Analysis

  • max time kernel
    69s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    05-05-2021 16:11

General

  • Target

    1bded6e2e06619dfaa85cadd6b4c85e7.exe

  • Size

    830KB

  • MD5

    1bded6e2e06619dfaa85cadd6b4c85e7

  • SHA1

    684e6799f7b400bba5d0f927c43cc13bb6398505

  • SHA256

    8f4d8aa16d1bfe09808ce2c6b24c3ad550bc41643bc5624a9506c66873c172a8

  • SHA512

    c2ad7271e5470af72c08c02e61687a1fb1d2be4dd213ac83bafa5efe582bc60d9eaa9977674d4fd751e964ea24935781f76bfbfa7d780809baa845aafbe7964a

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 14 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1bded6e2e06619dfaa85cadd6b4c85e7.exe
    "C:\Users\Admin\AppData\Local\Temp\1bded6e2e06619dfaa85cadd6b4c85e7.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\4fe3e0e5-53c8-4963-925e-cfe4b5cebd86" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:576
    • C:\Users\Admin\AppData\Local\Temp\1bded6e2e06619dfaa85cadd6b4c85e7.exe
      "C:\Users\Admin\AppData\Local\Temp\1bded6e2e06619dfaa85cadd6b4c85e7.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:204
      • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin1.exe
        "C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin1.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3876
        • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin1.exe
          "C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin1.exe" --Admin
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3156
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "& {Start-Process PowerShell -ArgumentList '-NoProfile -ExecutionPolicy Bypass -File ""C:\Users\Admin\AppData\Local\script.ps1""' -Verb RunAs}"
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4068
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\script.ps1
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2164
          • C:\Program Files\Windows Defender\mpcmdrun.exe
            "C:\Program Files\Windows Defender\mpcmdrun.exe" -removedefinitions -all
            5⤵
            • Deletes Windows Defender Definitions
            PID:804
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delself.bat""
            5⤵
              PID:1448
        • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin2.exe
          "C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin2.exe"
          3⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          PID:2888
        • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\5.exe
          "C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\5.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:2228
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 840
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1300
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 916
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3404
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1076
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:496
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1116
            4⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:632
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1148
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:3888
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1192
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:3180
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1464
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:2164
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1080
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:2936
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1604
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:900
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1672
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:2508
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1692
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:4080
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1804
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:3124
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1832
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:504
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 1944
            4⤵
            • Program crash
            • Suspicious use of AdjustPrivilegeToken
            PID:576
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\5.exe" & del C:\ProgramData\*.dll & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:808
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /im 5.exe /f
              5⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2164
            • C:\Windows\SysWOW64\timeout.exe
              timeout /t 6
              5⤵
              • Delays execution with timeout.exe
              PID:4012

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Command-Line Interface

    1
    T1059

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Impair Defenses

    1
    T1562

    File Permissions Modification

    1
    T1222

    Modify Registry

    2
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Credentials in Files

    4
    T1081

    Discovery

    Query Registry

    2
    T1012

    System Information Discovery

    2
    T1082

    Collection

    Data from Local System

    4
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\freebl3.dll
      MD5

      ef2834ac4ee7d6724f255beaf527e635

      SHA1

      5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

      SHA256

      a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

      SHA512

      c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

    • C:\ProgramData\mozglue.dll
      MD5

      8f73c08a9660691143661bf7332c3c27

      SHA1

      37fa65dd737c50fda710fdbde89e51374d0c204a

      SHA256

      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

      SHA512

      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

    • C:\ProgramData\msvcp140.dll
      MD5

      109f0f02fd37c84bfc7508d4227d7ed5

      SHA1

      ef7420141bb15ac334d3964082361a460bfdb975

      SHA256

      334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

      SHA512

      46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

    • C:\ProgramData\nss3.dll
      MD5

      bfac4e3c5908856ba17d41edcd455a51

      SHA1

      8eec7e888767aa9e4cca8ff246eb2aacb9170428

      SHA256

      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

      SHA512

      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

    • C:\ProgramData\softokn3.dll
      MD5

      a2ee53de9167bf0d6c019303b7ca84e5

      SHA1

      2a3c737fa1157e8483815e98b666408a18c0db42

      SHA256

      43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

      SHA512

      45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

    • C:\ProgramData\vcruntime140.dll
      MD5

      7587bf9cb4147022cd5681b015183046

      SHA1

      f2106306a8f6f0da5afb7fc765cfa0757ad5a628

      SHA256

      c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

      SHA512

      0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      MD5

      fa08f6463ef7be976f91339d5c800cd3

      SHA1

      8f179db874997b62c87d6da487a4b3a4db332a50

      SHA256

      c9b2bbc388046f9e34ce5b00e7624956916650f0b4cc4db3ce9f3ee2fb024af3

      SHA512

      80424f97f0a2b9244a378c0713de0143e7c9165a6545d706c162b6b0554b4c7d012f1f99668b6d1edf098a7190b456307e7ff88241c61c5dbad39b58369faaf3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      MD5

      21b384ab8f79242a8b66c0d2bcf28d14

      SHA1

      2c0a75ba21188dfbb1e5d26361bb7f4ccb5f1c3a

      SHA256

      7b4888ca877ce314415b04b92dffe7acf5f656b99908c9c0e174722b2e2386a4

      SHA512

      a3210cbde79ef024a5b17526b51f22c2ae86b03322e8cc06d8c8ad9c74d5ba7aeef792498198f21d43785b784f463126f686fe14396aef5ccecab63f61530e7e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
      MD5

      72730d2a05841dbdeff5593388e60e01

      SHA1

      5303d4ca22b3eb2843f57acc521b8b7213225749

      SHA256

      a053eb0ad84d5db5d2544015a25ec0ebcd69d34503e5c1597040741aa48dafe4

      SHA512

      6c957c4acd1e53eb5b2544f01ad9a622738280285d2ce047a805e1d0326e32b511281abffdbe4ffc1cb74cc3308e381b18456b7e16b6792bd3bf170768ecc9cb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
      MD5

      12809a79bdc7ba2802a267f640e36696

      SHA1

      81beca442a9a58d1627706f74ee1344eed82e353

      SHA256

      086d2629942c9bf7278b1155b445773df5e1f7bf03de96b93190799531d43595

      SHA512

      eac71d1dcb5b5921d350f28b71608ed46bccfe57211fb8651f07f1169719bc5c226bd4484e57d792102e9c7f492acde71a7523648c9f365fa962d55564230b92

    • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\5.exe
      MD5

      870b1ebd3a6f7418f9d9651a2772431f

      SHA1

      40dc4bd8ab1940cff438f3744bd2894985fff28a

      SHA256

      dc466832b1cfeb541df94d49aea4de357c034f78bf70480c27fe265e440010bf

      SHA512

      4d1eb817c319260ecdfd2f70ff2e9fd8594368a15203246f3997b207121044f12a68de64e280bcbafa1206241dba393f8190366684a54555d74199b2aa85c9c7

    • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\5.exe
      MD5

      870b1ebd3a6f7418f9d9651a2772431f

      SHA1

      40dc4bd8ab1940cff438f3744bd2894985fff28a

      SHA256

      dc466832b1cfeb541df94d49aea4de357c034f78bf70480c27fe265e440010bf

      SHA512

      4d1eb817c319260ecdfd2f70ff2e9fd8594368a15203246f3997b207121044f12a68de64e280bcbafa1206241dba393f8190366684a54555d74199b2aa85c9c7

    • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin1.exe
      MD5

      5b4bd24d6240f467bfbc74803c9f15b0

      SHA1

      c17f98c182d299845c54069872e8137645768a1a

      SHA256

      14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e

      SHA512

      a896acc38a6ff9641b0803f0598369c0d4fa8e38da28c1653c57948fe5e3274880d1b2e7959cd1b1da43375a1318b3ba72e13240bf40b27c852ee72bbb16cadc

    • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin1.exe
      MD5

      5b4bd24d6240f467bfbc74803c9f15b0

      SHA1

      c17f98c182d299845c54069872e8137645768a1a

      SHA256

      14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e

      SHA512

      a896acc38a6ff9641b0803f0598369c0d4fa8e38da28c1653c57948fe5e3274880d1b2e7959cd1b1da43375a1318b3ba72e13240bf40b27c852ee72bbb16cadc

    • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin1.exe
      MD5

      5b4bd24d6240f467bfbc74803c9f15b0

      SHA1

      c17f98c182d299845c54069872e8137645768a1a

      SHA256

      14c7bec7369d4175c6d92554b033862b3847ff98a04dfebdf9f5bb30180ed13e

      SHA512

      a896acc38a6ff9641b0803f0598369c0d4fa8e38da28c1653c57948fe5e3274880d1b2e7959cd1b1da43375a1318b3ba72e13240bf40b27c852ee72bbb16cadc

    • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin2.exe
      MD5

      996ba35165bb62473d2a6743a5200d45

      SHA1

      52169b0b5cce95c6905873b8d12a759c234bd2e0

      SHA256

      5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d

      SHA512

      2a7fb9bdf8dcf577ac851752f8875a710a3694b99d107c397942fce1392fd99ee0b85f1fddc18c33fba56d7b8fd4dda5f40f28e64d8398e6048c2ab140780634

    • C:\Users\Admin\AppData\Local\44cde717-9628-4e13-bae3-ece2a76b9185\updatewin2.exe
      MD5

      996ba35165bb62473d2a6743a5200d45

      SHA1

      52169b0b5cce95c6905873b8d12a759c234bd2e0

      SHA256

      5caffdc76a562e098c471feaede5693f9ead92d5c6c10fb3951dd1fa6c12d21d

      SHA512

      2a7fb9bdf8dcf577ac851752f8875a710a3694b99d107c397942fce1392fd99ee0b85f1fddc18c33fba56d7b8fd4dda5f40f28e64d8398e6048c2ab140780634

    • C:\Users\Admin\AppData\Local\4fe3e0e5-53c8-4963-925e-cfe4b5cebd86\1bded6e2e06619dfaa85cadd6b4c85e7.exe
      MD5

      1bded6e2e06619dfaa85cadd6b4c85e7

      SHA1

      684e6799f7b400bba5d0f927c43cc13bb6398505

      SHA256

      8f4d8aa16d1bfe09808ce2c6b24c3ad550bc41643bc5624a9506c66873c172a8

      SHA512

      c2ad7271e5470af72c08c02e61687a1fb1d2be4dd213ac83bafa5efe582bc60d9eaa9977674d4fd751e964ea24935781f76bfbfa7d780809baa845aafbe7964a

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
      MD5

      13151583954f0def829054cc3eae25ec

      SHA1

      2a2b013e8d4201ddc8a80f9680931873702d0213

      SHA256

      eb542ae9c791940e8e74833eb50543dbbcbc8bf8485698fad82a8b079546c8a7

      SHA512

      3f7a6d0e5ca29de7b02f5cb993c508ce0c0df12c3d970a3ad6da95149b4cb5cc7a138e7ed6f83e910cb39120f199b3f74fc0ec1a14ca86435a52f247c2514aaf

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      MD5

      425f4397ff85518cc7cc06ee766f83f2

      SHA1

      9a400b52a682a176d0fb10a23a7783803d608624

      SHA256

      b7ae9a2cedcc6b3d8e1fe6d27be7faacce13e2edabfdffdd48c1aa92d67ad6b5

      SHA512

      d6ef6681c0662db1c2511d2ef1ecba0113b7a1f25c628ad31c9e44976cbf84c1f84e82b0abbd96f3811f9f01672335e82c0b4c2a702c42fe47bc3e33915467ab

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      MD5

      97f61aac85d5eaad21e74192a36cc799

      SHA1

      4031a9d61ec6951ecca8a9be4d94812382d41337

      SHA256

      322783a6af0809051362a9dc00f2c596b1447d825a1878c6838acd9107253f79

      SHA512

      e46bf1b65ed43c2fde89ed52d545bc13881a3463348b82162b8bd1f5533db4c51abdab7dd9ad8c8805558843b76bb1b2b671c14809ce222c89e4c35b115950d2

    • C:\Users\Admin\AppData\Local\Temp\delself.bat
      MD5

      5d8c069a9839710a9f9bc3df1d3b2bdd

      SHA1

      f6cc5627ca5a5701f5edea6f298cc6d9f3910aea

      SHA256

      7dad479c98288ee06f2d6d5c4f876b65681d244707b3039a212d25798a87a47d

      SHA512

      8c83804e1fe3653a45dedf64a628b9aea9fb5a3ce3f1db3f4a730ad324c27c0571f77be2ce549a6bc2180cdbb00af52b2d67bedc4a35eef3f135de4d7ab52a40

    • C:\Users\Admin\AppData\Local\script.ps1
      MD5

      f972c62f986b5ed49ad7713d93bf6c9f

      SHA1

      4e157002bdb97e9526ab97bfafbf7c67e1d1efbf

      SHA256

      b47f85974a7ec2fd5aa82d52f08eb0f6cea7e596a98dd29e8b85b5c37beca0a8

      SHA512

      2c9e2e1b8b6cb5ffe3edf5dfbc2c3b917cd15ba6a5e5264207a43b02ce7020f44f5088aca195f7b428699f0d6bd693ce557a0227d67bbb4795e350a97314e9c4

    • \ProgramData\mozglue.dll
      MD5

      8f73c08a9660691143661bf7332c3c27

      SHA1

      37fa65dd737c50fda710fdbde89e51374d0c204a

      SHA256

      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

      SHA512

      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

    • \ProgramData\nss3.dll
      MD5

      bfac4e3c5908856ba17d41edcd455a51

      SHA1

      8eec7e888767aa9e4cca8ff246eb2aacb9170428

      SHA256

      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

      SHA512

      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

    • memory/204-118-0x0000000000000000-mapping.dmp
    • memory/204-124-0x0000000000400000-0x00000000008C7000-memory.dmp
      Filesize

      4.8MB

    • memory/576-116-0x0000000000000000-mapping.dmp
    • memory/804-228-0x0000000000000000-mapping.dmp
    • memory/808-114-0x0000000002690000-0x00000000027AA000-memory.dmp
      Filesize

      1.1MB

    • memory/808-142-0x0000000000000000-mapping.dmp
    • memory/808-115-0x0000000000400000-0x00000000008C7000-memory.dmp
      Filesize

      4.8MB

    • memory/1448-229-0x0000000000000000-mapping.dmp
    • memory/2136-146-0x0000000000400000-0x000000000044D000-memory.dmp
      Filesize

      308KB

    • memory/2136-138-0x0000000000000000-mapping.dmp
    • memory/2164-143-0x0000000000000000-mapping.dmp
    • memory/2164-232-0x0000000004990000-0x0000000004991000-memory.dmp
      Filesize

      4KB

    • memory/2164-233-0x0000000004992000-0x0000000004993000-memory.dmp
      Filesize

      4KB

    • memory/2164-227-0x0000000000000000-mapping.dmp
    • memory/2164-236-0x000000007F1E0000-0x000000007F1E1000-memory.dmp
      Filesize

      4KB

    • memory/2164-237-0x0000000004993000-0x0000000004994000-memory.dmp
      Filesize

      4KB

    • memory/2228-135-0x0000000000400000-0x00000000004B4000-memory.dmp
      Filesize

      720KB

    • memory/2228-131-0x0000000000000000-mapping.dmp
    • memory/2228-134-0x0000000000520000-0x00000000005CE000-memory.dmp
      Filesize

      696KB

    • memory/2888-128-0x0000000000000000-mapping.dmp
    • memory/2888-141-0x0000000000400000-0x000000000044D000-memory.dmp
      Filesize

      308KB

    • memory/3156-153-0x0000000007820000-0x0000000007821000-memory.dmp
      Filesize

      4KB

    • memory/3156-150-0x0000000007860000-0x0000000007861000-memory.dmp
      Filesize

      4KB

    • memory/3156-158-0x0000000008AC0000-0x0000000008AC1000-memory.dmp
      Filesize

      4KB

    • memory/3156-173-0x0000000009660000-0x0000000009693000-memory.dmp
      Filesize

      204KB

    • memory/3156-180-0x0000000009640000-0x0000000009641000-memory.dmp
      Filesize

      4KB

    • memory/3156-185-0x00000000099D0000-0x00000000099D1000-memory.dmp
      Filesize

      4KB

    • memory/3156-186-0x0000000009B80000-0x0000000009B81000-memory.dmp
      Filesize

      4KB

    • memory/3156-187-0x000000007EDC0000-0x000000007EDC1000-memory.dmp
      Filesize

      4KB

    • memory/3156-188-0x0000000007223000-0x0000000007224000-memory.dmp
      Filesize

      4KB

    • memory/3156-145-0x0000000000000000-mapping.dmp
    • memory/3156-157-0x00000000084A0000-0x00000000084A1000-memory.dmp
      Filesize

      4KB

    • memory/3156-156-0x00000000080E0000-0x00000000080E1000-memory.dmp
      Filesize

      4KB

    • memory/3156-149-0x0000000005110000-0x0000000005111000-memory.dmp
      Filesize

      4KB

    • memory/3156-159-0x0000000008910000-0x0000000008911000-memory.dmp
      Filesize

      4KB

    • memory/3156-224-0x0000000007226000-0x0000000007228000-memory.dmp
      Filesize

      8KB

    • memory/3156-155-0x0000000008070000-0x0000000008071000-memory.dmp
      Filesize

      4KB

    • memory/3156-154-0x0000000007F00000-0x0000000007F01000-memory.dmp
      Filesize

      4KB

    • memory/3156-152-0x0000000007222000-0x0000000007223000-memory.dmp
      Filesize

      4KB

    • memory/3156-151-0x0000000007220000-0x0000000007221000-memory.dmp
      Filesize

      4KB

    • memory/3876-140-0x0000000000400000-0x000000000044D000-memory.dmp
      Filesize

      308KB

    • memory/3876-125-0x0000000000000000-mapping.dmp
    • memory/4012-144-0x0000000000000000-mapping.dmp
    • memory/4068-226-0x0000000006E42000-0x0000000006E43000-memory.dmp
      Filesize

      4KB

    • memory/4068-231-0x0000000006E43000-0x0000000006E44000-memory.dmp
      Filesize

      4KB

    • memory/4068-225-0x0000000006E40000-0x0000000006E41000-memory.dmp
      Filesize

      4KB

    • memory/4068-221-0x0000000000000000-mapping.dmp