Malware Analysis Report

2025-03-15 06:31

Sample ID 240130-hzc2gacdfq
Target product list and specification.xls
SHA256 9fb885a66da2ed08983a46519b97dc55e002913f859dfa1e54917f63e4d7f8f4
Tags
warzonerat infostealer rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9fb885a66da2ed08983a46519b97dc55e002913f859dfa1e54917f63e4d7f8f4

Threat Level: Known bad

The file product list and specification.xls was found to be: Known bad.

Malicious Activity Summary

warzonerat infostealer rat

WarzoneRat, AveMaria

Warzone RAT payload

Downloads MZ/PE file

Creates scheduled task(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Uses Volume Shadow Copy service COM API

Enumerates system info in registry

Uses Volume Shadow Copy WMI provider

Uses Task Scheduler COM API

Launches Equation Editor

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-30 07:10

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-30 07:10

Reported

2024-01-30 07:12

Platform

win10v2004-20231215-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\product list and specification.xls"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAuditPrivilege N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2372 wrote to memory of 1312 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe
PID 2372 wrote to memory of 1312 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\product list and specification.xls"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
CA 198.12.89.27:80 198.12.89.27 tcp
US 8.8.8.8:53 194.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 27.89.12.198.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 153.141.79.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 13.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/644-5-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-4-0x00007FFAF2270000-0x00007FFAF2280000-memory.dmp

memory/644-6-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-7-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-8-0x00007FFAF0180000-0x00007FFAF0190000-memory.dmp

memory/644-9-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-11-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-12-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-10-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-13-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-14-0x00007FFAF0180000-0x00007FFAF0190000-memory.dmp

memory/644-15-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-3-0x00007FFAF2270000-0x00007FFAF2280000-memory.dmp

memory/644-16-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-2-0x00007FFAF2270000-0x00007FFAF2280000-memory.dmp

memory/644-1-0x00007FFAF2270000-0x00007FFAF2280000-memory.dmp

memory/644-18-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-19-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-17-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-0-0x00007FFAF2270000-0x00007FFAF2280000-memory.dmp

memory/644-20-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-21-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-22-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/644-23-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-31-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-33-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-37-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-39-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-35-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-40-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-43-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-44-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-45-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-46-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-41-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-47-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-48-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-50-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\1312A2FA-C902-4D3A-B2FC-97A39B0BCB11

MD5 610ecfcc51cff436fe31cd9208e217ae
SHA1 4c0fbb00fec368624fe33982daa79eb3e48abbf2
SHA256 12287a10e265b6bc2d0905cb55fb8eefa9e0413ab42197d527e8e67293ead837
SHA512 77f0f17f010d4bba3fc9aa08d3a70eb56de3e3146ae7031d0b77b5eff622e59f79809b21d985d5b80381d6d0c6d32448cdcf3981ebaeee1668e46fb755a01c3e

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

MD5 bb6a9a1615d031056452537cfbc64c4f
SHA1 422b219caa0245d742ccc072ec6d2b93ec80c671
SHA256 136be491c33391cb1b38934833dc73a1502dce807f6a2c384bfbfe7a68e83163
SHA512 02a01b2b4c4d9e465495493a3e4110ef1365461519b77702ffdf5a98bfbf6724dca623c5062490e621971641e7a9c9f3d0dc424eda05d79aebf89d7177099018

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

MD5 d4750396563258a81ce46b0d60771fb1
SHA1 debd412a497846c6b0267f033120e40d3195543a
SHA256 ef36885907b5c06e5009117dde5376deee7467a6cb8f5fa60b712c767a73e1af
SHA512 fe1b54ba550568d135a0db76c81341e9e963e8b32c734c75f672d2d22f18507912b6525d5840414aa3a8b9e12cf8e0bfce3ebcc65780fd4f98465607c6f45f5c

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W8BIYKF7\hclupdationprocessstartedrecentlytoimprovethequalityofservicetoconfirmentirethingsfineformtheside[1].doc

MD5 a17ade13a0a2d4b0edeaa0f94233e906
SHA1 62704b8fcac1a59022bb4cbe3c0f10a6856c7d3b
SHA256 c39833aa5c53ed2fd042d3fe4fb45f6e6fc42607bb811a69a6073d5da0316b19
SHA512 372077c7106660d70867e388b364e25a1f2109007fd5adf98ae1d0a3a834355526f4e503e1a272d844e3ae730f27c425e9964739aee75ebe714679858185cf71

memory/644-78-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

memory/2372-79-0x00007FFB321F0000-0x00007FFB323E5000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-30 07:10

Reported

2024-01-30 07:12

Platform

win7-20231129-en

Max time kernel

0s

Max time network

148s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\product list and specification.xls"

Signatures

WarzoneRat, AveMaria

rat infostealer warzonerat

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Launches Equation Editor

exploit
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\product list and specification.xls"

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Users\Admin\AppData\Roaming\conhosts.exe

"C:\Users\Admin\AppData\Roaming\conhosts.exe"

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hYnJcpennYk.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hYnJcpennYk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7272.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

Network

Country Destination Domain Proto
CA 198.12.89.27:80 198.12.89.27 tcp
CA 198.12.89.27:80 198.12.89.27 tcp
CA 198.12.89.27:80 198.12.89.27 tcp
CA 198.12.89.27:80 198.12.89.27 tcp
US 8.8.8.8:53 wz-lk.giftsbybierd.com udp
US 44.203.203.154:4434 wz-lk.giftsbybierd.com tcp

Files

memory/2548-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2548-1-0x0000000072CFD000-0x0000000072D08000-memory.dmp

memory/2660-5-0x000000002F411000-0x000000002F412000-memory.dmp

memory/2660-7-0x0000000072CFD000-0x0000000072D08000-memory.dmp

memory/2548-10-0x0000000002400000-0x0000000002402000-memory.dmp

memory/2660-9-0x0000000003BB0000-0x0000000003BB2000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{4D3D651D-7C68-4522-ACC0-1884F14A2AE2}.FSD

MD5 7b1e545cef34f92f8dcb4caf7785136f
SHA1 3c79eb48f9ed92d4d588ae5b2f8b930624909814
SHA256 b3b915966f8c8e93aaa79aa2f4606b99ea1b58da8e263d99db08116b71090ba5
SHA512 5027fcdc7d21ef3e65c9f99e2256f81d87c222d9d94124e4f43e541517b1f9e81f5f80966517528116240e92193c413432c3ebedf0ad927c038b716fdcc55a49

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

MD5 4c320f543c5f87a5f1a3670bb068b8cb
SHA1 80157a922f6d3776dae05df44ca9afdf0278e33d
SHA256 28a916357f9e77cd53d881db4d15c289750a70c36b608b3d389d8363bc21f4c7
SHA512 d28f64cd546003b0ffb1cc308c51a778fe708a1f1ce21a472695511b096c3d6544fe266a467c45622ecbb6a1ac43adae01c0fc86f9acd4fae9f79f30b2bf5777

C:\Users\Admin\AppData\Local\Temp\{18590B0E-FE87-4A4E-99E0-6D1F273B6D49}

MD5 4c6341f18e0122d378e577f78b46e1ca
SHA1 60c348f0eb8ebe65542ffafbe82b53d3a7743fc6
SHA256 46beba9b1b9f2f077b02dc662fc4c9ded9136b6909cd9a6c3e91b54e45aabb9a
SHA512 e6ed9f14605828c30fcfa0200c09ef1ee066dda3d21d4be4f63a43660f725c4495acdf6e684ff7d9cf407dc084e5afe33035b6a85f0707fe5e245b67467ab7c5

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HYK2QHJO\hclupdationprocessstartedrecentlytoimprovethequalityofservicetoconfirmentirethingsfineformtheside[1].doc

MD5 e589afe701c8eb046a0aa6b1ab35e9eb
SHA1 182a9f9113be2da618efce9973ef54bae4867fd9
SHA256 c3e56bdc9a5195ea0780f2db3896d40d2e7ad07c5a150849ad1685ea8cd34040
SHA512 f604f2dfa4efa8d6a2729105e2d50c33f233d36a8b8b2678af1e8fecce0be5caf269cb74a7739618ad5cd8e8d350f741e0b4a8a45ce70209320ea7b9f1b056de

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BE1AACCB.doc

MD5 a49a80ff3783f140a78a34885febfee9
SHA1 569348f6e9d0d4583794369af2ae07965f09800a
SHA256 750d96ce3b8eba97e8762f97cf96e867024b0a0e059e9f726057faac1f745f55
SHA512 cf73920f792187e706237e8c3638692a75227bee75d3afa30f919c15b4e00cb24c73c9e85c3b2aeadfa875af3618c55f98f6ec879d10e3cc663eef99b2ed22a6

\Users\Admin\AppData\Roaming\conhosts.exe

MD5 0244d876b9a2c1929fec2d2fbf167e33
SHA1 ee74011718c11dba40cc8b5382f1bd97f8a513d1
SHA256 80ce04333e465a4d3f075b056bbfda4fbba1b63e47b5e5868f82ae3bfae3c247
SHA512 d4642516c0129c40da64b43bc5be8249b5ee19e91a05242555c3c645f100c3def1540934c3e815809b7f76be154a59eae8f753607e0625b417e4b9dce6db43bb

C:\Users\Admin\AppData\Roaming\conhosts.exe

MD5 a3d60da0e536b4cadba316c6fb409598
SHA1 874433094edf7e8c6a81bbf08a0e5561db584c00
SHA256 f4e2cea54680b29bb251869df9847c3f07136144c58422a2d3d50449e028b80a
SHA512 69fe869d89d743da6e40bcfe1b56c4eb764a388ec9889f780b937d6b397d0f2d4a75739494406d5e26401f013bf741caff304afcef920dd2c33705807c21ee71

\Users\Admin\AppData\Roaming\conhosts.exe

MD5 3e6a0dd4cee9e66514b996e37c661a50
SHA1 13837f75d762ec92e7785360e1edcef279f5a393
SHA256 fcc2deaaf11de17751500dbb447dcc0b53334865379db398e28cba64e800e287
SHA512 229896c34ddc1d89c728cc2de380eabbc7ec92930cb4bad34869872b53a9ee16345e45a4958662128a5e9749db5a84abfc36ead598e224b6e32f5677a13ad1cc

C:\Users\Admin\AppData\Roaming\conhosts.exe

MD5 7e85155ab2d244aed0eb929f7c7e279d
SHA1 d42b2928e5d51e4339e3c8dc4f8203460b157ab7
SHA256 b89bb0971d97388b8cde24f4f5d166dce6f4c0fb8c21d90d22b023f18641f977
SHA512 1d30175d3c36547f11a0cf694d1d290cc82a2336476f1205376771743918f580ae409c8def39685c4785a39e6986d92ac15330304726fcd1ec778929bf392f6f

C:\Users\Admin\AppData\Roaming\conhosts.exe

MD5 45c4c2b4a524260051f02c947e9e09ae
SHA1 0254b14e1a5b87c390fd71be646e1b25a454470f
SHA256 990ce1f57c3a934a5fd8f181bc68b928eee20587f69c25db681a630f4e09988d
SHA512 ce143ce6ccc18bcb3f3943103dcd6f6a5888c2b410ea42a7a70403ba71e56796f3f4481a5831402018c03ac9e1f0d2c995c922ba403934810c66e4660b1bb943

memory/2792-101-0x00000000001F0000-0x0000000000296000-memory.dmp

memory/2792-102-0x000000006B0C0000-0x000000006B7AE000-memory.dmp

memory/2792-104-0x0000000004D70000-0x0000000004DB0000-memory.dmp

memory/2792-106-0x0000000000400000-0x000000000041C000-memory.dmp

memory/2548-107-0x0000000072CFD000-0x0000000072D08000-memory.dmp

memory/2660-108-0x0000000072CFD000-0x0000000072D08000-memory.dmp

memory/2792-109-0x0000000000430000-0x0000000000444000-memory.dmp

memory/2792-110-0x0000000004DB0000-0x0000000004E1E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7272.tmp

MD5 7241559590dee3ba391cd1b7acb66ca9
SHA1 622e1e044e301af84b1ed9d3e62b719cd4eb299b
SHA256 6a25885852e52f152e5839a2d51e7ef20e18a98093a91124facbbb68bf7bea60
SHA512 b66e2e1a653a36cc62563ea7073ca9e011fc3949f2b86c87ef62050581d8e75d5f1f0883d397c82af12f3ba07b1ad17ab103597f538e01f1935f0f2cfdfd0dc3

memory/1080-120-0x0000000000400000-0x000000000055E000-memory.dmp

memory/1080-126-0x0000000000400000-0x000000000055E000-memory.dmp

memory/1080-130-0x0000000000400000-0x000000000055E000-memory.dmp

memory/2792-133-0x000000006B0C0000-0x000000006B7AE000-memory.dmp

memory/1080-132-0x0000000000400000-0x000000000055E000-memory.dmp

memory/1080-128-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1080-137-0x0000000000400000-0x000000000055E000-memory.dmp

memory/584-136-0x0000000002930000-0x0000000002970000-memory.dmp

memory/584-138-0x00000000656D0000-0x0000000065C7B000-memory.dmp

memory/584-135-0x0000000002930000-0x0000000002970000-memory.dmp

memory/584-134-0x00000000656D0000-0x0000000065C7B000-memory.dmp

memory/1080-124-0x0000000000400000-0x000000000055E000-memory.dmp

memory/1080-123-0x0000000000400000-0x000000000055E000-memory.dmp

memory/1080-122-0x0000000000400000-0x000000000055E000-memory.dmp

memory/1080-118-0x0000000000400000-0x000000000055E000-memory.dmp

memory/584-139-0x00000000656D0000-0x0000000065C7B000-memory.dmp

memory/1080-141-0x0000000003300000-0x0000000003400000-memory.dmp

memory/1080-140-0x0000000000400000-0x000000000055E000-memory.dmp

memory/1080-142-0x0000000000400000-0x000000000055E000-memory.dmp

memory/1080-148-0x0000000004300000-0x0000000004384000-memory.dmp

\Users\Admin\AppData\Local\Temp\vcruntime140.dll

MD5 b9836f44cb6940afe10a8279dc82ef8e
SHA1 827561aa2488d2826940d789a79fa55db1a1a379
SHA256 6a20edc9b156ad1ce63d0b6773a9c3c9fff6643c3ade5108dc4428a3a1304509
SHA512 2a61a71cce3424cbcf299e02447a495a59764f2538df18931080e5112e1b84a9e70c5a8ff68852b37ad4d232af467dff4e05276b30d992e465d390b79d2c669b

\Users\Admin\AppData\Local\Temp\msvcp140.dll

MD5 b8ecb3ecf11faf45947e0eea966bc97b
SHA1 c5e9edea9ab49c5d987488f9e19a6ace3c303c2e
SHA256 9566ff8514133a80aea94fef870c6ca25d57dd0c9e7dcca140510e324d5f3b18
SHA512 aa14b14dd15956b824826ccb0260e1c7d2dfa64cf5cc8563978200f80a45a3b11b592bb278b69c167b086b137c1dbb9a0e135ad8e581b12d5e768da774f166d6

\Users\Admin\AppData\Local\Temp\freebl3.dll

MD5 54b79485c96736d7c4d613433598fcae
SHA1 8f350b4f7e086ed05f460b392f5502399672b67d
SHA256 1273c807a4da6f28f06e5a2acf9179c81a49a63d197b383eeaccea04202080e3
SHA512 e3006691a9045cc8701b4fb08006b0f7ce57b0b503b558c54fc39ce8095c461fd6ed9d5551ead8441d5faffa8e32f602da5c76c2f1d78579e3c624bb7e128884

\Users\Admin\AppData\Local\Temp\softokn3.dll

MD5 35fcaf7f50128448e6ebd210626bcd70
SHA1 4fc8bde385b3e92d765b291b0e32da3ff2a08542
SHA256 2d1a4a4428051cd1be631f94ea0e632ffa1d251f3c14faf47eb818e0f1a3950d
SHA512 d59a925580307fa8bce27555f3ff9239aec2fd70f21aecd0bb73a7869907e8fa1d3350f445abf79878badc6dfd6bc40c98f08da1c64c5a99a529cde9ab6a1730

\Users\Admin\AppData\Local\Temp\nss3.dll

MD5 62322754cc72bb5cc8f0905e1055a426
SHA1 4b39c26416ff7da42b0859429fc0e34a5e4500ef
SHA256 eefe097b40cf965084d410631eb547204e26068229a5b098a8e5a29fc050ecfd
SHA512 df51196d8fab9fad7bf2bb9308007c0d0134f2b8baf88679831eaac0001fd15df9047aec369271b16b796e7fa9125b5618dc5e0b66e27151f9b1e943f820af0b

memory/1080-167-0x0000000000400000-0x000000000055E000-memory.dmp

\Users\Admin\AppData\Local\Temp\mozglue.dll

MD5 21e04a8c690632f13ccbdf81f2eacf62
SHA1 321e2f8fb406996b6e5a20ffbbbeb4d9266c212a
SHA256 4691f89784f7639141fc6efd73340e888f46695679afc7a2f31a10ca633ceec4
SHA512 cf5ee901b88956475793e8e7d5a458d62470762f35aba74e72f0eb37fb2f79fb2cbd87f9dd00990063ff77d8265032bf2f723ad7036340c99c3d6ef2fca0dcfe