djvu | 91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49

Analysis

max time kernel
145s
max time network
152s
platform
windows10_x64
resource
win10v20210408
submitted
26-08-2021 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
Size

721KB
MD5

92baa6d072d591b827950b6bc4730057
SHA1

17e968a7d200a75fcec9b6967bd635d8633405d9
SHA256

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49
SHA512

21cd5c7c535b333c6e7297f0edb1d03cad96c24114d3318b6943c0af57c81e2486c6056103617222c3c7650ce666945c7fb4080947ae4946219acf229cd3f0da

Score

10^/10

djvu vidar 517 discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\_readme.txt

Family

djvu

Ransom Note

ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ykQaS2tRyB Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0328gDrgoC4j04vLx6lqyFlyzpTC55w9igCGDgaBYLhUjv3Rr

Emails

[email protected]

URLs

https://we.tl/t-ykQaS2tRyB

Extracted

Family

vidar

Version

40.1

Botnet

517

https://eduarroma.tumblr.com/

Attributes

profile_id
517

Signatures

Detected Djvu ransomeware 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3148-114-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3148-115-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/900-116-0x0000000004AB0000-0x0000000004BCB000-memory.dmp	family_djvu
behavioral1/memory/3148-117-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3832-122-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/3832-127-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/644-169-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/644-171-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1824-132-0x000000000046B77D-mapping.dmp	family_vidar
behavioral1/memory/1824-131-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral1/memory/1824-135-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral1/memory/3464-134-0x0000000002480000-0x000000000252E000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

Processes:

build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exe91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

pid	process
3464	build2.exe
1824	build2.exe
1924	build3.exe
4064	build3.exe
508	mstsca.exe
3820	mstsca.exe
564	mstsca.exe
2208	mstsca.exe
2384	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
644	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

Modifies extensions of user files 6 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ExportWrite.crw => C:\Users\Admin\Pictures\ExportWrite.crw.orkf	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
File renamed	C:\Users\Admin\Pictures\RenameUse.crw => C:\Users\Admin\Pictures\RenameUse.crw.orkf	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
File renamed	C:\Users\Admin\Pictures\ShowStep.tif => C:\Users\Admin\Pictures\ShowStep.tif.orkf	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
File renamed	C:\Users\Admin\Pictures\TestRestore.tif => C:\Users\Admin\Pictures\TestRestore.tif.orkf	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
File renamed	C:\Users\Admin\Pictures\ConvertFromStop.raw => C:\Users\Admin\Pictures\ConvertFromStop.raw.orkf	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
File renamed	C:\Users\Admin\Pictures\DenyRevoke.crw => C:\Users\Admin\Pictures\DenyRevoke.crw.orkf	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

Loads dropped DLL 2 IoCs

Processes:

build2.exe

pid process

1824 build2.exe
1824 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2936 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1824	build2.exe
1824	build2.exe

pid	process
2936	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c1df307e-a78e-414f-86dc-9441c03b3e34\\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe\" --AutoStart"	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 api.2ip.ua
11 api.2ip.ua
22 api.2ip.ua
39 api.2ip.ua

flow	ioc
10	api.2ip.ua
11	api.2ip.ua
22	api.2ip.ua
39	api.2ip.ua

Suspicious use of SetThreadContext 7 IoCs

Processes:

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exebuild2.exebuild3.exemstsca.exemstsca.exe91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

description	pid	process	target process
PID 900 set thread context of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 set thread context of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 3464 set thread context of 1824	3464	build2.exe	build2.exe
PID 1924 set thread context of 4064	1924	build3.exe	build3.exe
PID 508 set thread context of 3820	508	mstsca.exe	mstsca.exe
PID 564 set thread context of 2208	564	mstsca.exe	mstsca.exe
PID 2384 set thread context of 644	2384	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

build2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3812 schtasks.exe
3480 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

4080 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

716 taskkill.exe

pid	process
3812	schtasks.exe
3480	schtasks.exe

pid	process
4080	timeout.exe

pid	process
716	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exebuild2.exe91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

pid	process
3148	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
3148	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
1824	build2.exe
1824	build2.exe
1824	build2.exe
1824	build2.exe
1824	build2.exe
1824	build2.exe
1824	build2.exe
1824	build2.exe
3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
644	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
644	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 716 taskkill.exe

description	pid	process
Token: SeDebugPrivilege	716	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exebuild2.exebuild3.exebuild3.exebuild2.execmd.exemstsca.exe

description	pid	process	target process
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 900 wrote to memory of 3148	900	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 3148 wrote to memory of 2936	3148	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	icacls.exe
PID 3148 wrote to memory of 2936	3148	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	icacls.exe
PID 3148 wrote to memory of 2936	3148	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	icacls.exe
PID 3148 wrote to memory of 1352	3148	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 3148 wrote to memory of 1352	3148	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 3148 wrote to memory of 1352	3148	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 1352 wrote to memory of 3832	1352	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
PID 3832 wrote to memory of 3464	3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	build2.exe
PID 3832 wrote to memory of 3464	3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	build2.exe
PID 3832 wrote to memory of 3464	3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	build2.exe
PID 3464 wrote to memory of 1824	3464	build2.exe	build2.exe
PID 3464 wrote to memory of 1824	3464	build2.exe	build2.exe
PID 3464 wrote to memory of 1824	3464	build2.exe	build2.exe
PID 3464 wrote to memory of 1824	3464	build2.exe	build2.exe
PID 3464 wrote to memory of 1824	3464	build2.exe	build2.exe
PID 3464 wrote to memory of 1824	3464	build2.exe	build2.exe
PID 3464 wrote to memory of 1824	3464	build2.exe	build2.exe
PID 3464 wrote to memory of 1824	3464	build2.exe	build2.exe
PID 3832 wrote to memory of 1924	3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	build3.exe
PID 3832 wrote to memory of 1924	3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	build3.exe
PID 3832 wrote to memory of 1924	3832	91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe	build3.exe
PID 1924 wrote to memory of 4064	1924	build3.exe	build3.exe
PID 1924 wrote to memory of 4064	1924	build3.exe	build3.exe
PID 1924 wrote to memory of 4064	1924	build3.exe	build3.exe
PID 1924 wrote to memory of 4064	1924	build3.exe	build3.exe
PID 1924 wrote to memory of 4064	1924	build3.exe	build3.exe
PID 1924 wrote to memory of 4064	1924	build3.exe	build3.exe
PID 1924 wrote to memory of 4064	1924	build3.exe	build3.exe
PID 1924 wrote to memory of 4064	1924	build3.exe	build3.exe
PID 1924 wrote to memory of 4064	1924	build3.exe	build3.exe
PID 4064 wrote to memory of 3812	4064	build3.exe	schtasks.exe
PID 4064 wrote to memory of 3812	4064	build3.exe	schtasks.exe
PID 4064 wrote to memory of 3812	4064	build3.exe	schtasks.exe
PID 1824 wrote to memory of 192	1824	build2.exe	cmd.exe
PID 1824 wrote to memory of 192	1824	build2.exe	cmd.exe
PID 1824 wrote to memory of 192	1824	build2.exe	cmd.exe
PID 192 wrote to memory of 716	192	cmd.exe	taskkill.exe
PID 192 wrote to memory of 716	192	cmd.exe	taskkill.exe
PID 192 wrote to memory of 716	192	cmd.exe	taskkill.exe
PID 192 wrote to memory of 4080	192	cmd.exe	timeout.exe
PID 192 wrote to memory of 4080	192	cmd.exe	timeout.exe
PID 192 wrote to memory of 4080	192	cmd.exe	timeout.exe
PID 508 wrote to memory of 3820	508	mstsca.exe	mstsca.exe
PID 508 wrote to memory of 3820	508	mstsca.exe	mstsca.exe
PID 508 wrote to memory of 3820	508	mstsca.exe	mstsca.exe

C:\Users\Admin\AppData\Local\Temp\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
"C:\Users\Admin\AppData\Local\Temp\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
  "C:\Users\Admin\AppData\Local\Temp\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\c1df307e-a78e-414f-86dc-9441c03b3e34" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
    "C:\Users\Admin\AppData\Local\Temp\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Users\Admin\AppData\Local\Temp\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
      "C:\Users\Admin\AppData\Local\Temp\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Modifies extensions of user files
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3832
    - - C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build2.exe
        
        "C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3464
      - C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build2.exe
        
        "C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build2.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build2.exe" & del C:\ProgramData\*.dll & exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:192
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im build2.exe /f
        8⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:716
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        8⤵
        Delays execution with timeout.exe
        
        PID:4080
    - - C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build3.exe
        
        "C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1924
      - C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build3.exe
        
        "C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build3.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:3812

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    3⤵
    - Creates scheduled task(s)
    PID:3480

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:564
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  PID:2208

C:\Users\Admin\AppData\Local\c1df307e-a78e-414f-86dc-9441c03b3e34\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
C:\Users\Admin\AppData\Local\c1df307e-a78e-414f-86dc-9441c03b3e34\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe --Task
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2384
- C:\Users\Admin\AppData\Local\c1df307e-a78e-414f-86dc-9441c03b3e34\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe
  C:\Users\Admin\AppData\Local\c1df307e-a78e-414f-86dc-9441c03b3e34\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe --Task
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\freebl3.dll

MD5
ef2834ac4ee7d6724f255beaf527e635

SHA1
5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

SHA256
a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

SHA512
c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

Download Submit
C:\ProgramData\mozglue.dll

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\msvcp140.dll

MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\ProgramData\nss3.dll

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\ProgramData\softokn3.dll

MD5
a2ee53de9167bf0d6c019303b7ca84e5

SHA1
2a3c737fa1157e8483815e98b666408a18c0db42

SHA256
43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

SHA512
45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

Download Submit
C:\ProgramData\vcruntime140.dll

MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\SystemID\PersonalID.txt

MD5
8474f339727595fd2745c1d18940779c

SHA1
7b1b7e2f685b0a6f07ef3e915c2d130aacc11ae0

SHA256
86e446b2f237d8e05d4ac17d4e90a7709471eaaf62ae2c0a5afe0edc68b328fd

SHA512
ad218614bfcca02ff26b95d527384590c2f4c8537d10f691880e8fd61378e9f12040a5f57aec416b96e4a2f39e569614ca555db2e27493b52acb14c0a5828b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5
464fde229f537718853614c06e30b9c9

SHA1
b10380895677fb5b100b18524b33b8b8e351e77a

SHA256
f60ff54618115cbf8d3b494ecf912ed647e09bff7cc0dff80f304d9f7051badc

SHA512
9198123686dc351e91373b9bcabe20e5ab6e55aa37ada6e0ccdb396f23f0cb1e814fea55e7a234b4bf15f8da50517bd9fa95aaaef66b0a4b18ef0f26d2f6714b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5
c666571cee2bfa75d13073f6a38718bd

SHA1
f78e3cd32b11d662c241518b3e608499ea8b0784

SHA256
dc46ca8ba3fafcf14ad91b267401a7f85188329423d564c9e0348379b533b2aa

SHA512
388263b6917d478ce2bed8b45aa2974fa9aa51776eee6ad5ec08b38b70442874b153c86797723e59bb8871ab574ed7120e097ce9000b7e12cc3802d53ea6f5f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5
f8927df1af2ab509021dd437bf8c5aa6

SHA1
945da91affbba41dbef8371cf4c88b9f857aa2db

SHA256
22413c0f3b2b601c0c25243621004801622283d4f0eae448838fdec2c784b3f7

SHA512
dd84be3a2706238436c9b2d0646722394b80fced99ddedb97d78a4c5f9dc767cfb2e264359115c335327294aca181a2f6550b4ff1ed0e75feb1dacc350acc268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5
6a6ea9b3aa867964ae070dcce515b3f1

SHA1
2382d6749c475364f2bd93b8f1e3c6782a4d8c2f

SHA256
2cae3ee7b49b3986ff31f044e895cf1f083fe9b8d8c2b18304f29f6c4fb2b79d

SHA512
00f2dd36a924d611ddef78df030baec6e7afd00df95d508e1bc1995200aa4c98508d0b5f5e297ec8c6c14f43aa9a86c80a0a4d50b2a570d66ae87dc98ba2a799

Download Submit
C:\Users\Admin\AppData\Local\bowsakkdestx.txt

MD5
7a988d317a6f561ace91befbe61a902d

SHA1
55549400d43690b302a8281124286a4204ab77b5

SHA256
631392ac6c344e98e902b643a02ebfd758788aae49ee6a539663c504507e5667

SHA512
71eba1ba3671b63425ab3c72c70bbde8eb2e3d419cd47c40fc796117da71ff195ea264f45ade9b8a644ab917e5190032e699dc16e50c986140cffac4e39f30f2

Download Submit
C:\Users\Admin\AppData\Local\c1df307e-a78e-414f-86dc-9441c03b3e34\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

MD5
92baa6d072d591b827950b6bc4730057

SHA1
17e968a7d200a75fcec9b6967bd635d8633405d9

SHA256
91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49

SHA512
21cd5c7c535b333c6e7297f0edb1d03cad96c24114d3318b6943c0af57c81e2486c6056103617222c3c7650ce666945c7fb4080947ae4946219acf229cd3f0da

Download Submit
C:\Users\Admin\AppData\Local\c1df307e-a78e-414f-86dc-9441c03b3e34\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

MD5
92baa6d072d591b827950b6bc4730057

SHA1
17e968a7d200a75fcec9b6967bd635d8633405d9

SHA256
91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49

SHA512
21cd5c7c535b333c6e7297f0edb1d03cad96c24114d3318b6943c0af57c81e2486c6056103617222c3c7650ce666945c7fb4080947ae4946219acf229cd3f0da

Download Submit
C:\Users\Admin\AppData\Local\c1df307e-a78e-414f-86dc-9441c03b3e34\91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49.exe

MD5
92baa6d072d591b827950b6bc4730057

SHA1
17e968a7d200a75fcec9b6967bd635d8633405d9

SHA256
91e437e7ba475e248127177f79b578bc0f73cd9ec8fd2eb9d380eea88e939f49

SHA512
21cd5c7c535b333c6e7297f0edb1d03cad96c24114d3318b6943c0af57c81e2486c6056103617222c3c7650ce666945c7fb4080947ae4946219acf229cd3f0da

Download Submit
C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build2.exe

MD5
18c960230dd536a0d62f98d6ec723ff0

SHA1
ab8b12d852f35deb702a0e92c18099fa08af04e1

SHA256
381b93b17fc27fb2e22ed16f1ed5724b1b8adc5be8cbe996950949c01c6fa3b4

SHA512
3de9421f26c1aa7120bb5740ea50599c473e3b7f1e76e1a201505c57908320690643c65d0f971a30c992984b28ade9a6fad7f4bc3a34a9e954ac888995404fd4

Download Submit
C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build2.exe

MD5
18c960230dd536a0d62f98d6ec723ff0

SHA1
ab8b12d852f35deb702a0e92c18099fa08af04e1

SHA256
381b93b17fc27fb2e22ed16f1ed5724b1b8adc5be8cbe996950949c01c6fa3b4

SHA512
3de9421f26c1aa7120bb5740ea50599c473e3b7f1e76e1a201505c57908320690643c65d0f971a30c992984b28ade9a6fad7f4bc3a34a9e954ac888995404fd4

Download Submit
C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build2.exe

MD5
18c960230dd536a0d62f98d6ec723ff0

SHA1
ab8b12d852f35deb702a0e92c18099fa08af04e1

SHA256
381b93b17fc27fb2e22ed16f1ed5724b1b8adc5be8cbe996950949c01c6fa3b4

SHA512
3de9421f26c1aa7120bb5740ea50599c473e3b7f1e76e1a201505c57908320690643c65d0f971a30c992984b28ade9a6fad7f4bc3a34a9e954ac888995404fd4

Download Submit
C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build3.exe

MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build3.exe

MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Local\d6e72f6e-67c6-4b14-aeac-e35e85c271f3\build3.exe

MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
\ProgramData\mozglue.dll

MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll

MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
memory/192-147-0x0000000000000000-mapping.dmp

Download
memory/508-162-0x00000000032A0000-0x00000000032A4000-memory.dmp

Filesize
16KB

Download
memory/644-169-0x0000000000424141-mapping.dmp

Download
memory/644-171-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/716-148-0x0000000000000000-mapping.dmp

Download
memory/900-116-0x0000000004AB0000-0x0000000004BCB000-memory.dmp

Filesize
1.1MB

Download
memory/1352-120-0x0000000000000000-mapping.dmp

Download
memory/1824-132-0x000000000046B77D-mapping.dmp

Download
memory/1824-131-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1824-135-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1924-142-0x0000000003250000-0x00000000032FE000-memory.dmp

Filesize
696KB

Download
memory/1924-136-0x0000000000000000-mapping.dmp

Download
memory/2208-165-0x0000000000401AFA-mapping.dmp

Download
memory/2936-118-0x0000000000000000-mapping.dmp

Download
memory/3148-115-0x0000000000424141-mapping.dmp

Download
memory/3148-114-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3148-117-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3464-128-0x0000000000000000-mapping.dmp

Download
memory/3464-134-0x0000000002480000-0x000000000252E000-memory.dmp

Filesize
696KB

Download
memory/3480-161-0x0000000000000000-mapping.dmp

Download
memory/3812-144-0x0000000000000000-mapping.dmp

Download
memory/3820-159-0x0000000000401AFA-mapping.dmp

Download
memory/3832-127-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3832-122-0x0000000000424141-mapping.dmp

Download
memory/4064-143-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4064-139-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4064-140-0x0000000000401AFA-mapping.dmp

Download
memory/4080-149-0x0000000000000000-mapping.dmp

Download