raccoon | c3193806a082fa6c5c4b755e343c01dcf9169487acbf9150ab169d3972a8c6e8

Target

Microsoft_Toolkit.exe
Size

4.9MB
MD5

ee287c2e51854fee07881638379c6f38
SHA1

1dccecc235b6d702a8fea3350c72b9c52c05c7be
SHA256

c3193806a082fa6c5c4b755e343c01dcf9169487acbf9150ab169d3972a8c6e8
SHA512

02a1e9874f994e958489be409e3a6efcce642c57b9f5e50de0a2072ad15769cdb717744ed37436b0f9d94104572a79d39e6114938ba3e5a6670d6c05e780aafa

Score

10^/10

raccoon smokeloader backdoor evasion persistence spyware stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Version

2020

http://oversun.monster/upload/

http://oversun.net/upload/

http://dingobossin.com/upload/

http://duda1.monster/upload/

http�//vinder55.monster/upload/

http://jamb2.monster/upload/

rc4.i32

Signatures

Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 12 IoCs

Processes:

KRSetp.exejg7_7wjg.exeproz.exeubisoftant.exeaskinstall4.exepiyyy.exeupdate_5e6d00.exesetup.exePas.exejfiag3g_gg.exe8730319.965189245.57

pid	process
3876	KRSetp.exe
2928	jg7_7wjg.exe
192	proz.exe
1076	ubisoftant.exe
2940	askinstall4.exe
2664	piyyy.exe
3532	update_5e6d00.exe
1488	setup.exe
3864	Pas.exe
2568	jfiag3g_gg.exe
4236	8730319.96
4300	5189245.57

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe	upx
C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe	upx
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe	upx
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe	upx

Loads dropped DLL 1 IoCs

Processes:

update_5e6d00.exe

pid process

3532 update_5e6d00.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3532	update_5e6d00.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

piyyy.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.ex"	piyyy.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

jg7_7wjg.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg7_7wjg.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jg7_7wjg.exe

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\nss3.dll	js

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 ip-api.com
Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe

flow	ioc
12	ip-api.com

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

update_5e6d00.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	update_5e6d00.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	update_5e6d00.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	update_5e6d00.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4684 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4216 taskkill.exe
Modifies Control Panel 1 IoCs
evasion

Processes:

MicrosoftEdge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors MicrosoftEdge.exe

pid	process
4684	timeout.exe

pid	process
4216	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies registry class 26 IoCs

Processes:

MicrosoftEdge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 998267c856add601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 998267c856add601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 998267c856add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

askinstall4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	askinstall4.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	askinstall4.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1864 PING.EXE
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

update_5e6d00.exe

pid process

3532 update_5e6d00.exe
3532 update_5e6d00.exe

pid	process
1864	PING.EXE

pid	process
3532	update_5e6d00.exe
3532	update_5e6d00.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

KRSetp.exejg7_7wjg.exetaskkill.exeubisoftant.exe

description	pid	process
Token: SeDebugPrivilege	3876	KRSetp.exe
Token: SeManageVolumePrivilege	2928	jg7_7wjg.exe
Token: SeDebugPrivilege	4216	taskkill.exe
Token: SeManageVolumePrivilege	1076	ubisoftant.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

ubisoftant.exeMicrosoftEdge.exe

pid process

1076 ubisoftant.exe
1076 ubisoftant.exe
4348 MicrosoftEdge.exe

pid	process
1076	ubisoftant.exe
1076	ubisoftant.exe
4348	MicrosoftEdge.exe

Suspicious use of WriteProcessMemory 47 IoCs

Processes:

Microsoft_Toolkit.exeproz.exesetup.exepiyyy.execmd.exeaskinstall4.execmd.exeKRSetp.exe

description	pid	process	target process
PID 3084 wrote to memory of 3876	3084	Microsoft_Toolkit.exe	KRSetp.exe
PID 3084 wrote to memory of 3876	3084	Microsoft_Toolkit.exe	KRSetp.exe
PID 3084 wrote to memory of 2928	3084	Microsoft_Toolkit.exe	jg7_7wjg.exe
PID 3084 wrote to memory of 2928	3084	Microsoft_Toolkit.exe	jg7_7wjg.exe
PID 3084 wrote to memory of 2928	3084	Microsoft_Toolkit.exe	jg7_7wjg.exe
PID 3084 wrote to memory of 192	3084	Microsoft_Toolkit.exe	proz.exe
PID 3084 wrote to memory of 192	3084	Microsoft_Toolkit.exe	proz.exe
PID 3084 wrote to memory of 192	3084	Microsoft_Toolkit.exe	proz.exe
PID 3084 wrote to memory of 1076	3084	Microsoft_Toolkit.exe	ubisoftant.exe
PID 3084 wrote to memory of 1076	3084	Microsoft_Toolkit.exe	ubisoftant.exe
PID 3084 wrote to memory of 1076	3084	Microsoft_Toolkit.exe	ubisoftant.exe
PID 3084 wrote to memory of 2940	3084	Microsoft_Toolkit.exe	askinstall4.exe
PID 3084 wrote to memory of 2940	3084	Microsoft_Toolkit.exe	askinstall4.exe
PID 3084 wrote to memory of 2940	3084	Microsoft_Toolkit.exe	askinstall4.exe
PID 3084 wrote to memory of 2664	3084	Microsoft_Toolkit.exe	piyyy.exe
PID 3084 wrote to memory of 2664	3084	Microsoft_Toolkit.exe	piyyy.exe
PID 3084 wrote to memory of 2664	3084	Microsoft_Toolkit.exe	piyyy.exe
PID 3084 wrote to memory of 3532	3084	Microsoft_Toolkit.exe	update_5e6d00.exe
PID 3084 wrote to memory of 3532	3084	Microsoft_Toolkit.exe	update_5e6d00.exe
PID 3084 wrote to memory of 3532	3084	Microsoft_Toolkit.exe	update_5e6d00.exe
PID 3084 wrote to memory of 1488	3084	Microsoft_Toolkit.exe	setup.exe
PID 3084 wrote to memory of 1488	3084	Microsoft_Toolkit.exe	setup.exe
PID 3084 wrote to memory of 1488	3084	Microsoft_Toolkit.exe	setup.exe
PID 192 wrote to memory of 3864	192	proz.exe	Pas.exe
PID 192 wrote to memory of 3864	192	proz.exe	Pas.exe
PID 192 wrote to memory of 3864	192	proz.exe	Pas.exe
PID 1488 wrote to memory of 1632	1488	setup.exe	cmd.exe
PID 1488 wrote to memory of 1632	1488	setup.exe	cmd.exe
PID 1488 wrote to memory of 1632	1488	setup.exe	cmd.exe
PID 2664 wrote to memory of 2568	2664	piyyy.exe	jfiag3g_gg.exe
PID 2664 wrote to memory of 2568	2664	piyyy.exe	jfiag3g_gg.exe
PID 2664 wrote to memory of 2568	2664	piyyy.exe	jfiag3g_gg.exe
PID 1632 wrote to memory of 1864	1632	cmd.exe	PING.EXE
PID 1632 wrote to memory of 1864	1632	cmd.exe	PING.EXE
PID 1632 wrote to memory of 1864	1632	cmd.exe	PING.EXE
PID 2940 wrote to memory of 4152	2940	askinstall4.exe	cmd.exe
PID 2940 wrote to memory of 4152	2940	askinstall4.exe	cmd.exe
PID 2940 wrote to memory of 4152	2940	askinstall4.exe	cmd.exe
PID 4152 wrote to memory of 4216	4152	cmd.exe	taskkill.exe
PID 4152 wrote to memory of 4216	4152	cmd.exe	taskkill.exe
PID 4152 wrote to memory of 4216	4152	cmd.exe	taskkill.exe
PID 3876 wrote to memory of 4236	3876	KRSetp.exe	8730319.96
PID 3876 wrote to memory of 4236	3876	KRSetp.exe	8730319.96
PID 3876 wrote to memory of 4236	3876	KRSetp.exe	8730319.96
PID 3876 wrote to memory of 4300	3876	KRSetp.exe	5189245.57
PID 3876 wrote to memory of 4300	3876	KRSetp.exe	5189245.57
PID 3876 wrote to memory of 4300	3876	KRSetp.exe	5189245.57

C:\Users\Admin\AppData\Local\Temp\Microsoft_Toolkit.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft_Toolkit.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3084

C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876

C:\Users\Admin\AppData\Roaming\8730319.96
"C:\Users\Admin\AppData\Roaming\8730319.96"
3⤵
- Executes dropped EXE
PID:4236

C:\Users\Admin\AppData\Roaming\5189245.57
"C:\Users\Admin\AppData\Roaming\5189245.57"
3⤵
- Executes dropped EXE
PID:4300

C:\ProgramData\Windows Host\Windows Host.exe
"C:\ProgramData\Windows Host\Windows Host.exe"
4⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe
"C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\Users\Admin\AppData\Local\Temp\proz.exe
"C:\Users\Admin\AppData\Local\Temp\proz.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:192

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe"
3⤵
- Executes dropped EXE
PID:3864

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe"
4⤵
PID:848

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
5⤵
- Delays execution with timeout.exe
PID:4684

C:\Users\Admin\AppData\Local\Temp\ubisoftant.exe
"C:\Users\Admin\AppData\Local\Temp\ubisoftant.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1076

C:\Users\Admin\AppData\Local\Temp\askinstall4.exe
"C:\Users\Admin\AppData\Local\Temp\askinstall4.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2940

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:4152

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4216

C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe
"C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3532

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
4⤵
- Runs ping.exe
PID:1864

C:\Users\Admin\AppData\Local\Temp\piyyy.exe
"C:\Users\Admin\AppData\Local\Temp\piyyy.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2664

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:2568

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:5040

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4348

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:4496

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4952

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4516

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4172

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:3552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windows Host\Windows Host.exe
MD5
afa33dfbdad73a4e12c1af34d73133f2

SHA1
43924d73e58da7f3ea9c3ec8bf1dee26c441a11d

SHA256
7d3e9848965e09cc7acea44f59c66c28b3c57a5a902a8971b03d24a9634c14b1

SHA512
501d72dd1398332f363a5c0dee739b9d9908bb13a8549664b3b2bb1446d35b6228b0147d6ec32ea95c96f3e4a433e970b9fe3070460893d04facd0f82a40cc93

Download Submit
C:\ProgramData\Windows Host\Windows Host.exe
MD5
afa33dfbdad73a4e12c1af34d73133f2

SHA1
43924d73e58da7f3ea9c3ec8bf1dee26c441a11d

SHA256
7d3e9848965e09cc7acea44f59c66c28b3c57a5a902a8971b03d24a9634c14b1

SHA512
501d72dd1398332f363a5c0dee739b9d9908bb13a8549664b3b2bb1446d35b6228b0147d6ec32ea95c96f3e4a433e970b9fe3070460893d04facd0f82a40cc93

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
ce82da74721b73ebca106db3d6c03101

SHA1
07dd2f58f2bfaec2aded4e380f57804c2ffe60bf

SHA256
2e21d96491d3f3f352d472e11064718fa6b8bf855ba11d167a8c6df42ced6181

SHA512
9752aadf0d83fa1df14ce4418b8b7a9b2e7c7530afd19fc6a8d5d4e908b89a5f51f945a7f0b4bcfba87e44fd130540e079ee9244c9658c94db187c748683ddde

Download Submit
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
MD5
ce82da74721b73ebca106db3d6c03101

SHA1
07dd2f58f2bfaec2aded4e380f57804c2ffe60bf

SHA256
2e21d96491d3f3f352d472e11064718fa6b8bf855ba11d167a8c6df42ced6181

SHA512
9752aadf0d83fa1df14ce4418b8b7a9b2e7c7530afd19fc6a8d5d4e908b89a5f51f945a7f0b4bcfba87e44fd130540e079ee9244c9658c94db187c748683ddde

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe
MD5
db2e9f9b8807458226ca4cb9a52ff5c4

SHA1
94b8b1e0b9c617d370ad5d1445d410692529d23b

SHA256
a0f2ff7cb28c9f9c4e4d7583d2fbbcf89b5a2320f2dc8e82749a0f59e6ba197b

SHA512
68406f390ccb28893dcd7e36ec290f59ae9f86f2cd1e36e1596815ac664cda83ff3a8b833c963492bcadcd3620c844c28e87fb398444970e82418de02147ecf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Pas.exe
MD5
db2e9f9b8807458226ca4cb9a52ff5c4

SHA1
94b8b1e0b9c617d370ad5d1445d410692529d23b

SHA256
a0f2ff7cb28c9f9c4e4d7583d2fbbcf89b5a2320f2dc8e82749a0f59e6ba197b

SHA512
68406f390ccb28893dcd7e36ec290f59ae9f86f2cd1e36e1596815ac664cda83ff3a8b833c963492bcadcd3620c844c28e87fb398444970e82418de02147ecf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\askinstall4.exe
MD5
53801ac3d522650a7c9a2f3e03b5c0a1

SHA1
b533a5eed14ecdc19159961df60e8aae58aee74b

SHA256
e28ff4f4b3871ebf761118f6ee0a8c1f600c90e54931f2e25030976906ed6568

SHA512
1e19561dae72756e7859298581ad859d844e879db8fd6e6f91a719a06b5dbf4f8cb690ab8adef3619f6ed9925bca39ae94609d071fdf043f7b85e1d5e6764c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\askinstall4.exe
MD5
53801ac3d522650a7c9a2f3e03b5c0a1

SHA1
b533a5eed14ecdc19159961df60e8aae58aee74b

SHA256
e28ff4f4b3871ebf761118f6ee0a8c1f600c90e54931f2e25030976906ed6568

SHA512
1e19561dae72756e7859298581ad859d844e879db8fd6e6f91a719a06b5dbf4f8cb690ab8adef3619f6ed9925bca39ae94609d071fdf043f7b85e1d5e6764c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d
MD5
04fc9fb420737eb6373482776dd0f7b7

SHA1
ca03766a2b8a7955a404ce565e6a74e3b2b87097

SHA256
132f1b5a1ba660a35bd3bd981723a594f3848ee3ba90c589d0107ef5567b1ddb

SHA512
fd8e484923fa288c3628f69ab5f82eab827f073e4f8f526176f5982aa17b0ce4fda42661322b9efdaacc9effe3066e8e1b7e98c373c472b27945f2227ffab97f

Download Submit
C:\Users\Admin\AppData\Local\Temp\d
MD5
04fc9fb420737eb6373482776dd0f7b7

SHA1
ca03766a2b8a7955a404ce565e6a74e3b2b87097

SHA256
132f1b5a1ba660a35bd3bd981723a594f3848ee3ba90c589d0107ef5567b1ddb

SHA512
fd8e484923fa288c3628f69ab5f82eab827f073e4f8f526176f5982aa17b0ce4fda42661322b9efdaacc9effe3066e8e1b7e98c373c472b27945f2227ffab97f

Download Submit
C:\Users\Admin\AppData\Local\Temp\d
MD5
e7cc45e81b628670f1ee5199e7696057

SHA1
13cf235c6a3aaca38810b8ebbfbdfd56c3f457f8

SHA256
39f63521ab497c0158cddd92eed5645d04c22883d86a50919b3b34f23a220e85

SHA512
fd7122c84aba5753da2617396a59544a0393b6a5addbb41292302e4611432fde192d94c907eaef2d20c5d5e22d5877311837aa018c9706511235d0917850e4a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.INTEG.RAW
MD5
8cb21dbf2118ac6721309a99ef79360d

SHA1
06f7a1cf629a8b456cebf11b0d4d7a8a02a13902

SHA256
5225f3e1149959249936b7157ca50b0f2b2446c986dc1b61fdb395bb82b152d9

SHA512
7a816870d31d19bd580a93651dc6603845caeab305ab7424533c1bdd9498b7ceb4c5d75c9f1543d4f74d1ee57bbe225de2f082c5a743097d2b9e83db6a8cea4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.INTEG.RAW
MD5
1e957941459c4574dd1eb0049ccd2a61

SHA1
d52db0974f45d53d023fbc5ad1cd17b05c0dd2d6

SHA256
488d17b454deb3a218e377aeed3ccba9cabd9d9abdde2e6ff6e046144566da01

SHA512
224f7c08b69a2b4de85d5e05a5208f04f02a2fc52f1e5fcf6261fe6bc4c66c205beb696d169e8705ee99e1f2b74e846bd4f493e237f9ee16442e7148d379a50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.INTEG.RAW
MD5
850cc54d1f540c280a028a2855872e0b

SHA1
50c16cf51507fd606d69f329cd453af6f0746889

SHA256
50a0ff9a2532f11aec6dfd871242a0e9384120569fb05550585c79b09aba4756

SHA512
bb58dbc2fe69ba5e98306013d3712032c664c2299bdedcc04a3cbfeebaf549e1fa39295c9af4c2ae553ed46f28ee0bbd614d96fdddf79770f917b0af3d01327c

Download Submit
C:\Users\Admin\AppData\Local\Temp\d.jfm
MD5
a3b919959cc3777135e370954a7c1fe6

SHA1
f528593bc1a21f50da9fa4831500d6d0011b0974

SHA256
c1f7cea259561b8c186b8eeb5fa28748a7fe84eb10fbc8cfa4391bf57ab96ab3

SHA512
f5e546e16bbfa0a8d52e847c55c96833d0016be486b538a0b3e6217181eed6f4461183fc8db839f854f748d0a9e1668d6df524ca5952e0919a955c4cf1b2b043

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
MD5
b7161c0845a64ff6d7345b67ff97f3b0

SHA1
d223f855da541fe8e4c1d5c50cb26da0a1deb5fc

SHA256
fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66

SHA512
98d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe
MD5
b319aba56f3a2c3fce5e3337acdfc849

SHA1
620879dbe04e71d8637104379581a95ff03c6025

SHA256
d2024a6ff6b174406d466890282e5d07f92e07ea5c64c2ef3f8d11397dcd6e70

SHA512
e1581c84bdfaf8f27d17dd9924a6c792fcb270e5d229328bdfdc258dae7f64fbb0d3ffb4ebbeaca643b1561c35dc2d507a638a0db3ddb189b78c357e89533e46

Download Submit
C:\Users\Admin\AppData\Local\Temp\jg7_7wjg.exe
MD5
b319aba56f3a2c3fce5e3337acdfc849

SHA1
620879dbe04e71d8637104379581a95ff03c6025

SHA256
d2024a6ff6b174406d466890282e5d07f92e07ea5c64c2ef3f8d11397dcd6e70

SHA512
e1581c84bdfaf8f27d17dd9924a6c792fcb270e5d229328bdfdc258dae7f64fbb0d3ffb4ebbeaca643b1561c35dc2d507a638a0db3ddb189b78c357e89533e46

Download Submit
C:\Users\Admin\AppData\Local\Temp\piyyy.exe
MD5
49939240c51965f0527297a3127b6c32

SHA1
78ab6d6f31a1b552a1a493b9f41690b6c47a28c3

SHA256
a7a20ca4cdcfd0e7b281e379889638207acd4b35e902caac95b894f02706129c

SHA512
abbd7a728a4dfc6b0ac04a9354172ef67e190f7b313e5cf7719e1240b4e2de12118ced45a1e7cd3494e4aad5420a28f01758b779269de8864b0f063e790b78ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\piyyy.exe
MD5
49939240c51965f0527297a3127b6c32

SHA1
78ab6d6f31a1b552a1a493b9f41690b6c47a28c3

SHA256
a7a20ca4cdcfd0e7b281e379889638207acd4b35e902caac95b894f02706129c

SHA512
abbd7a728a4dfc6b0ac04a9354172ef67e190f7b313e5cf7719e1240b4e2de12118ced45a1e7cd3494e4aad5420a28f01758b779269de8864b0f063e790b78ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\proz.exe
MD5
87930a2af638eab739a4925e5efb66be

SHA1
faa3701185a42c844020947407aec0c642fb96db

SHA256
5ea59c6498dd18d506f324a8b61f1a7c9008380f37ea6af60c308c05dfa0c371

SHA512
764928f88b53a5ccae09a1dee134fadcea6105c036dd6a53b97b57e7ef0577782ea569bcf8dfc6371fbb6ec9f1569c28fa3602de3ca669134febb0f039341ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\proz.exe
MD5
87930a2af638eab739a4925e5efb66be

SHA1
faa3701185a42c844020947407aec0c642fb96db

SHA256
5ea59c6498dd18d506f324a8b61f1a7c9008380f37ea6af60c308c05dfa0c371

SHA512
764928f88b53a5ccae09a1dee134fadcea6105c036dd6a53b97b57e7ef0577782ea569bcf8dfc6371fbb6ec9f1569c28fa3602de3ca669134febb0f039341ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
931a67fffb696d947a1cf5de4e02193a

SHA1
04d185b5641c394bf16ee0712c503622c81021bd

SHA256
36fcc164264719077c074a60132a51627f4f2fdd5ff775a549685349945c0bf9

SHA512
51c608c8b7ca11ba05b051aca54e9fbccad321f34a1ddb22619e687a5a86c9f7020299383ef90792da87941086943489a0bc2d1af10287ce69cd99f56a168f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\setup.exe
MD5
931a67fffb696d947a1cf5de4e02193a

SHA1
04d185b5641c394bf16ee0712c503622c81021bd

SHA256
36fcc164264719077c074a60132a51627f4f2fdd5ff775a549685349945c0bf9

SHA512
51c608c8b7ca11ba05b051aca54e9fbccad321f34a1ddb22619e687a5a86c9f7020299383ef90792da87941086943489a0bc2d1af10287ce69cd99f56a168f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\ubisoftant.exe
MD5
9d778c2eb91a8b335cc085ffc5728a17

SHA1
8ff274de9a05b447341d8821dad63f461913045c

SHA256
9ff78393a5e67786ed14a4f019ab112b1ca1c977d8b35b107871ccff7a0f44d0

SHA512
fb7b4c07d58e3f771e126c8d89d9735347189351f72d5470c84c99d539fdd2ea6a7b1595d8b55a9334c12d53fde8973511aecbbf76959df253e9c6a4e0223deb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ubisoftant.exe
MD5
9d778c2eb91a8b335cc085ffc5728a17

SHA1
8ff274de9a05b447341d8821dad63f461913045c

SHA256
9ff78393a5e67786ed14a4f019ab112b1ca1c977d8b35b107871ccff7a0f44d0

SHA512
fb7b4c07d58e3f771e126c8d89d9735347189351f72d5470c84c99d539fdd2ea6a7b1595d8b55a9334c12d53fde8973511aecbbf76959df253e9c6a4e0223deb

Download Submit
C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe
MD5
9b556d99e3f32187b336a7d091e298f3

SHA1
fd132cf3106584a106909f3d96f476a1aede6043

SHA256
22167c9d39466648b4544fc60d48e631b743b73e1cab0fe179223e4785e3a6e3

SHA512
aa50f8d8f72869fcfc02ed0ef306aaa2a2076f0eea3a27b0d0e0a8a0a1f86502d5ef1e0e4a1f29ad985623b0d99dd4cf90f834fb4bdd5bce06ebc5fc3ef30c6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\update_5e6d00.exe
MD5
9b556d99e3f32187b336a7d091e298f3

SHA1
fd132cf3106584a106909f3d96f476a1aede6043

SHA256
22167c9d39466648b4544fc60d48e631b743b73e1cab0fe179223e4785e3a6e3

SHA512
aa50f8d8f72869fcfc02ed0ef306aaa2a2076f0eea3a27b0d0e0a8a0a1f86502d5ef1e0e4a1f29ad985623b0d99dd4cf90f834fb4bdd5bce06ebc5fc3ef30c6f

Download Submit
C:\Users\Admin\AppData\Roaming\5189245.57
MD5
afa33dfbdad73a4e12c1af34d73133f2

SHA1
43924d73e58da7f3ea9c3ec8bf1dee26c441a11d

SHA256
7d3e9848965e09cc7acea44f59c66c28b3c57a5a902a8971b03d24a9634c14b1

SHA512
501d72dd1398332f363a5c0dee739b9d9908bb13a8549664b3b2bb1446d35b6228b0147d6ec32ea95c96f3e4a433e970b9fe3070460893d04facd0f82a40cc93

Download Submit
C:\Users\Admin\AppData\Roaming\5189245.57
MD5
afa33dfbdad73a4e12c1af34d73133f2

SHA1
43924d73e58da7f3ea9c3ec8bf1dee26c441a11d

SHA256
7d3e9848965e09cc7acea44f59c66c28b3c57a5a902a8971b03d24a9634c14b1

SHA512
501d72dd1398332f363a5c0dee739b9d9908bb13a8549664b3b2bb1446d35b6228b0147d6ec32ea95c96f3e4a433e970b9fe3070460893d04facd0f82a40cc93

Download Submit
C:\Users\Admin\AppData\Roaming\8730319.96
MD5
a94bd5065b1af61ee6361f8379dd6bab

SHA1
43208a8de5d2c95545845fa17f436e836ab2ad7d

SHA256
3ed38bfcd1ee09967caa0b82e941361a0e5575d8e6b1a2d1b359fbebbb66c37b

SHA512
f88a6467ebb3baa79e620443ea19dc00017ad22404e4dfa8edda752be7c25ddc622aeb2a905bc5670c1d446e75f5ae2c6961291584d582bcf0c60162e63d37ae

Download Submit
C:\Users\Admin\AppData\Roaming\8730319.96
MD5
a94bd5065b1af61ee6361f8379dd6bab

SHA1
43208a8de5d2c95545845fa17f436e836ab2ad7d

SHA256
3ed38bfcd1ee09967caa0b82e941361a0e5575d8e6b1a2d1b359fbebbb66c37b

SHA512
f88a6467ebb3baa79e620443ea19dc00017ad22404e4dfa8edda752be7c25ddc622aeb2a905bc5670c1d446e75f5ae2c6961291584d582bcf0c60162e63d37ae

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\freebl3.dll
MD5
60acd24430204ad2dc7f148b8cfe9bdc

SHA1
989f377b9117d7cb21cbe92a4117f88f9c7693d9

SHA256
9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

SHA512
626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\mozglue.dll
MD5
eae9273f8cdcf9321c6c37c244773139

SHA1
8378e2a2f3635574c106eea8419b5eb00b8489b0

SHA256
a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

SHA512
06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\nss3.dll
MD5
02cc7b8ee30056d5912de54f1bdfc219

SHA1
a6923da95705fb81e368ae48f93d28522ef552fb

SHA256
1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

SHA512
0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\softokn3.dll
MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
\Users\Admin\AppData\LocalLow\pF2qC1gG7yH8hI1o\softokn3.dll
MD5
4e8df049f3459fa94ab6ad387f3561ac

SHA1
06ed392bc29ad9d5fc05ee254c2625fd65925114

SHA256
25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

SHA512
3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

Download Submit
\Users\Admin\AppData\LocalLow\sqlite3.dll
MD5
f964811b68f9f1487c2b41e1aef576ce

SHA1
b423959793f14b1416bc3b7051bed58a1034025f

SHA256
83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

SHA512
565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

Download Submit
\Users\Admin\AppData\Local\Temp\CC4F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
memory/192-10-0x0000000000000000-mapping.dmp

Download
memory/848-113-0x0000000000000000-mapping.dmp

Download
memory/1076-33-0x0000000000771000-0x0000000000772000-memory.dmp

Filesize
4KB

Download
memory/1076-12-0x0000000000000000-mapping.dmp

Download
memory/1488-27-0x0000000000000000-mapping.dmp

Download
memory/1632-32-0x0000000000000000-mapping.dmp

Download
memory/1864-46-0x0000000000000000-mapping.dmp

Download
memory/2568-45-0x0000000000000000-mapping.dmp

Download
memory/2664-19-0x0000000000000000-mapping.dmp

Download
memory/2828-78-0x0000000000FA0000-0x0000000000FB6000-memory.dmp

Filesize
88KB

Download
memory/2928-7-0x0000000000000000-mapping.dmp

Download
memory/2940-14-0x0000000000000000-mapping.dmp

Download
memory/3532-20-0x0000000000000000-mapping.dmp

Download
memory/3532-38-0x0000000004A90000-0x0000000004A91000-memory.dmp

Filesize
4KB

Download
memory/3532-39-0x0000000000030000-0x0000000000039000-memory.dmp

Filesize
36KB

Download
memory/3532-42-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3532-40-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/3864-49-0x00000000048A0000-0x00000000048F0000-memory.dmp

Filesize
320KB

Download
memory/3864-51-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/3864-50-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Filesize
584KB

Download
memory/3864-44-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/3864-31-0x0000000000000000-mapping.dmp

Download
memory/3876-6-0x00007FF8965F0000-0x00007FF896FDC000-memory.dmp

Filesize
9.9MB

Download
memory/3876-3-0x0000000000000000-mapping.dmp

Download
memory/3876-37-0x0000000000950000-0x0000000000973000-memory.dmp

Filesize
140KB

Download
memory/3876-36-0x0000000000940000-0x0000000000942000-memory.dmp

Filesize
8KB

Download
memory/3876-41-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/3876-29-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/3876-25-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/4152-55-0x0000000000000000-mapping.dmp

Download
memory/4216-56-0x0000000000000000-mapping.dmp

Download
memory/4236-65-0x000000006F7D0000-0x000000006FEBE000-memory.dmp

Filesize
6.9MB

Download
memory/4236-103-0x0000000009B40000-0x0000000009B41000-memory.dmp

Filesize
4KB

Download
memory/4236-73-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/4236-115-0x000000000A2B0000-0x000000000A2B1000-memory.dmp

Filesize
4KB

Download
memory/4236-77-0x00000000057E0000-0x00000000057E1000-memory.dmp

Filesize
4KB

Download
memory/4236-79-0x00000000030B0000-0x00000000030E1000-memory.dmp

Filesize
196KB

Download
memory/4236-82-0x0000000003130000-0x0000000003131000-memory.dmp

Filesize
4KB

Download
memory/4236-69-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/4236-57-0x0000000000000000-mapping.dmp

Download
memory/4300-83-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

Filesize
4KB

Download
memory/4300-74-0x0000000004970000-0x0000000004980000-memory.dmp

Filesize
64KB

Download
memory/4300-59-0x0000000000000000-mapping.dmp

Download
memory/4300-64-0x000000006F7D0000-0x000000006FEBE000-memory.dmp

Filesize
6.9MB

Download
memory/4300-72-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/4300-75-0x0000000007960000-0x0000000007961000-memory.dmp

Filesize
4KB

Download
memory/4300-68-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/4300-76-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/4300-80-0x0000000007460000-0x0000000007461000-memory.dmp

Filesize
4KB

Download
memory/4424-85-0x0000000000000000-mapping.dmp

Download
memory/4424-88-0x000000006F7D0000-0x000000006FEBE000-memory.dmp

Filesize
6.9MB

Download
memory/4424-94-0x00000000051C0000-0x00000000051C1000-memory.dmp

Filesize
4KB

Download
memory/4424-101-0x0000000007EA0000-0x0000000007EA1000-memory.dmp

Filesize
4KB

Download
memory/4684-114-0x0000000000000000-mapping.dmp

Download
memory/5040-97-0x0000000000000000-mapping.dmp

Download