asyncrat | 3a280f118c4f7ac82065573f90304f21133cdb63ca937538fb204044b5a5af97

Analysis

max time kernel
153s
max time network
209s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05-08-2024 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Infected.exe
Size

63KB
MD5

6ebf955e667eca74175c3542178de4d6
SHA1

ede474b8c1b9101424415e3b58087f1460024c31
SHA256

3a280f118c4f7ac82065573f90304f21133cdb63ca937538fb204044b5a5af97
SHA512

7c42c092074dcf9b664c1b0bf08d67e19880bb61bbc99411bebdabc5ff30494f6e7a9921c09434c7ad5abf1846d3779ad126c69e49841f6600f68d97b9f460fb
SSDEEP

768:Cil3pYNlrm78RIC8A+XjqazcBRL5JTk1+T4KSBGHmDbD/ph0oXlE24NEMSuLbpqM:jyr0AdSJYUbdh9+vYuLbpqKmY7

Score

10^/10

asyncrat stealerium testing collection credential_access discovery persistence privilege_escalation rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Botnet

testing

147.185.221.21:35374

Attributes

delay
1
install
true
install_file
sigma.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Stealerium
An open source info stealer written in C# first seen in May 2022.
stealer stealerium

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000400000002aa72-11.dat	family_asyncrat

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Executes dropped EXE 1 IoCs

pid	Process
3172	sigma.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sigma.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sigma.exe
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sigma.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	icanhazip.com
2	ip-api.com

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1880	cmd.exe
4880	netsh.exe
4972	cmd.exe
3336	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	sigma.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	sigma.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3032	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
4408	Infected.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe
3172	sigma.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	Infected.exe
Token: SeDebugPrivilege	3172	sigma.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 1016	4408	Infected.exe	82
PID 4408 wrote to memory of 1016	4408	Infected.exe	82
PID 4408 wrote to memory of 3612	4408	Infected.exe	84
PID 4408 wrote to memory of 3612	4408	Infected.exe	84
PID 3612 wrote to memory of 3032	3612	cmd.exe	86
PID 3612 wrote to memory of 3032	3612	cmd.exe	86
PID 1016 wrote to memory of 3544	1016	cmd.exe	87
PID 1016 wrote to memory of 3544	1016	cmd.exe	87
PID 3612 wrote to memory of 3172	3612	cmd.exe	88
PID 3612 wrote to memory of 3172	3612	cmd.exe	88
PID 3172 wrote to memory of 1880	3172	sigma.exe	90
PID 3172 wrote to memory of 1880	3172	sigma.exe	90
PID 1880 wrote to memory of 3864	1880	cmd.exe	92
PID 1880 wrote to memory of 3864	1880	cmd.exe	92
PID 1880 wrote to memory of 4880	1880	cmd.exe	93
PID 1880 wrote to memory of 4880	1880	cmd.exe	93
PID 1880 wrote to memory of 4028	1880	cmd.exe	94
PID 1880 wrote to memory of 4028	1880	cmd.exe	94
PID 3172 wrote to memory of 4640	3172	sigma.exe	95
PID 3172 wrote to memory of 4640	3172	sigma.exe	95
PID 4640 wrote to memory of 3556	4640	cmd.exe	97
PID 4640 wrote to memory of 3556	4640	cmd.exe	97
PID 4640 wrote to memory of 4520	4640	cmd.exe	98
PID 4640 wrote to memory of 4520	4640	cmd.exe	98
PID 3172 wrote to memory of 4972	3172	sigma.exe	99
PID 3172 wrote to memory of 4972	3172	sigma.exe	99
PID 4972 wrote to memory of 4904	4972	cmd.exe	101
PID 4972 wrote to memory of 4904	4972	cmd.exe	101
PID 4972 wrote to memory of 3336	4972	cmd.exe	102
PID 4972 wrote to memory of 3336	4972	cmd.exe	102
PID 4972 wrote to memory of 3092	4972	cmd.exe	103
PID 4972 wrote to memory of 3092	4972	cmd.exe	103
PID 3172 wrote to memory of 4452	3172	sigma.exe	104
PID 3172 wrote to memory of 4452	3172	sigma.exe	104
PID 4452 wrote to memory of 1456	4452	cmd.exe	106
PID 4452 wrote to memory of 1456	4452	cmd.exe	106
PID 4452 wrote to memory of 1132	4452	cmd.exe	107
PID 4452 wrote to memory of 1132	4452	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sigma.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-242286936-336880687-2152680090-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sigma.exe

C:\Users\Admin\AppData\Local\Temp\Infected.exe
"C:\Users\Admin\AppData\Local\Temp\Infected.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "sigma" /tr '"C:\Users\Admin\AppData\Roaming\sigma.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "sigma" /tr '"C:\Users\Admin\AppData\Roaming\sigma.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9059.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3032
- - C:\Users\Admin\AppData\Roaming\sigma.exe
    "C:\Users\Admin\AppData\Roaming\sigma.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:3172
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3864
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4880
    - - C:\Windows\system32\findstr.exe
        
        findstr All
        5⤵
        
        PID:4028
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3556
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4520
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
      4⤵
      System Network Configuration Discovery: Wi-Fi Discovery
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:4904
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3336
    - - C:\Windows\system32\findstr.exe
        
        findstr All
        5⤵
        
        PID:3092
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4452
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:1456
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show networks mode=bssid
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3859.tmp.dat

Filesize
114KB

MD5
0314b66f9eb938be8129e7b72a6dfe4d

SHA1
f524526636d7e3df1c2d6fc4d3a530ec2b40f5a6

SHA256
96f64dc6baf4363b64cf944be7e45a0400e535951510200007a4bdd68d1788d8

SHA512
ce7622f34a755687816868f1d26c069cefc69b2a630f333d3c49203e4aa285a312e693c4875f8ce709778ffb2e7f9376269f795063f665f18efaf7550e956194

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp386B.tmp.dat

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp386E.tmp.dat

Filesize
5.0MB

MD5
7367c79c5371210ee11b636ad2dfe9c8

SHA1
918a195fe480bbaf1d3f06af151874641ef6ff48

SHA256
e4fbfcb98867e877047f75335865537d4872fd839c5187b7f392a6b9fbc19fb6

SHA512
0965ce063c23c42226d7e8d8202279260ea2e3853e996351286c8505f5ca17c17f68e281a10ef6cef4ab30d1ac01984a7b6980630eace5b5262ee8cfec6b35c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp9059.tmp.bat

Filesize
149B

MD5
2d147e1bacfeb1848355453c182c35de

SHA1
fd90d443f28b72e86033b33904cf93d5e6635b2f

SHA256
725a1f2672016290d4204161d184c235e5753bb91eb300fbe48199cfd0728725

SHA512
dc30b6be2beffb2681f5378a7554b3fc1604be8b3825e2dd272e8427296f77fbe3c987f4220487f2b8ebe2d82eb4482a7265fed11b5c83be7c5e4f090968369f

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\Browsers\Mozilla\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\Directories\OneDrive.txt

Filesize
25B

MD5
966247eb3ee749e21597d73c4176bd52

SHA1
1e9e63c2872cef8f015d4b888eb9f81b00a35c79

SHA256
8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

SHA512
bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\Directories\Startup.txt

Filesize
24B

MD5
68c93da4981d591704cea7b71cebfb97

SHA1
fd0f8d97463cd33892cc828b4ad04e03fc014fa6

SHA256
889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

SHA512
63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\System\Desktop.jpg

Filesize
82KB

MD5
40655b22f374e2475cebc8491b5c06f6

SHA1
937df2fe7c04c497750ed4f1057ad4007cf2239b

SHA256
e8f4017f7dabcafd28ef5d2880dc8c3c5db4e8ec6b973c57743a57e21199fb83

SHA512
50b91e696a6dce1f4bc00500f3c16e4ca96164da003f7e03a91729798277ddfd6d47782c53be691d296a8d265eecd01cd5fd9c8a19e29342999c4f3bd0bf197b

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\System\Process.txt

Filesize
3KB

MD5
d893e8d9d5e0b1530750989e0a4b79fc

SHA1
7505cb91c35a346eeda2c009fa9c9817a1cbc641

SHA256
a34bf837c946db579e5af53489b8c0195edec82a425c4774f3a564e97f38d344

SHA512
0c443f9a63891a312272f620cc69e48e426adcf98039e0dad872d45bfea8b1eaf438207d05c59a8f41a304290754e398000ba4ec045b970adbbb6e03703bca4b

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\System\Process.txt

Filesize
4KB

MD5
cf1bfe5715b08d1d646524fc14a538ac

SHA1
8c84dc3673998f6c01629c11688936a565548dd5

SHA256
14ea90e28330d73797717262effba300842031541f18c69fedab05361f43818a

SHA512
72b8c18fe5fee9d3c9145e626241a6503590f2dea7dbbded6e771f573a9e681f4ffb2e4c6efd9e77117639957092b9dc4e287bdbe040575b437041a2b1b3651e

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\System\Process.txt

Filesize
1KB

MD5
ca05517fe444232bd0b89e65b0205356

SHA1
671d0233d3cd3b0b7d3aaee99174a9b11604cf7b

SHA256
f169d3aecc9a06832836c3e1ac8a69111e4fbdb43d1d9bed6d8559edf121db3f

SHA512
5aa7f1ad1fd82aea4e439831b268566633a36ae6050f692eeab52ba9cbc08b02848dfc4bf332c141592bdfd4c59788e9bd92fad2a912ddc2045048dbe81c82e9

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\System\Process.txt

Filesize
668B

MD5
06b339e306e360cbe2232417a87e5a2b

SHA1
3aa69154a16511c4a549e80fe6dad2889f308e09

SHA256
eb7354253ed99f44feba8b560cf1b50d8ac4743d3c14f8ca13094debca348af6

SHA512
e3532ea99d93ef6fc7fafce034754371fb4f4540c0dbf810024e72fe7d109365705a35ca1aff74ebaaac33eb76aaa6bf3508333991b4b5c25c783f8238996e24

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\System\Process.txt

Filesize
765B

MD5
510861d348bd0e7b7f1c71df3ceb41d3

SHA1
60859653ef296022d0ecb3e488b9c6ad2a4fc833

SHA256
ae9de62bffdc50c2106ecf6e63649b01f0d59f17eb2a03165712e1aab0878197

SHA512
73e8175e890184359471f1329ba75521cb157366d910c31c37f7c8630b6d2eb62236a5e794d7e25a0a0475eb5d28e0d77c17cfe637c34fd59ff908de28d22df2

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\System\Process.txt

Filesize
3KB

MD5
8ad2bf69ec9e5392c834157030f3f312

SHA1
94873166615db06a6a46169dcbf267afa19b520c

SHA256
02381c5a655fc88560f3d716e18b4625b02541e58d5c660ca27ab5e2349a8805

SHA512
58aeec4578b01911a491cebb5459fbb3ddd8b8d864ed26e170162f8817e020903af9b2b82b3770e892be5a9c7c04aa7a34bc03d84af84e08b50344c82d934909

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\System\Process.txt

Filesize
4KB

MD5
6931c229b5cb1fcf9358e1fe8dd0ad39

SHA1
5ca0c5dfad81945a875e8199bed56eb5b4321454

SHA256
be79f442079c1eb6cee31f8812bc3711a60b9309052ece1f4263deb09e89aeec

SHA512
befa289e02f1474c7eddb5e932d5ea7b4b97da2dcd5315e1d0c50b310a1c3a90dbc1500a80cf525af84c378d0348a613b7f84288f2834a3546ef10236cc9e3ec

Download Submit
C:\Users\Admin\AppData\Local\f7643365a75d986a16230a48cf3aa73a\Admin@HFFTDKON_en-US\System\ProductKey.txt

Filesize
29B

MD5
71eb5479298c7afc6d126fa04d2a9bde

SHA1
a9b3d5505cf9f84bb6c2be2acece53cb40075113

SHA256
f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

SHA512
7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

Download Submit
C:\Users\Admin\AppData\Roaming\sigma.exe

Filesize
63KB

MD5
6ebf955e667eca74175c3542178de4d6

SHA1
ede474b8c1b9101424415e3b58087f1460024c31

SHA256
3a280f118c4f7ac82065573f90304f21133cdb63ca937538fb204044b5a5af97

SHA512
7c42c092074dcf9b664c1b0bf08d67e19880bb61bbc99411bebdabc5ff30494f6e7a9921c09434c7ad5abf1846d3779ad126c69e49841f6600f68d97b9f460fb

Download Submit
memory/3172-13-0x000000001BD60000-0x000000001BDD6000-memory.dmp

Filesize
472KB

Download
memory/3172-20-0x00000000024E0000-0x00000000024EA000-memory.dmp

Filesize
40KB

Download
memory/3172-165-0x000000001BC60000-0x000000001BCDA000-memory.dmp

Filesize
488KB

Download
memory/3172-14-0x000000001BEE0000-0x000000001C068000-memory.dmp

Filesize
1.5MB

Download
memory/3172-15-0x0000000002510000-0x000000000252E000-memory.dmp

Filesize
120KB

Download
memory/3172-374-0x0000000000B80000-0x0000000000BB2000-memory.dmp

Filesize
200KB

Download
memory/3172-375-0x000000001C770000-0x000000001C7DA000-memory.dmp

Filesize
424KB

Download
memory/4408-8-0x00007FFE44430000-0x00007FFE44EF2000-memory.dmp

Filesize
10.8MB

Download
memory/4408-3-0x00007FFE44430000-0x00007FFE44EF2000-memory.dmp

Filesize
10.8MB

Download
memory/4408-2-0x00007FFE44430000-0x00007FFE44EF2000-memory.dmp

Filesize
10.8MB

Download
memory/4408-0-0x0000000000FA0000-0x0000000000FB6000-memory.dmp

Filesize
88KB

Download
memory/4408-1-0x00007FFE44433000-0x00007FFE44435000-memory.dmp

Filesize
8KB

Download