djvu | 01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b

Analysis

max time kernel
144s
max time network
157s
platform
windows10_x64
resource
win10v20210408
submitted
26-08-2021 01:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
Size

722KB
MD5

55c13e0408310276dcb7a5356262a987
SHA1

d7d15e0d6298572a83a26ee67bf5488b93cabb05
SHA256

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b
SHA512

52ac50b3c74d827dce52d44b2f47fbf24a4f5b9eedb32bb5e1126acf49cfb5bc4946cb4259b868d22b934524b0e84553a8df5b688acee1e750180e014fee27b1

Score

10^/10

djvu vidar 517 discovery persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\_readme.txt

Family

djvu

Ransom Note

ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ykQaS2tRyB Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: managerhelper@airmail.cc Your personal ID: 0328gDrgoC4j04vLx6lqyFlyzpTC55w9igCGDgaBYLhUjv3Rr

Emails

manager@mailtemp.ch

managerhelper@airmail.cc

URLs

https://we.tl/t-ykQaS2tRyB

Extracted

Family

vidar

Version

40.1

Botnet

517

https://eduarroma.tumblr.com/

Attributes

profile_id
517

Signatures

Detected Djvu ransomeware 8 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3128-114-0x0000000004B80000-0x0000000004C9B000-memory.dmp	family_djvu
behavioral1/memory/2916-115-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2916-116-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/2916-117-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2072-122-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/2072-127-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2080-169-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/2080-173-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1296-131-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral1/memory/1296-132-0x000000000046B77D-mapping.dmp	family_vidar
behavioral1/memory/2300-134-0x0000000002670000-0x000000000270E000-memory.dmp	family_vidar
behavioral1/memory/1296-135-0x0000000000400000-0x00000000004A1000-memory.dmp	family_vidar
behavioral1/memory/2188-145-0x0000000003250000-0x00000000032FE000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

Processes:

build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exe01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

pid	process
2300	build2.exe
1296	build2.exe
2188	build3.exe
1732	build3.exe
3936	mstsca.exe
3788	mstsca.exe
4040	mstsca.exe
1640	mstsca.exe
1736	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
2080	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

Modifies extensions of user files 8 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\ConvertToUnregister.png => C:\Users\Admin\Pictures\ConvertToUnregister.png.orkf	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
File opened for modification	C:\Users\Admin\Pictures\DisableClose.tiff	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
File renamed	C:\Users\Admin\Pictures\DisableClose.tiff => C:\Users\Admin\Pictures\DisableClose.tiff.orkf	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
File renamed	C:\Users\Admin\Pictures\ReceiveCompress.tif => C:\Users\Admin\Pictures\ReceiveCompress.tif.orkf	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
File opened for modification	C:\Users\Admin\Pictures\RenameRemove.tiff	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
File renamed	C:\Users\Admin\Pictures\RenameRemove.tiff => C:\Users\Admin\Pictures\RenameRemove.tiff.orkf	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
File opened for modification	C:\Users\Admin\Pictures\StepGroup.tiff	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
File renamed	C:\Users\Admin\Pictures\StepGroup.tiff => C:\Users\Admin\Pictures\StepGroup.tiff.orkf	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

Loads dropped DLL 2 IoCs

Processes:

build2.exe

pid process

1296 build2.exe
1296 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

928 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1296	build2.exe
1296	build2.exe

pid	process
928	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8bcc96f3-0c3c-411c-a05a-cbc01bf3e7d9\\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe\" --AutoStart"	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 api.2ip.ua
19 api.2ip.ua
36 api.2ip.ua
8 api.2ip.ua

flow	ioc
9	api.2ip.ua
19	api.2ip.ua
36	api.2ip.ua
8	api.2ip.ua

Suspicious use of SetThreadContext 7 IoCs

Processes:

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exebuild2.exebuild3.exemstsca.exemstsca.exe01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

description	pid	process	target process
PID 3128 set thread context of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 set thread context of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 2300 set thread context of 1296	2300	build2.exe	build2.exe
PID 2188 set thread context of 1732	2188	build3.exe	build3.exe
PID 3936 set thread context of 3788	3936	mstsca.exe	mstsca.exe
PID 4040 set thread context of 1640	4040	mstsca.exe	mstsca.exe
PID 1736 set thread context of 2080	1736	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

build2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2136 schtasks.exe
1260 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1184 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2204 taskkill.exe

pid	process
2136	schtasks.exe
1260	schtasks.exe

pid	process
1184	timeout.exe

pid	process
2204	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exebuild2.exe01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

pid	process
2916	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
2916	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
1296	build2.exe
1296	build2.exe
1296	build2.exe
1296	build2.exe
1296	build2.exe
1296	build2.exe
1296	build2.exe
1296	build2.exe
2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
2080	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
2080	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2204 taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2204	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exebuild2.exebuild3.exebuild3.exebuild2.execmd.exemstsca.exe

description	pid	process	target process
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3128 wrote to memory of 2916	3128	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 2916 wrote to memory of 928	2916	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	icacls.exe
PID 2916 wrote to memory of 928	2916	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	icacls.exe
PID 2916 wrote to memory of 928	2916	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	icacls.exe
PID 2916 wrote to memory of 3724	2916	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 2916 wrote to memory of 3724	2916	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 2916 wrote to memory of 3724	2916	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 3724 wrote to memory of 2072	3724	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
PID 2072 wrote to memory of 2300	2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	build2.exe
PID 2072 wrote to memory of 2300	2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	build2.exe
PID 2072 wrote to memory of 2300	2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	build2.exe
PID 2300 wrote to memory of 1296	2300	build2.exe	build2.exe
PID 2300 wrote to memory of 1296	2300	build2.exe	build2.exe
PID 2300 wrote to memory of 1296	2300	build2.exe	build2.exe
PID 2300 wrote to memory of 1296	2300	build2.exe	build2.exe
PID 2300 wrote to memory of 1296	2300	build2.exe	build2.exe
PID 2300 wrote to memory of 1296	2300	build2.exe	build2.exe
PID 2300 wrote to memory of 1296	2300	build2.exe	build2.exe
PID 2300 wrote to memory of 1296	2300	build2.exe	build2.exe
PID 2072 wrote to memory of 2188	2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	build3.exe
PID 2072 wrote to memory of 2188	2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	build3.exe
PID 2072 wrote to memory of 2188	2072	01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe	build3.exe
PID 2188 wrote to memory of 1732	2188	build3.exe	build3.exe
PID 2188 wrote to memory of 1732	2188	build3.exe	build3.exe
PID 2188 wrote to memory of 1732	2188	build3.exe	build3.exe
PID 2188 wrote to memory of 1732	2188	build3.exe	build3.exe
PID 2188 wrote to memory of 1732	2188	build3.exe	build3.exe
PID 2188 wrote to memory of 1732	2188	build3.exe	build3.exe
PID 2188 wrote to memory of 1732	2188	build3.exe	build3.exe
PID 2188 wrote to memory of 1732	2188	build3.exe	build3.exe
PID 2188 wrote to memory of 1732	2188	build3.exe	build3.exe
PID 1732 wrote to memory of 2136	1732	build3.exe	schtasks.exe
PID 1732 wrote to memory of 2136	1732	build3.exe	schtasks.exe
PID 1732 wrote to memory of 2136	1732	build3.exe	schtasks.exe
PID 1296 wrote to memory of 2624	1296	build2.exe	cmd.exe
PID 1296 wrote to memory of 2624	1296	build2.exe	cmd.exe
PID 1296 wrote to memory of 2624	1296	build2.exe	cmd.exe
PID 2624 wrote to memory of 2204	2624	cmd.exe	taskkill.exe
PID 2624 wrote to memory of 2204	2624	cmd.exe	taskkill.exe
PID 2624 wrote to memory of 2204	2624	cmd.exe	taskkill.exe
PID 2624 wrote to memory of 1184	2624	cmd.exe	timeout.exe
PID 2624 wrote to memory of 1184	2624	cmd.exe	timeout.exe
PID 2624 wrote to memory of 1184	2624	cmd.exe	timeout.exe
PID 3936 wrote to memory of 3788	3936	mstsca.exe	mstsca.exe
PID 3936 wrote to memory of 3788	3936	mstsca.exe	mstsca.exe
PID 3936 wrote to memory of 3788	3936	mstsca.exe	mstsca.exe

C:\Users\Admin\AppData\Local\Temp\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
"C:\Users\Admin\AppData\Local\Temp\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3128

C:\Users\Admin\AppData\Local\Temp\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
"C:\Users\Admin\AppData\Local\Temp\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe"
2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\8bcc96f3-0c3c-411c-a05a-cbc01bf3e7d9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:928

C:\Users\Admin\AppData\Local\Temp\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
"C:\Users\Admin\AppData\Local\Temp\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3724

C:\Users\Admin\AppData\Local\Temp\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
"C:\Users\Admin\AppData\Local\Temp\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Modifies extensions of user files
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072

C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build2.exe
"C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2300

C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build2.exe
"C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build2.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1296

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build2.exe" & del C:\ProgramData\*.dll & exit
7⤵
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:1184

C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build3.exe
"C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build3.exe
"C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:2136

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3936

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:3788

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
3⤵
- Creates scheduled task(s)
PID:1260

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4040

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:1640

C:\Users\Admin\AppData\Local\8bcc96f3-0c3c-411c-a05a-cbc01bf3e7d9\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
C:\Users\Admin\AppData\Local\8bcc96f3-0c3c-411c-a05a-cbc01bf3e7d9\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe --Task
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1736

C:\Users\Admin\AppData\Local\8bcc96f3-0c3c-411c-a05a-cbc01bf3e7d9\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
C:\Users\Admin\AppData\Local\8bcc96f3-0c3c-411c-a05a-cbc01bf3e7d9\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe --Task
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2080

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File Permissions Modification

T1222

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\freebl3.dll
MD5
ef2834ac4ee7d6724f255beaf527e635

SHA1
5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

SHA256
a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

SHA512
c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

Download Submit
C:\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\msvcp140.dll
MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\ProgramData\softokn3.dll
MD5
a2ee53de9167bf0d6c019303b7ca84e5

SHA1
2a3c737fa1157e8483815e98b666408a18c0db42

SHA256
43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

SHA512
45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

Download Submit
C:\ProgramData\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\SystemID\PersonalID.txt
MD5
8474f339727595fd2745c1d18940779c

SHA1
7b1b7e2f685b0a6f07ef3e915c2d130aacc11ae0

SHA256
86e446b2f237d8e05d4ac17d4e90a7709471eaaf62ae2c0a5afe0edc68b328fd

SHA512
ad218614bfcca02ff26b95d527384590c2f4c8537d10f691880e8fd61378e9f12040a5f57aec416b96e4a2f39e569614ca555db2e27493b52acb14c0a5828b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
464fde229f537718853614c06e30b9c9

SHA1
b10380895677fb5b100b18524b33b8b8e351e77a

SHA256
f60ff54618115cbf8d3b494ecf912ed647e09bff7cc0dff80f304d9f7051badc

SHA512
9198123686dc351e91373b9bcabe20e5ab6e55aa37ada6e0ccdb396f23f0cb1e814fea55e7a234b4bf15f8da50517bd9fa95aaaef66b0a4b18ef0f26d2f6714b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
c666571cee2bfa75d13073f6a38718bd

SHA1
f78e3cd32b11d662c241518b3e608499ea8b0784

SHA256
dc46ca8ba3fafcf14ad91b267401a7f85188329423d564c9e0348379b533b2aa

SHA512
388263b6917d478ce2bed8b45aa2974fa9aa51776eee6ad5ec08b38b70442874b153c86797723e59bb8871ab574ed7120e097ce9000b7e12cc3802d53ea6f5f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
f757c8f5002d7f9109d8a80005da9e03

SHA1
4d2ec1766ee16e318026416b0706eca010faff4c

SHA256
93250f42affa13fc0abb66cd7a03618ca9a433fb08f3f905cf11cfff6301a602

SHA512
a8da96ec8200b015f7a2c74023b874d978da8b69b7550585710a42d6d2f435a64aa17019324211d22b026782cf1fd8f5a8512b376c42dcb3b01f6803f5aacd6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
6feb0ee036db3e6c9db3e1958729fcce

SHA1
abf92dc33974d05524f560cd1507dedb3dfc45f5

SHA256
b21c5901aa6942d3a25d6b6f96998555ef0251446a2a7e8a0d38b92fea33a76b

SHA512
52927f63fffb4226071f369d5c47d59e424e2df295d778e1da303606e777c8bffecdb12c73bed35ea21253b32036c681561f1fbec1e8a5e83ed2e65765e4a3a6

Download Submit
C:\Users\Admin\AppData\Local\8bcc96f3-0c3c-411c-a05a-cbc01bf3e7d9\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
MD5
55c13e0408310276dcb7a5356262a987

SHA1
d7d15e0d6298572a83a26ee67bf5488b93cabb05

SHA256
01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b

SHA512
52ac50b3c74d827dce52d44b2f47fbf24a4f5b9eedb32bb5e1126acf49cfb5bc4946cb4259b868d22b934524b0e84553a8df5b688acee1e750180e014fee27b1

Download Submit
C:\Users\Admin\AppData\Local\8bcc96f3-0c3c-411c-a05a-cbc01bf3e7d9\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
MD5
55c13e0408310276dcb7a5356262a987

SHA1
d7d15e0d6298572a83a26ee67bf5488b93cabb05

SHA256
01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b

SHA512
52ac50b3c74d827dce52d44b2f47fbf24a4f5b9eedb32bb5e1126acf49cfb5bc4946cb4259b868d22b934524b0e84553a8df5b688acee1e750180e014fee27b1

Download Submit
C:\Users\Admin\AppData\Local\8bcc96f3-0c3c-411c-a05a-cbc01bf3e7d9\01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b.exe
MD5
55c13e0408310276dcb7a5356262a987

SHA1
d7d15e0d6298572a83a26ee67bf5488b93cabb05

SHA256
01f06c896c957dc5cd9450298c5503b20478b6b8728aed6f903ae7312dff501b

SHA512
52ac50b3c74d827dce52d44b2f47fbf24a4f5b9eedb32bb5e1126acf49cfb5bc4946cb4259b868d22b934524b0e84553a8df5b688acee1e750180e014fee27b1

Download Submit
C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build2.exe
MD5
18c960230dd536a0d62f98d6ec723ff0

SHA1
ab8b12d852f35deb702a0e92c18099fa08af04e1

SHA256
381b93b17fc27fb2e22ed16f1ed5724b1b8adc5be8cbe996950949c01c6fa3b4

SHA512
3de9421f26c1aa7120bb5740ea50599c473e3b7f1e76e1a201505c57908320690643c65d0f971a30c992984b28ade9a6fad7f4bc3a34a9e954ac888995404fd4

Download Submit
C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build2.exe
MD5
18c960230dd536a0d62f98d6ec723ff0

SHA1
ab8b12d852f35deb702a0e92c18099fa08af04e1

SHA256
381b93b17fc27fb2e22ed16f1ed5724b1b8adc5be8cbe996950949c01c6fa3b4

SHA512
3de9421f26c1aa7120bb5740ea50599c473e3b7f1e76e1a201505c57908320690643c65d0f971a30c992984b28ade9a6fad7f4bc3a34a9e954ac888995404fd4

Download Submit
C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build2.exe
MD5
18c960230dd536a0d62f98d6ec723ff0

SHA1
ab8b12d852f35deb702a0e92c18099fa08af04e1

SHA256
381b93b17fc27fb2e22ed16f1ed5724b1b8adc5be8cbe996950949c01c6fa3b4

SHA512
3de9421f26c1aa7120bb5740ea50599c473e3b7f1e76e1a201505c57908320690643c65d0f971a30c992984b28ade9a6fad7f4bc3a34a9e954ac888995404fd4

Download Submit
C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build3.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build3.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Local\befd9e9d-74eb-43e8-9df2-b867ca45cc0d\build3.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Local\bowsakkdestx.txt
MD5
7a988d317a6f561ace91befbe61a902d

SHA1
55549400d43690b302a8281124286a4204ab77b5

SHA256
631392ac6c344e98e902b643a02ebfd758788aae49ee6a539663c504507e5667

SHA512
71eba1ba3671b63425ab3c72c70bbde8eb2e3d419cd47c40fc796117da71ff195ea264f45ade9b8a644ab917e5190032e699dc16e50c986140cffac4e39f30f2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
memory/928-118-0x0000000000000000-mapping.dmp

Download
memory/1184-149-0x0000000000000000-mapping.dmp

Download
memory/1260-161-0x0000000000000000-mapping.dmp

Download
memory/1296-131-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1296-132-0x000000000046B77D-mapping.dmp

Download
memory/1296-135-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1640-165-0x0000000000401AFA-mapping.dmp

Download
memory/1732-146-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1732-142-0x0000000000401AFA-mapping.dmp

Download
memory/1732-141-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2072-127-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2072-122-0x0000000000424141-mapping.dmp

Download
memory/2080-173-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2080-169-0x0000000000424141-mapping.dmp

Download
memory/2136-144-0x0000000000000000-mapping.dmp

Download
memory/2188-136-0x0000000000000000-mapping.dmp

Download
memory/2188-145-0x0000000003250000-0x00000000032FE000-memory.dmp

Filesize
696KB

Download
memory/2204-148-0x0000000000000000-mapping.dmp

Download
memory/2300-134-0x0000000002670000-0x000000000270E000-memory.dmp

Filesize
632KB

Download
memory/2300-128-0x0000000000000000-mapping.dmp

Download
memory/2624-147-0x0000000000000000-mapping.dmp

Download
memory/2916-117-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2916-116-0x0000000000424141-mapping.dmp

Download
memory/2916-115-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3128-114-0x0000000004B80000-0x0000000004C9B000-memory.dmp

Filesize
1.1MB

Download
memory/3724-120-0x0000000000000000-mapping.dmp

Download
memory/3788-159-0x0000000000401AFA-mapping.dmp

Download
memory/3936-162-0x00000000032A0000-0x00000000032A4000-memory.dmp

Filesize
16KB

Download