Malware Analysis Report

2025-01-22 14:19

Sample ID 240214-l38jbsfe4s
Target 9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009
SHA256 9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009
Tags
warzonerat infostealer persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009

Threat Level: Known bad

The file 9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009 was found to be: Known bad.

Malicious Activity Summary

warzonerat infostealer persistence rat

WarzoneRat, AveMaria

Warzone RAT payload

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Suspicious use of FindShellTrayWindow

Enumerates system info in registry

Modifies registry class

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Modifies Internet Explorer settings

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-14 10:04

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-14 10:04

Reported

2024-02-14 10:07

Platform

win7-20231215-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009.xll

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009.xll

Network

N/A

Files

memory/2024-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2024-1-0x0000000072CAD000-0x0000000072CB8000-memory.dmp

\Users\Admin\AppData\Local\Temp\9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009.xll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2024-3-0x0000000072CAD000-0x0000000072CB8000-memory.dmp

memory/2024-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2024-5-0x0000000072CAD000-0x0000000072CB8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-14 10:04

Reported

2024-02-14 10:07

Platform

win10v2004-20231222-en

Max time kernel

144s

Max time network

149s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009.xll"

Signatures

WarzoneRat, AveMaria

rat infostealer warzonerat

Warzone RAT payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Cmages = "C:\\ProgramData\\cmages.exe" C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe N/A

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\ProgramData\cmages.exe

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\cmages.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1464 wrote to memory of 3116 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 1464 wrote to memory of 3116 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 1464 wrote to memory of 3116 N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 3116 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
PID 4388 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\ProgramData\cmages.exe
PID 4388 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\ProgramData\cmages.exe
PID 4388 wrote to memory of 3756 N/A C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 4680 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe
PID 3756 wrote to memory of 3524 N/A C:\ProgramData\cmages.exe C:\ProgramData\cmages.exe

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009.xll"

C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe

"C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe"

C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe

C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe

C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe

C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe

C:\ProgramData\cmages.exe

"C:\ProgramData\cmages.exe"

C:\ProgramData\cmages.exe

C:\ProgramData\cmages.exe

C:\ProgramData\cmages.exe

C:\ProgramData\cmages.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4680 -ip 4680

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 80

Network

Country Destination Domain Proto
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 97.32.109.52.in-addr.arpa udp
US 8.8.8.8:53 16.43.107.13.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 qoldwold.zanity.net udp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 qoldwold.zanity.net udp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
US 8.8.8.8:53 qoldwold.zanity.net udp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp
UA 194.147.140.222:5208 qoldwold.zanity.net tcp

Files

memory/1464-0-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

memory/1464-1-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

memory/1464-2-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

memory/1464-4-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-3-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

memory/1464-6-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

memory/1464-5-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-7-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-8-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-9-0x00007FFC16720000-0x00007FFC16730000-memory.dmp

memory/1464-10-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-11-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-12-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-13-0x00007FFC16720000-0x00007FFC16730000-memory.dmp

memory/1464-14-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-15-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-16-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-17-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-19-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-18-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-20-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-21-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-22-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-25-0x000001FD508B0000-0x000001FD509D2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009.xll

MD5 08fea09ff0b64eeed38c5e5056626b86
SHA1 5bed42391c7c2c2bfd853a51b5f38b87e0ee03ed
SHA256 9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009
SHA512 630fd25bc6dda06257069dfdee0488f03fa0bceb1c2f4425d65983ca21f42a1b5b5ac67e8f6468d46ea39c58d1f4033762ce3e18e118a11c81e54d8dd0f39066

memory/1464-28-0x000001FD51F10000-0x000001FD51F24000-memory.dmp

memory/1464-29-0x000001FD6A2D0000-0x000001FD6A454000-memory.dmp

memory/1464-31-0x00007FFC30A90000-0x00007FFC31551000-memory.dmp

memory/1464-32-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-30-0x000001FD52010000-0x000001FD5204C000-memory.dmp

memory/1464-33-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-34-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-37-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-38-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-39-0x000001FD6A450000-0x000001FD6A4D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe

MD5 c4c2b1de0beed142e649ed9db54135d8
SHA1 3c290091b7ef5b8e3a9f5f1d7b5a091845c5cbf3
SHA256 bf81759f58a1c186019e567df6ef5347d61ec3d032be37c6a9268a59c5679a88
SHA512 f806647de157e68cc6f47008eb8661aa238fba136eea475183fab03339e566c8c47cd36a2539626cd978ff1b0e8926fa6242a369f44ed7d68ce3989ee12949cc

memory/3116-57-0x0000000074980000-0x0000000075130000-memory.dmp

memory/3116-56-0x00000000004A0000-0x0000000000524000-memory.dmp

memory/3116-58-0x0000000002810000-0x0000000002816000-memory.dmp

memory/3116-59-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

memory/3116-60-0x0000000005130000-0x00000000051A8000-memory.dmp

memory/3116-61-0x0000000005250000-0x00000000052EC000-memory.dmp

memory/3116-62-0x00000000058A0000-0x0000000005E44000-memory.dmp

memory/3116-63-0x00000000052F0000-0x0000000005382000-memory.dmp

memory/3116-64-0x0000000004FF0000-0x0000000004FF6000-memory.dmp

memory/1500-65-0x0000000000400000-0x0000000000554000-memory.dmp

memory/1500-71-0x0000000000400000-0x0000000000554000-memory.dmp

memory/1500-74-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3116-75-0x0000000074980000-0x0000000075130000-memory.dmp

memory/4388-76-0x0000000000400000-0x0000000000554000-memory.dmp

memory/1500-77-0x0000000000400000-0x0000000000554000-memory.dmp

memory/4388-81-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3756-83-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/3756-84-0x0000000005540000-0x0000000005550000-memory.dmp

memory/3524-91-0x0000000000400000-0x0000000000554000-memory.dmp

memory/3756-92-0x00000000742F0000-0x0000000074AA0000-memory.dmp

memory/1464-93-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/3524-94-0x0000000000400000-0x0000000000554000-memory.dmp

memory/1464-95-0x00007FFC30A90000-0x00007FFC31551000-memory.dmp

memory/1464-99-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-100-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-101-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-102-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-105-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/1464-106-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

memory/3524-107-0x0000000000400000-0x0000000000554000-memory.dmp

memory/1464-122-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

memory/1464-123-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

memory/1464-124-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

memory/1464-125-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

memory/1464-126-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

memory/1464-127-0x00007FFC30A90000-0x00007FFC31551000-memory.dmp