djvu | 89e3b00acfc8b0904398665280312cf9a2b426db3eb77b2e5303131de48a2dde

Analysis

max time kernel
145s
max time network
147s
platform
windows10_x64
resource
win10-en-20210920
submitted
26-09-2021 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c7373ab965995304bd8b007f66ebad2.exe
Size

134KB
MD5

2c7373ab965995304bd8b007f66ebad2
SHA1

48a6f884b3a5fd51a371f900cbdb1b8651af72b4
SHA256

89e3b00acfc8b0904398665280312cf9a2b426db3eb77b2e5303131de48a2dde
SHA512

52f52a8c42f40fa6fab49cd303a310cd23513439e97e669b92aaec4a78baa60cebed9b66254770d1fcb6c5783e08d90422b17836ee7175effc0f935fa4cbea4e

Score

10^/10

djvu redline smokeloader vidar xmrig paladin backdoor discovery evasion infostealer miner persistence ransomware spyware stealer suricata themida trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://govsurplusstore.com/upload/

http://best-forsale.com/upload/

http://chmxnautoparts.com/upload/

http://kwazone.com/upload/

rc4.i32

Extracted

Family

redline

92.246.89.6:38437

Extracted

Family

redline

Botnet

paladin

94.26.228.204:32917

Signatures

Detected Djvu ransomware 6 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2716-122-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/2716-121-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2672-124-0x00000000022D0000-0x00000000023EB000-memory.dmp	family_djvu
behavioral2/memory/2716-125-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3672-131-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/3672-137-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/360-149-0x0000000002280000-0x00000000022B0000-memory.dmp	family_redline
behavioral2/memory/360-151-0x0000000002570000-0x000000000259E000-memory.dmp	family_redline
behavioral2/memory/1520-184-0x000000000041C5BA-mapping.dmp	family_redline
behavioral2/memory/1520-183-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral2/memory/1520-194-0x0000000004EF0000-0x00000000054F6000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/1672-145-0x00000000004A032D-mapping.dmp	family_vidar
behavioral2/memory/1672-144-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar
behavioral2/memory/4068-147-0x00000000030B0000-0x0000000003184000-memory.dmp	family_vidar
behavioral2/memory/1672-148-0x0000000000400000-0x00000000004D7000-memory.dmp	family_vidar

XMRig Miner Payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\ProgramData\Systemd\note3dll.exe	xmrig
C:\ProgramData\Systemd\note3dll.exe	xmrig

Downloads MZ/PE file

Executes dropped EXE 16 IoCs

Processes:

1975.exe1975.exe1975.exe1975.exe4066.exebuild2.exebuild2.exebuild3.exe5353.exebuild3.exe5353.exeNetFrame.exenote3dll.exeA2AD.exemstsca.exemstsca.exe

pid	process
2672	1975.exe
2716	1975.exe
1644	1975.exe
3672	1975.exe
360	4066.exe
4068	build2.exe
1672	build2.exe
3868	build3.exe
3960	5353.exe
3776	build3.exe
1520	5353.exe
964	NetFrame.exe
1072	note3dll.exe
4068	A2AD.exe
4016	mstsca.exe
2372	mstsca.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

A2AD.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	A2AD.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	A2AD.exe

Deletes itself 1 IoCs

Processes:

pid process

1588
Drops startup file 1 IoCs

Processes:

NetFrame.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk NetFrame.exe
Loads dropped DLL 2 IoCs

Processes:

build2.exe

pid process

1672 build2.exe
1672 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2292 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1588

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk	NetFrame.exe

pid	process
1672	build2.exe
1672	build2.exe

pid	process
2292	icacls.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\A2AD.exe	themida
behavioral2/memory/4068-271-0x0000000000BE0000-0x0000000000BE1000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1975.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1812b8ef-b00d-46b5-ac2e-075d7b7d446a\\1975.exe\" --AutoStart"	1975.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

A2AD.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA A2AD.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

14 api.2ip.ua
15 api.2ip.ua
25 api.2ip.ua
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

A2AD.exe

pid process

4068 A2AD.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	A2AD.exe

flow	ioc
14	api.2ip.ua
15	api.2ip.ua
25	api.2ip.ua

pid	process
4068	A2AD.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

1975.exe1975.exebuild2.exebuild3.exe5353.exemstsca.exe

description	pid	process	target process
PID 2672 set thread context of 2716	2672	1975.exe	1975.exe
PID 1644 set thread context of 3672	1644	1975.exe	1975.exe
PID 4068 set thread context of 1672	4068	build2.exe	build2.exe
PID 3868 set thread context of 3776	3868	build3.exe	build3.exe
PID 3960 set thread context of 1520	3960	5353.exe	5353.exe
PID 4016 set thread context of 2372	4016	mstsca.exe	mstsca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2c7373ab965995304bd8b007f66ebad2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2c7373ab965995304bd8b007f66ebad2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2c7373ab965995304bd8b007f66ebad2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2c7373ab965995304bd8b007f66ebad2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

build2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2192 schtasks.exe
1336 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

928 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2116 taskkill.exe

pid	process
2192	schtasks.exe
1336	schtasks.exe

pid	process
928	timeout.exe

pid	process
2116	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

1975.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	1975.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	1975.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2c7373ab965995304bd8b007f66ebad2.exe

pid	process
2384	2c7373ab965995304bd8b007f66ebad2.exe
2384	2c7373ab965995304bd8b007f66ebad2.exe
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588
1588

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1588
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2c7373ab965995304bd8b007f66ebad2.exe

pid process

2384 2c7373ab965995304bd8b007f66ebad2.exe

pid	process
1588

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

4066.exetaskkill.exe5353.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeDebugPrivilege	360	4066.exe
Token: SeDebugPrivilege	2116	taskkill.exe
Token: SeDebugPrivilege	1520	5353.exe
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeShutdownPrivilege	1588
Token: SeCreatePagefilePrivilege	1588
Token: SeDebugPrivilege	980	powershell.exe
Token: SeIncreaseQuotaPrivilege	980	powershell.exe
Token: SeSecurityPrivilege	980	powershell.exe
Token: SeTakeOwnershipPrivilege	980	powershell.exe
Token: SeLoadDriverPrivilege	980	powershell.exe
Token: SeSystemProfilePrivilege	980	powershell.exe
Token: SeSystemtimePrivilege	980	powershell.exe
Token: SeProfSingleProcessPrivilege	980	powershell.exe
Token: SeIncBasePriorityPrivilege	980	powershell.exe
Token: SeCreatePagefilePrivilege	980	powershell.exe
Token: SeBackupPrivilege	980	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1975.exe1975.exe1975.exe1975.exebuild2.exe5353.exebuild3.exebuild3.exe

description	pid	process	target process
PID 1588 wrote to memory of 2672	1588		1975.exe
PID 1588 wrote to memory of 2672	1588		1975.exe
PID 1588 wrote to memory of 2672	1588		1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2672 wrote to memory of 2716	2672	1975.exe	1975.exe
PID 2716 wrote to memory of 2292	2716	1975.exe	icacls.exe
PID 2716 wrote to memory of 2292	2716	1975.exe	icacls.exe
PID 2716 wrote to memory of 2292	2716	1975.exe	icacls.exe
PID 2716 wrote to memory of 1644	2716	1975.exe	1975.exe
PID 2716 wrote to memory of 1644	2716	1975.exe	1975.exe
PID 2716 wrote to memory of 1644	2716	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1644 wrote to memory of 3672	1644	1975.exe	1975.exe
PID 1588 wrote to memory of 360	1588		4066.exe
PID 1588 wrote to memory of 360	1588		4066.exe
PID 1588 wrote to memory of 360	1588		4066.exe
PID 3672 wrote to memory of 4068	3672	1975.exe	build2.exe
PID 3672 wrote to memory of 4068	3672	1975.exe	build2.exe
PID 3672 wrote to memory of 4068	3672	1975.exe	build2.exe
PID 4068 wrote to memory of 1672	4068	build2.exe	build2.exe
PID 4068 wrote to memory of 1672	4068	build2.exe	build2.exe
PID 4068 wrote to memory of 1672	4068	build2.exe	build2.exe
PID 4068 wrote to memory of 1672	4068	build2.exe	build2.exe
PID 4068 wrote to memory of 1672	4068	build2.exe	build2.exe
PID 4068 wrote to memory of 1672	4068	build2.exe	build2.exe
PID 4068 wrote to memory of 1672	4068	build2.exe	build2.exe
PID 4068 wrote to memory of 1672	4068	build2.exe	build2.exe
PID 3672 wrote to memory of 3868	3672	1975.exe	build3.exe
PID 3672 wrote to memory of 3868	3672	1975.exe	build3.exe
PID 3672 wrote to memory of 3868	3672	1975.exe	build3.exe
PID 1588 wrote to memory of 3960	1588		5353.exe
PID 1588 wrote to memory of 3960	1588		5353.exe
PID 1588 wrote to memory of 3960	1588		5353.exe
PID 3960 wrote to memory of 1520	3960	5353.exe	5353.exe
PID 3960 wrote to memory of 1520	3960	5353.exe	5353.exe
PID 3960 wrote to memory of 1520	3960	5353.exe	5353.exe
PID 3868 wrote to memory of 3776	3868	build3.exe	build3.exe
PID 3868 wrote to memory of 3776	3868	build3.exe	build3.exe
PID 3868 wrote to memory of 3776	3868	build3.exe	build3.exe
PID 3868 wrote to memory of 3776	3868	build3.exe	build3.exe
PID 3868 wrote to memory of 3776	3868	build3.exe	build3.exe
PID 3868 wrote to memory of 3776	3868	build3.exe	build3.exe
PID 3868 wrote to memory of 3776	3868	build3.exe	build3.exe
PID 3868 wrote to memory of 3776	3868	build3.exe	build3.exe
PID 3868 wrote to memory of 3776	3868	build3.exe	build3.exe
PID 3776 wrote to memory of 2192	3776	build3.exe	schtasks.exe
PID 3776 wrote to memory of 2192	3776	build3.exe	schtasks.exe
PID 3776 wrote to memory of 2192	3776	build3.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\2c7373ab965995304bd8b007f66ebad2.exe
"C:\Users\Admin\AppData\Local\Temp\2c7373ab965995304bd8b007f66ebad2.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2384

C:\Users\Admin\AppData\Local\Temp\1975.exe
C:\Users\Admin\AppData\Local\Temp\1975.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2672

C:\Users\Admin\AppData\Local\Temp\1975.exe
C:\Users\Admin\AppData\Local\Temp\1975.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2716

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\1812b8ef-b00d-46b5-ac2e-075d7b7d446a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2292

C:\Users\Admin\AppData\Local\Temp\1975.exe
"C:\Users\Admin\AppData\Local\Temp\1975.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\1975.exe
"C:\Users\Admin\AppData\Local\Temp\1975.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build2.exe
"C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4068

C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build2.exe
"C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build2.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build2.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:2748

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:928

C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build3.exe
"C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3868

C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build3.exe
"C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:2192

C:\Users\Admin\AppData\Local\Temp\4066.exe
C:\Users\Admin\AppData\Local\Temp\4066.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:360

C:\Users\Admin\AppData\Local\Temp\5353.exe
C:\Users\Admin\AppData\Local\Temp\5353.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3960

C:\Users\Admin\AppData\Local\Temp\5353.exe
C:\Users\Admin\AppData\Local\Temp\5353.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1520

C:\Users\Admin\AppData\Local\Temp\NetFrame.exe
"C:\Users\Admin\AppData\Local\Temp\NetFrame.exe"
3⤵
- Executes dropped EXE
- Drops startup file
PID:964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\ProgramData
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\ProgramData\Systemd\note3dll.exe
NULL
4⤵
- Executes dropped EXE
PID:1072

C:\Users\Admin\AppData\Local\Temp\A2AD.exe
C:\Users\Admin\AppData\Local\Temp\A2AD.exe
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4068

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4016

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:2372

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
3⤵
- Creates scheduled task(s)
PID:1336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Systemd\config.json
MD5
fa1d69a92278c02bde09e56f53f17e7c

SHA1
18bf7aeb76a9dab8dfbc54fd6c44c9c31ab96c6a

SHA256
b7530d98b7fbfaf91eaf37c184adf3d2f0d7fe0be0161f94cf01a66a8b8334c2

SHA512
86260deb08d8e17cab9aa84c156988343ac567b45a9b437a67443983d5143e5979ee775ba01a33cdad57d87ab6fd4dca56489df4da2b9a529202dad5a26c93e2

Download Submit
C:\ProgramData\Systemd\note3dll.exe
MD5
ffb329c2154e6f420068c6eacb1c0fe7

SHA1
b3157f6538b5ae8634e387ca670241dab5728109

SHA256
088e1203ee8d1119bdf8dffc9753456ba8d2d78ddd9c882344b5270b1767b9e9

SHA512
65ae6ad8ac8a2fd473b61833e57ef43fa36e6c9dfc9b6ef301957fc08075a6883d83dd119c1fbf055d2d9ffab91be4900abc65f3a340022f39aa90bbe63679ec

Download Submit
C:\ProgramData\Systemd\note3dll.exe
MD5
ffb329c2154e6f420068c6eacb1c0fe7

SHA1
b3157f6538b5ae8634e387ca670241dab5728109

SHA256
088e1203ee8d1119bdf8dffc9753456ba8d2d78ddd9c882344b5270b1767b9e9

SHA512
65ae6ad8ac8a2fd473b61833e57ef43fa36e6c9dfc9b6ef301957fc08075a6883d83dd119c1fbf055d2d9ffab91be4900abc65f3a340022f39aa90bbe63679ec

Download Submit
C:\ProgramData\freebl3.dll
MD5
ef2834ac4ee7d6724f255beaf527e635

SHA1
5be8c1e73a21b49f353c2ecfa4108e43a883cb7b

SHA256
a770ecba3b08bbabd0a567fc978e50615f8b346709f8eb3cfacf3faab24090ba

SHA512
c6ea0e4347cbd7ef5e80ae8c0afdca20ea23ac2bdd963361dfaf562a9aed58dcbc43f89dd826692a064d76c3f4b3e92361af7b79a6d16a75d9951591ae3544d2

Download Submit
C:\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
C:\ProgramData\msvcp140.dll
MD5
109f0f02fd37c84bfc7508d4227d7ed5

SHA1
ef7420141bb15ac334d3964082361a460bfdb975

SHA256
334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

SHA512
46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

Download Submit
C:\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
C:\ProgramData\softokn3.dll
MD5
a2ee53de9167bf0d6c019303b7ca84e5

SHA1
2a3c737fa1157e8483815e98b666408a18c0db42

SHA256
43536adef2ddcc811c28d35fa6ce3031029a2424ad393989db36169ff2995083

SHA512
45b56432244f86321fa88fbcca6a0d2a2f7f4e0648c1d7d7b1866adc9daa5eddd9f6bb73662149f279c9ab60930dad1113c8337cb5e6ec9eed5048322f65f7d8

Download Submit
C:\ProgramData\vcruntime140.dll
MD5
7587bf9cb4147022cd5681b015183046

SHA1
f2106306a8f6f0da5afb7fc765cfa0757ad5a628

SHA256
c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

SHA512
0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
57ba3fd55153ccfffc38981d45eb27ef

SHA1
8b89079e2a405fe04a1a87fe901d88982ef516cb

SHA256
19d84b87ec3acb0894fbbb2c95b23053373568282aa6817da64607ed3225dcef

SHA512
58ae33ebb38e6bec6332b9085f8b41850b53d7de804bc87a462f9ce7b1e960051d3682fb87a14c159041a7577a36af95cb2edf971e4d23c902d583da9945c0b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
3f5ce173eed18d061760acea4c8f69f3

SHA1
c8a02499ede88cb10496fbbc77fee1f2757e6629

SHA256
b7666f21ebc73a75f02fefbf7d6f17700897b69301eae07ce4bab6b32ab107c8

SHA512
22f7b2af2a230e7f6ae2830d27b5769c07f0c3f8d327cfb6be6a4c632af012e823e303514c62dac8f70c973e4df81aeba10138a930d4a8880caf18c8a7062d24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
MD5
007f79334480cc8c7c7f42bdae2a5a5b

SHA1
470cc429232336417c72f8fe9a4fc8c4ca26f9f1

SHA256
c3e6f5f48c4683b4a2134ef23c3f1d1926ebeb7becd18064c140eda0c09c3ba0

SHA512
2cfbc4bf087a0ebe8a497893498ac46514748858fda1ac1bc31c4ecc7169b90d5fefd822fe5f4b7160de790ab77176c384cd091bf821d1bdcd9c99bc8638020a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
fd4fa28aacd144e470e9a54cdc101c4b

SHA1
e7de5d96259400b156f9af88e209f4478a5e0317

SHA256
3a53602740dbbe50b8fb337f2cbbdb6f1b143f5127b0acdbe7958365f06f2c12

SHA512
053b6bbe7078d7336169b8a0c5a8847f70654b31df495acf4d23678b236c5c67b13dc9affe54758daa8d67f017c00461920d3d4cf14bbf2ddc8d962f88bc5310

Download Submit
C:\Users\Admin\AppData\Local\1812b8ef-b00d-46b5-ac2e-075d7b7d446a\1975.exe
MD5
a02b31dac1565be66df4600be65c0def

SHA1
4020c3c83178b0ba063d47767b091b2af3624ca9

SHA256
982661fa50431f34e62cfbd6629bc29a5989dea65f84cf19bd5036f57f44780b

SHA512
840c18abb74493b9b0ba5d77b2aeb96565eba0346f7c1baa85375547131ca90d8077de0362b879639a155117b105c11bb60e0c5b7d9829b9c248fca5209e4e67

Download Submit
C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build2.exe
MD5
7c48019f424bbd08de9d0c7d66e0ea7c

SHA1
1394ad4f1fd9a7109e179695d4b404eaca70fa88

SHA256
33d15dacd2b4951517f39aa2e12afa747ddc5785b0ef3c2d78c3db16cae97d7c

SHA512
63cf0ee393e8a3dec78a06dd0a478a993143bc9061acdb828fa6edecc5d45b286aa081d0ed99819ab8d8c95345eac73658c819eefdf6efa30da877af7374e322

Download Submit
C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build2.exe
MD5
7c48019f424bbd08de9d0c7d66e0ea7c

SHA1
1394ad4f1fd9a7109e179695d4b404eaca70fa88

SHA256
33d15dacd2b4951517f39aa2e12afa747ddc5785b0ef3c2d78c3db16cae97d7c

SHA512
63cf0ee393e8a3dec78a06dd0a478a993143bc9061acdb828fa6edecc5d45b286aa081d0ed99819ab8d8c95345eac73658c819eefdf6efa30da877af7374e322

Download Submit
C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build2.exe
MD5
7c48019f424bbd08de9d0c7d66e0ea7c

SHA1
1394ad4f1fd9a7109e179695d4b404eaca70fa88

SHA256
33d15dacd2b4951517f39aa2e12afa747ddc5785b0ef3c2d78c3db16cae97d7c

SHA512
63cf0ee393e8a3dec78a06dd0a478a993143bc9061acdb828fa6edecc5d45b286aa081d0ed99819ab8d8c95345eac73658c819eefdf6efa30da877af7374e322

Download Submit
C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build3.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build3.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Local\548cda8e-dd33-4f76-b495-3790cd8e905a\build3.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5353.exe.log
MD5
41fbed686f5700fc29aaccf83e8ba7fd

SHA1
5271bc29538f11e42a3b600c8dc727186e912456

SHA256
df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

SHA512
234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

Download Submit
C:\Users\Admin\AppData\Local\Temp\1975.exe
MD5
a02b31dac1565be66df4600be65c0def

SHA1
4020c3c83178b0ba063d47767b091b2af3624ca9

SHA256
982661fa50431f34e62cfbd6629bc29a5989dea65f84cf19bd5036f57f44780b

SHA512
840c18abb74493b9b0ba5d77b2aeb96565eba0346f7c1baa85375547131ca90d8077de0362b879639a155117b105c11bb60e0c5b7d9829b9c248fca5209e4e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\1975.exe
MD5
a02b31dac1565be66df4600be65c0def

SHA1
4020c3c83178b0ba063d47767b091b2af3624ca9

SHA256
982661fa50431f34e62cfbd6629bc29a5989dea65f84cf19bd5036f57f44780b

SHA512
840c18abb74493b9b0ba5d77b2aeb96565eba0346f7c1baa85375547131ca90d8077de0362b879639a155117b105c11bb60e0c5b7d9829b9c248fca5209e4e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\1975.exe
MD5
a02b31dac1565be66df4600be65c0def

SHA1
4020c3c83178b0ba063d47767b091b2af3624ca9

SHA256
982661fa50431f34e62cfbd6629bc29a5989dea65f84cf19bd5036f57f44780b

SHA512
840c18abb74493b9b0ba5d77b2aeb96565eba0346f7c1baa85375547131ca90d8077de0362b879639a155117b105c11bb60e0c5b7d9829b9c248fca5209e4e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\1975.exe
MD5
a02b31dac1565be66df4600be65c0def

SHA1
4020c3c83178b0ba063d47767b091b2af3624ca9

SHA256
982661fa50431f34e62cfbd6629bc29a5989dea65f84cf19bd5036f57f44780b

SHA512
840c18abb74493b9b0ba5d77b2aeb96565eba0346f7c1baa85375547131ca90d8077de0362b879639a155117b105c11bb60e0c5b7d9829b9c248fca5209e4e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\1975.exe
MD5
a02b31dac1565be66df4600be65c0def

SHA1
4020c3c83178b0ba063d47767b091b2af3624ca9

SHA256
982661fa50431f34e62cfbd6629bc29a5989dea65f84cf19bd5036f57f44780b

SHA512
840c18abb74493b9b0ba5d77b2aeb96565eba0346f7c1baa85375547131ca90d8077de0362b879639a155117b105c11bb60e0c5b7d9829b9c248fca5209e4e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\4066.exe
MD5
00f96742e30d5151d30b199e822b014b

SHA1
b00a8589649e09282ea8de72a9c6ebd37f59874c

SHA256
1a258df93de3955089e869e2348df88c72444d09930ff31cba0fab7022701da1

SHA512
c582946d3eabe342b64f58ddde6a8766df0a7760e6bf4767a93e1465b4dad34bb838981790fdfc55906e8c695f1f567172d2ce4a20b0eb8f4c5b94d2dc8de094

Download Submit
C:\Users\Admin\AppData\Local\Temp\4066.exe
MD5
00f96742e30d5151d30b199e822b014b

SHA1
b00a8589649e09282ea8de72a9c6ebd37f59874c

SHA256
1a258df93de3955089e869e2348df88c72444d09930ff31cba0fab7022701da1

SHA512
c582946d3eabe342b64f58ddde6a8766df0a7760e6bf4767a93e1465b4dad34bb838981790fdfc55906e8c695f1f567172d2ce4a20b0eb8f4c5b94d2dc8de094

Download Submit
C:\Users\Admin\AppData\Local\Temp\5353.exe
MD5
287976d8c62519cbb494cf31916ce26e

SHA1
e9749fe784aeba486115ee4cef0fe8400439d613

SHA256
91802cc2e767e5fc498a4f8068b97de249a16b5aa05e085354862e5cc3f17d3b

SHA512
9e63b59777b413d9d62c68ee3f7a52e487ea6a563603174fbccc5eb8893009b04a11d37e7d29d286e26bb7039c84027493a605947b0472affa73fafbc5f0d29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\5353.exe
MD5
287976d8c62519cbb494cf31916ce26e

SHA1
e9749fe784aeba486115ee4cef0fe8400439d613

SHA256
91802cc2e767e5fc498a4f8068b97de249a16b5aa05e085354862e5cc3f17d3b

SHA512
9e63b59777b413d9d62c68ee3f7a52e487ea6a563603174fbccc5eb8893009b04a11d37e7d29d286e26bb7039c84027493a605947b0472affa73fafbc5f0d29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\5353.exe
MD5
287976d8c62519cbb494cf31916ce26e

SHA1
e9749fe784aeba486115ee4cef0fe8400439d613

SHA256
91802cc2e767e5fc498a4f8068b97de249a16b5aa05e085354862e5cc3f17d3b

SHA512
9e63b59777b413d9d62c68ee3f7a52e487ea6a563603174fbccc5eb8893009b04a11d37e7d29d286e26bb7039c84027493a605947b0472affa73fafbc5f0d29f

Download Submit
C:\Users\Admin\AppData\Local\Temp\A2AD.exe
MD5
706e056e6b2aaebd358701538b774fcd

SHA1
a528290b1eec45a22587c15d8a0135185832e71a

SHA256
c431a09f7c0a0c4ec016f16ca7150c1a6b9227fe5ed216ce004eda4af9878ac8

SHA512
a3ff93f0e7f8781c8c4b664a6d33c63a5bd712dc999f69394a4d991bb3d1059aae0c0c001ec16d6c6b72f3054bce3cb2e7030bd81b15360fdee6a1a8f8c39fcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\NetFrame.exe
MD5
935adaea999dc3ad0672636dced6011e

SHA1
0f6a0f57684c66a14985ee14e858b95905cf8e05

SHA256
9b97b61edb6d9159517d77215d49a34647cd2e9737948a13bc20c4dcb989b005

SHA512
371f39ff8d6216258103d43450f3c6d99301e5fbccabcf2494cfcc136bef510f66e61429eea86a8a7de72f6d5a5786ef5f24a46042379778e965e7395dae5bcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\NetFrame.exe
MD5
935adaea999dc3ad0672636dced6011e

SHA1
0f6a0f57684c66a14985ee14e858b95905cf8e05

SHA256
9b97b61edb6d9159517d77215d49a34647cd2e9737948a13bc20c4dcb989b005

SHA512
371f39ff8d6216258103d43450f3c6d99301e5fbccabcf2494cfcc136bef510f66e61429eea86a8a7de72f6d5a5786ef5f24a46042379778e965e7395dae5bcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
MD5
0fea771099e342facd95a9d659548919

SHA1
9f8b56a37870f8b4ac5aa0ff5677a666f94c7197

SHA256
6f032f671284b3812373e90b0ab5b16ea737bd7dc87d22b8f2aabe558334e403

SHA512
2c1eeb2909acdc1ac36a677dba5131775e97dd107cd60f03bc6672be1791b2dd83a9f588719cb376cc4771570c6b2c202e783e30450ae3c2aa48bbaf2ee049c3

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
memory/360-150-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/360-204-0x0000000007BA0000-0x0000000007BA1000-memory.dmp

Filesize
4KB

Download
memory/360-158-0x0000000004E12000-0x0000000004E13000-memory.dmp

Filesize
4KB

Download
memory/360-157-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/360-156-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/360-160-0x0000000004D60000-0x0000000004D61000-memory.dmp

Filesize
4KB

Download
memory/360-161-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/360-159-0x0000000004E13000-0x0000000004E14000-memory.dmp

Filesize
4KB

Download
memory/360-155-0x0000000000620000-0x0000000000662000-memory.dmp

Filesize
264KB

Download
memory/360-154-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download
memory/360-165-0x0000000004E14000-0x0000000004E16000-memory.dmp

Filesize
8KB

Download
memory/360-197-0x0000000006C60000-0x0000000006C61000-memory.dmp

Filesize
4KB

Download
memory/360-153-0x0000000004C20000-0x0000000004C21000-memory.dmp

Filesize
4KB

Download
memory/360-152-0x0000000005930000-0x0000000005931000-memory.dmp

Filesize
4KB

Download
memory/360-138-0x0000000000000000-mapping.dmp

Download
memory/360-151-0x0000000002570000-0x000000000259E000-memory.dmp

Filesize
184KB

Download
memory/360-149-0x0000000002280000-0x00000000022B0000-memory.dmp

Filesize
192KB

Download
memory/360-202-0x00000000078D0000-0x00000000078D1000-memory.dmp

Filesize
4KB

Download
memory/360-198-0x0000000006E30000-0x0000000006E31000-memory.dmp

Filesize
4KB

Download
memory/360-199-0x0000000007450000-0x0000000007451000-memory.dmp

Filesize
4KB

Download
memory/928-200-0x0000000000000000-mapping.dmp

Download
memory/964-218-0x0000000000000000-mapping.dmp

Download
memory/980-227-0x0000029860840000-0x0000029860841000-memory.dmp

Filesize
4KB

Download
memory/980-221-0x0000000000000000-mapping.dmp

Download
memory/980-232-0x000002987AEB0000-0x000002987AEB1000-memory.dmp

Filesize
4KB

Download
memory/980-235-0x000002985EF00000-0x000002985EF02000-memory.dmp

Filesize
8KB

Download
memory/980-236-0x000002985EF03000-0x000002985EF05000-memory.dmp

Filesize
8KB

Download
memory/980-237-0x000002985EF06000-0x000002985EF08000-memory.dmp

Filesize
8KB

Download
memory/980-260-0x000002985EF08000-0x000002985EF09000-memory.dmp

Filesize
4KB

Download
memory/1072-264-0x00000208DAAB0000-0x00000208DAAD0000-memory.dmp

Filesize
128KB

Download
memory/1072-261-0x0000000000000000-mapping.dmp

Download
memory/1072-268-0x00000208DAAD0000-0x00000208DAAF0000-memory.dmp

Filesize
128KB

Download
memory/1072-287-0x00000208DAB10000-0x00000208DAB30000-memory.dmp

Filesize
128KB

Download
memory/1072-286-0x00000208DAAF0000-0x00000208DAB10000-memory.dmp

Filesize
128KB

Download
memory/1336-293-0x0000000000000000-mapping.dmp

Download
memory/1520-194-0x0000000004EF0000-0x00000000054F6000-memory.dmp

Filesize
6.0MB

Download
memory/1520-183-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/1520-184-0x000000000041C5BA-mapping.dmp

Download
memory/1588-299-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-307-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-306-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-301-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-313-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-300-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-295-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-117-0x0000000000880000-0x0000000000895000-memory.dmp

Filesize
84KB

Download
memory/1588-314-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-311-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-312-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-310-0x0000000004510000-0x0000000004520000-memory.dmp

Filesize
64KB

Download
memory/1588-309-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-308-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-305-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-304-0x0000000004510000-0x0000000004520000-memory.dmp

Filesize
64KB

Download
memory/1588-294-0x00000000008A0000-0x00000000008B0000-memory.dmp

Filesize
64KB

Download
memory/1588-302-0x0000000004510000-0x0000000004520000-memory.dmp

Filesize
64KB

Download
memory/1588-296-0x0000000002A50000-0x0000000002A60000-memory.dmp

Filesize
64KB

Download
memory/1588-298-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-303-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1588-297-0x0000000002930000-0x0000000002940000-memory.dmp

Filesize
64KB

Download
memory/1644-128-0x0000000000000000-mapping.dmp

Download
memory/1672-148-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1672-144-0x0000000000400000-0x00000000004D7000-memory.dmp

Filesize
860KB

Download
memory/1672-145-0x00000000004A032D-mapping.dmp

Download
memory/2116-196-0x0000000000000000-mapping.dmp

Download
memory/2192-180-0x0000000000000000-mapping.dmp

Download
memory/2292-126-0x0000000000000000-mapping.dmp

Download
memory/2372-291-0x0000000000401AFA-mapping.dmp

Download
memory/2384-115-0x00000000004B0000-0x000000000055E000-memory.dmp

Filesize
696KB

Download
memory/2384-116-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/2672-118-0x0000000000000000-mapping.dmp

Download
memory/2672-124-0x00000000022D0000-0x00000000023EB000-memory.dmp

Filesize
1.1MB

Download
memory/2716-121-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-125-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2716-122-0x0000000000424141-mapping.dmp

Download
memory/2748-195-0x0000000000000000-mapping.dmp

Download
memory/3672-137-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3672-131-0x0000000000424141-mapping.dmp

Download
memory/3776-182-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3776-177-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3776-178-0x0000000000401AFA-mapping.dmp

Download
memory/3868-162-0x0000000000000000-mapping.dmp

Download
memory/3868-181-0x00000000001E0000-0x00000000001E4000-memory.dmp

Filesize
16KB

Download
memory/3960-174-0x0000000003060000-0x0000000003061000-memory.dmp

Filesize
4KB

Download
memory/3960-175-0x0000000005950000-0x0000000005951000-memory.dmp

Filesize
4KB

Download
memory/3960-171-0x00000000056F0000-0x00000000056F1000-memory.dmp

Filesize
4KB

Download
memory/3960-169-0x0000000000E70000-0x0000000000E71000-memory.dmp

Filesize
4KB

Download
memory/3960-166-0x0000000000000000-mapping.dmp

Download
memory/4068-147-0x00000000030B0000-0x0000000003184000-memory.dmp

Filesize
848KB

Download
memory/4068-271-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/4068-141-0x0000000000000000-mapping.dmp

Download
memory/4068-278-0x0000000005F50000-0x0000000005F51000-memory.dmp

Filesize
4KB

Download
memory/4068-266-0x0000000000000000-mapping.dmp

Download
memory/4068-277-0x0000000006000000-0x0000000006001000-memory.dmp

Filesize
4KB

Download
memory/4068-269-0x0000000077000000-0x000000007718E000-memory.dmp

Filesize
1.6MB

Download