ce65a4fff9a0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\u4LeQhQQrp.exe

MD5
816a22f036e9479e6c5c21a66fb994c9

SHA1
5a7ba12257eeaa7fd8939f0b3f3d0f72312f8b09

SHA256
b4267cab9e3e8255b44e1947b4c6bb40901d9f0654c2d0ab40690851fcacf16c

SHA512
83e388487e06402a39b3c8c6c10381a53bb822b82ac0f04a50705caed6743acf3e452dc5338828fba8adef5a61189f2b98a293f468d29525312ce65a4fff9a0c

Download Submit
C:\Windows\Temp\3qwzf0nx.exe

MD5
f4b5c1ebf4966256f52c4c4ceae87fb1

SHA1
ca70ec96d1a65cb2a4cbf4db46042275dc75813b

SHA256
88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

SHA512
02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

Download Submit
C:\Windows\temp\3qwzf0nx.exe

MD5
f4b5c1ebf4966256f52c4c4ceae87fb1

SHA1
ca70ec96d1a65cb2a4cbf4db46042275dc75813b

SHA256
88e7d1e5414b8fceb396130e98482829eac4bdc78fbc3fe7fb3f4432137e0e03

SHA512
02a7790b31525873ee506eec4ba47800310f7fb4ba58ea7ff4377bf76273ae3d0b4269c7ad866ee7af63471a920c4bd34a9808766e0c51bcaf54ba2e518e6c1e

Download Submit
C:\Windows\temp\jcxxn4ri.inf

MD5
7819dcdb813fc2691dc54b8f44d71a02

SHA1
9bbd864621bd431369aa462e9c95587913f03bb7

SHA256
97b61ea64ae34646f6f30469a3cad7ec731d7cb0c2a748c2fc6c5660383f8940

SHA512
9c6751f604ecca97f102140309ee45b291e9be4363b7be60e5126009e22f0b56ad21ad67b50ca5d8c740c5947fb00c8de2243b6a48764d56a2c82d28bee87841

Download Submit
\ProgramData\mozglue.dll

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\ProgramData\sqlite3.dll

MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\freebl3.dll

MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\freebl3.dll

MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\mozglue.dll

MD5
eae9273f8cdcf9321c6c37c244773139

SHA1
8378e2a2f3635574c106eea8419b5eb00b8489b0

SHA256
a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

SHA512
06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\nss3.dll

MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\LIbesLLibEs\softokn3.dll

MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll

MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
memory/196-47-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/196-48-0x000000000041A684-mapping.dmp

Download
memory/196-50-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/496-147-0x0000000000000000-mapping.dmp

Download
memory/728-192-0x00007FF9C5C10000-0x00007FF9C65FC000-memory.dmp

Filesize
9.9MB

Download
memory/728-187-0x0000000000000000-mapping.dmp

Download
memory/736-25-0x0000000000000000-mapping.dmp

Download
memory/736-27-0x0000000073070000-0x000000007375E000-memory.dmp

Filesize
6.9MB

Download
memory/736-43-0x0000000002780000-0x00000000027A4000-memory.dmp

Filesize
144KB

Download
memory/736-28-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/924-56-0x0000000000000000-mapping.dmp

Download
memory/924-59-0x0000000071740000-0x0000000071E2E000-memory.dmp

Filesize
6.9MB

Download
memory/924-60-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/924-79-0x0000000004DA0000-0x0000000004DC7000-memory.dmp

Filesize
156KB

Download
memory/1016-42-0x0000000000000000-mapping.dmp

Download
memory/1204-68-0x0000000000000000-mapping.dmp

Download
memory/1204-92-0x0000000004F10000-0x0000000004F26000-memory.dmp

Filesize
88KB

Download
memory/1204-76-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1204-73-0x0000000071740000-0x0000000071E2E000-memory.dmp

Filesize
6.9MB

Download
memory/1492-62-0x0000000000000000-mapping.dmp

Download
memory/2172-153-0x0000000000000000-mapping.dmp

Download
memory/2428-41-0x0000000000000000-mapping.dmp

Download
memory/2436-191-0x0000000000000000-mapping.dmp

Download
memory/2472-70-0x0000000000000000-mapping.dmp

Download
memory/2556-182-0x0000000000000000-mapping.dmp

Download
memory/2556-186-0x00007FF9C5C10000-0x00007FF9C65FC000-memory.dmp

Filesize
9.9MB

Download
memory/2704-115-0x0000000000000000-mapping.dmp

Download
memory/2704-130-0x0000000004F50000-0x0000000005051000-memory.dmp

Filesize
1.0MB

Download
memory/2820-149-0x0000000000000000-mapping.dmp

Download
memory/2820-148-0x0000000000000000-mapping.dmp

Download
memory/2820-154-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download
memory/2820-152-0x00007FF9C5C10000-0x00007FF9C65FC000-memory.dmp

Filesize
9.9MB

Download
memory/3160-11-0x0000000000000000-mapping.dmp

Download
memory/3160-16-0x0000000005020000-0x000000000506D000-memory.dmp

Filesize
308KB

Download
memory/3160-13-0x0000000072F90000-0x000000007367E000-memory.dmp

Filesize
6.9MB

Download
memory/3160-14-0x0000000000850000-0x0000000000851000-memory.dmp

Filesize
4KB

Download
memory/3192-104-0x0000000071740000-0x0000000071E2E000-memory.dmp

Filesize
6.9MB

Download
memory/3192-97-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3192-98-0x0000000000403BEE-mapping.dmp

Download
memory/3232-7-0x0000000000440102-mapping.dmp

Download
memory/3232-6-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3232-9-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/3420-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3420-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3420-21-0x0000000000417A8B-mapping.dmp

Download
memory/3444-139-0x0000000007880000-0x0000000007881000-memory.dmp

Filesize
4KB

Download
memory/3444-176-0x0000000008F10000-0x0000000008F11000-memory.dmp

Filesize
4KB

Download
memory/3444-178-0x0000000009270000-0x0000000009271000-memory.dmp

Filesize
4KB

Download
memory/3444-109-0x0000000000000000-mapping.dmp

Download
memory/3444-121-0x00000000070D0000-0x00000000070D1000-memory.dmp

Filesize
4KB

Download
memory/3444-111-0x0000000071740000-0x0000000071E2E000-memory.dmp

Filesize
6.9MB

Download
memory/3448-188-0x00007FF9C5C10000-0x00007FF9C65FC000-memory.dmp

Filesize
9.9MB

Download
memory/3448-183-0x0000000000000000-mapping.dmp

Download
memory/3516-80-0x0000000000000000-mapping.dmp

Download
memory/3516-145-0x0000000007C80000-0x0000000007C81000-memory.dmp

Filesize
4KB

Download
memory/3516-180-0x0000000008EC0000-0x0000000008EC1000-memory.dmp

Filesize
4KB

Download
memory/3516-127-0x0000000006B30000-0x0000000006B31000-memory.dmp

Filesize
4KB

Download
memory/3516-163-0x0000000008C10000-0x0000000008C43000-memory.dmp

Filesize
204KB

Download
memory/3516-131-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/3516-135-0x0000000007370000-0x0000000007371000-memory.dmp

Filesize
4KB

Download
memory/3516-87-0x0000000071740000-0x0000000071E2E000-memory.dmp

Filesize
6.9MB

Download
memory/3516-90-0x0000000004130000-0x0000000004131000-memory.dmp

Filesize
4KB

Download
memory/3516-141-0x0000000007D30000-0x0000000007D31000-memory.dmp

Filesize
4KB

Download
memory/3516-91-0x0000000006CD0000-0x0000000006CD1000-memory.dmp

Filesize
4KB

Download
memory/3596-157-0x00007FF9C5C10000-0x00007FF9C65FC000-memory.dmp

Filesize
9.9MB

Download
memory/3596-156-0x0000000000000000-mapping.dmp

Download
memory/3596-159-0x0000020053700000-0x0000020053701000-memory.dmp

Filesize
4KB

Download
memory/3596-158-0x0000020039090000-0x0000020039091000-memory.dmp

Filesize
4KB

Download
memory/3628-17-0x0000000000000000-mapping.dmp

Download
memory/3728-190-0x00007FF9C5C10000-0x00007FF9C65FC000-memory.dmp

Filesize
9.9MB

Download
memory/3728-184-0x0000000000000000-mapping.dmp

Download
memory/3816-138-0x00000000050E0000-0x00000000050E1000-memory.dmp

Filesize
4KB

Download
memory/3816-82-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3816-83-0x00000000004252EE-mapping.dmp

Download
memory/3816-86-0x0000000071740000-0x0000000071E2E000-memory.dmp

Filesize
6.9MB

Download
memory/3856-4-0x0000000000000000-mapping.dmp

Download
memory/3864-114-0x00000000053A0000-0x00000000053A1000-memory.dmp

Filesize
4KB

Download
memory/3864-99-0x000000000040616E-mapping.dmp

Download
memory/3864-103-0x0000000071740000-0x0000000071E2E000-memory.dmp

Filesize
6.9MB

Download
memory/3864-96-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3864-110-0x00000000057C0000-0x00000000057C1000-memory.dmp

Filesize
4KB

Download
memory/3864-143-0x0000000005550000-0x0000000005551000-memory.dmp

Filesize
4KB

Download
memory/3904-78-0x0000000000000000-mapping.dmp

Download
memory/3908-5-0x0000000001620000-0x000000000162D000-memory.dmp

Filesize
52KB

Download
memory/3908-0-0x0000000073DE0000-0x00000000744CE000-memory.dmp

Filesize
6.9MB

Download
memory/3908-3-0x0000000002F20000-0x0000000002FCC000-memory.dmp

Filesize
688KB

Download
memory/3908-1-0x0000000000B10000-0x0000000000B11000-memory.dmp

Filesize
4KB

Download
memory/3916-189-0x0000000000000000-mapping.dmp

Download
memory/3916-194-0x00007FF9C5C10000-0x00007FF9C65FC000-memory.dmp

Filesize
9.9MB

Download
memory/3980-69-0x0000000071740000-0x0000000071E2E000-memory.dmp

Filesize
6.9MB

Download
memory/3980-65-0x0000000000000000-mapping.dmp

Download
memory/3980-74-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/3980-93-0x0000000005170000-0x0000000005185000-memory.dmp

Filesize
84KB

Download
memory/4148-193-0x0000000000000000-mapping.dmp

Download
memory/4236-195-0x0000000000000000-mapping.dmp

Download