djvu | 90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24

Analysis

max time kernel
151s
max time network
154s
platform
windows10_x64
resource
win10-20220414-en
submitted
18-04-2022 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
Size

789KB
MD5

87c720e513db68673a707be7a224bb91
SHA1

8fd449c7d335f99ae9d910b4ac9f5aee09a5f4dd
SHA256

90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24
SHA512

6c88e43cad65f38109d1f36b4dd0d77b6d45d2b297e8438e4364cb5ed82a5545ff4e7230bc6af01c415e5b11593fd2a895cd84ef6019a8d8b17ae449235b92d3

Score

10^/10

djvu vidar discovery persistence ransomware stealer suricata

Malware Config

Extracted

Family

djvu

http://fuyt.org/fhsgtsspen6/get.php

Attributes

extension
.nuhb
offline_id
PfLhykvDxmCghCq8peuxBtQ3c0QBuANi8WUkuet1
payload_url
http://zerit.top/dl/build2.exe

http://fuyt.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-c565B1ILoZ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0453Jbdio

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/640-117-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/640-118-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/640-119-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/912-121-0x0000000002310000-0x000000000242B000-memory.dmp	family_djvu
behavioral1/memory/640-122-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/640-123-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2936-129-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/2936-130-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2936-131-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2936-132-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata

Vidar Stealer 6 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2276-143-0x0000000000400000-0x00000000004AA000-memory.dmp	family_vidar
behavioral1/memory/2276-144-0x00000000004717BA-mapping.dmp	family_vidar
behavioral1/memory/2276-146-0x0000000000400000-0x00000000004AA000-memory.dmp	family_vidar
behavioral1/memory/2276-149-0x0000000000400000-0x00000000004AA000-memory.dmp	family_vidar
behavioral1/memory/2404-148-0x0000000002170000-0x0000000002218000-memory.dmp	family_vidar
behavioral1/memory/2276-150-0x0000000000400000-0x00000000004AA000-memory.dmp	family_vidar

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

build2.exebuild2.exe

pid process

2404 build2.exe
2276 build2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3960 icacls.exe

pid	process
2404	build2.exe
2276	build2.exe

pid	process
3960	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\58f425e0-5965-46bd-9ca7-640ff12c6042\\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe\" --AutoStart"	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 api.2ip.ua
11 api.2ip.ua
1 api.2ip.ua

flow	ioc
2	api.2ip.ua
11	api.2ip.ua
1	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

Processes:

90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exebuild2.exe

description	pid	process	target process
PID 912 set thread context of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 set thread context of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 2404 set thread context of 2276	2404	build2.exe	build2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe

pid	process
640	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
640	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
2936	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
2936	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exebuild2.exe

C:\Users\Admin\AppData\Local\Temp\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
"C:\Users\Admin\AppData\Local\Temp\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
  "C:\Users\Admin\AppData\Local\Temp\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\58f425e0-5965-46bd-9ca7-640ff12c6042" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3960
- - C:\Users\Admin\AppData\Local\Temp\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
    "C:\Users\Admin\AppData\Local\Temp\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
      "C:\Users\Admin\AppData\Local\Temp\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\Users\Admin\AppData\Local\d55bf3d3-84ed-41ff-877a-343d86d2f940\build2.exe
        
        "C:\Users\Admin\AppData\Local\d55bf3d3-84ed-41ff-877a-343d86d2f940\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2404
      - C:\Users\Admin\AppData\Local\d55bf3d3-84ed-41ff-877a-343d86d2f940\build2.exe
        
        "C:\Users\Admin\AppData\Local\d55bf3d3-84ed-41ff-877a-343d86d2f940\build2.exe"
        6⤵
        Executes dropped EXE
        
        PID:2276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
727B

MD5
944e0b205b374bae5a5ec6f004e0ccdc

SHA1
0f227641cff488a8610faf4151241c7d3b387358

SHA256
a27baf0aef166a0570dd5543e141fb1f97b8d6d19bf2dc1e91ee532b93927286

SHA512
fd1a8ea4a418817a4001af2a351d0cdce2ca25a0c5c65b762e42b5d15e57cba4a514b2169dc52946bcc168dbbdbce7b930a4e08cd3cbdc5acf3cf94d57d42007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
f7dcb24540769805e5bb30d193944dce

SHA1
e26c583c562293356794937d9e2e6155d15449ee

SHA256
6b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea

SHA512
cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
471B

MD5
7443608ab0c5be3ff317d4072fd2a4c1

SHA1
c14ca7d35ca32880627b147d57b520466ebb5213

SHA256
d4ab6ff49fb6c573a076269888c063cba4d52e9c2d0a03b488559e510df57ab2

SHA512
06adf1d67845a438089a93f00603ddfd734966673af1617493652d136bbaf0775c4fb64f15e4aad0caef105604414d09c756f2fee1b2d73396ad1eb93ba0f322

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
402B

MD5
8d2293e1c343de340800cba0eb50427c

SHA1
ccb3a22bffdde5879aac17e87a9be5aa915bb603

SHA256
8702652bd25bc4b7f7a70684dada9e1afe366b1b946ade98a12c237e4d3d3c9d

SHA512
c9ede89665e5dbf7914379885abe7660192831ee39caa246be1dcf98c966ec34decc034166112cf9b5f7a69f5608928a22bb94aec79450d428758ead59510012

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
340B

MD5
a737660331d4104c1e7e7f0e1d406e60

SHA1
ccbb3312e99226279f817697870e2968868b8041

SHA256
9a2054fea90ba32db7ddfacc1837a29b2f26156c7a46d198873ea2f3a132ebc5

SHA512
a86832375df38588ecd978792b7437d7f5b1d75184adfd8675cfe28b049a98d4820814beb021ffe58d529f29f8ecb42758021dbca0ceb9f89b7184a7c91f5a62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
396B

MD5
59420f401a8d6a8963162bdc93e2956e

SHA1
fdee50fed76af82d7cbba2fa477a351ac4b00a18

SHA256
b02a254fc22fcb81e4ec262d5205add6e7405fd4497bcd63b18c4a1bdaf6edec

SHA512
9b8c38c38f4b8ef4aab7750b7fb2abc39d866ba632e0d6cff8e53093afde14d6392870985c1f558003303e9a2e6e2912abb85d4d003175a7823eea2112867b27

Download Submit
C:\Users\Admin\AppData\Local\58f425e0-5965-46bd-9ca7-640ff12c6042\90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe

Filesize
789KB

MD5
87c720e513db68673a707be7a224bb91

SHA1
8fd449c7d335f99ae9d910b4ac9f5aee09a5f4dd

SHA256
90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24

SHA512
6c88e43cad65f38109d1f36b4dd0d77b6d45d2b297e8438e4364cb5ed82a5545ff4e7230bc6af01c415e5b11593fd2a895cd84ef6019a8d8b17ae449235b92d3

Download Submit
C:\Users\Admin\AppData\Local\d55bf3d3-84ed-41ff-877a-343d86d2f940\build2.exe

Filesize
603KB

MD5
a13e3b18282318c65f096bad322b3c50

SHA1
2c76179e95e583b588bcd516e94e7a2da52d5299

SHA256
ba981a94852325debf0e4b478266f6efd8e4e9c5b149fd9ad277be0be5045768

SHA512
acb009f4b622ab7e8729dac2c45da975ba2305612c9575e5c8ce221edecf2d49da2236fc28b00d8f424a251765b935d8acce7bf40a1557d9fc79ba446250e786

Download Submit
C:\Users\Admin\AppData\Local\d55bf3d3-84ed-41ff-877a-343d86d2f940\build2.exe

Filesize
603KB

MD5
a13e3b18282318c65f096bad322b3c50

SHA1
2c76179e95e583b588bcd516e94e7a2da52d5299

SHA256
ba981a94852325debf0e4b478266f6efd8e4e9c5b149fd9ad277be0be5045768

SHA512
acb009f4b622ab7e8729dac2c45da975ba2305612c9575e5c8ce221edecf2d49da2236fc28b00d8f424a251765b935d8acce7bf40a1557d9fc79ba446250e786

Download Submit
C:\Users\Admin\AppData\Local\d55bf3d3-84ed-41ff-877a-343d86d2f940\build2.exe

Filesize
603KB

MD5
a13e3b18282318c65f096bad322b3c50

SHA1
2c76179e95e583b588bcd516e94e7a2da52d5299

SHA256
ba981a94852325debf0e4b478266f6efd8e4e9c5b149fd9ad277be0be5045768

SHA512
acb009f4b622ab7e8729dac2c45da975ba2305612c9575e5c8ce221edecf2d49da2236fc28b00d8f424a251765b935d8acce7bf40a1557d9fc79ba446250e786

Download Submit
memory/640-117-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/640-118-0x0000000000424141-mapping.dmp

Download
memory/640-119-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/640-123-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/640-122-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/912-121-0x0000000002310000-0x000000000242B000-memory.dmp

Filesize
1.1MB

Download
memory/912-120-0x0000000002210000-0x00000000022A5000-memory.dmp

Filesize
596KB

Download
memory/2276-144-0x00000000004717BA-mapping.dmp

Download
memory/2276-146-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2276-150-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2276-149-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2276-143-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/2404-142-0x000000000077A000-0x00000000007E2000-memory.dmp

Filesize
416KB

Download
memory/2404-139-0x0000000000000000-mapping.dmp

Download
memory/2404-148-0x0000000002170000-0x0000000002218000-memory.dmp

Filesize
672KB

Download
memory/2404-147-0x000000000077A000-0x00000000007E2000-memory.dmp

Filesize
416KB

Download
memory/2936-129-0x0000000000424141-mapping.dmp

Download
memory/2936-130-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2936-132-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2936-131-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3960-124-0x0000000000000000-mapping.dmp

Download
memory/4052-126-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 912 wrote to memory of 640	912	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 640 wrote to memory of 3960	640	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	icacls.exe
PID 640 wrote to memory of 3960	640	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	icacls.exe
PID 640 wrote to memory of 3960	640	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	icacls.exe
PID 640 wrote to memory of 4052	640	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 640 wrote to memory of 4052	640	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 640 wrote to memory of 4052	640	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 4052 wrote to memory of 2936	4052	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe
PID 2936 wrote to memory of 2404	2936	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	build2.exe
PID 2936 wrote to memory of 2404	2936	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	build2.exe
PID 2936 wrote to memory of 2404	2936	90674ff25b01802e2622240c64fa74f2c15b2d26da1782e7f35a56123c89df24.exe	build2.exe
PID 2404 wrote to memory of 2276	2404	build2.exe	build2.exe
PID 2404 wrote to memory of 2276	2404	build2.exe	build2.exe
PID 2404 wrote to memory of 2276	2404	build2.exe	build2.exe
PID 2404 wrote to memory of 2276	2404	build2.exe	build2.exe
PID 2404 wrote to memory of 2276	2404	build2.exe	build2.exe
PID 2404 wrote to memory of 2276	2404	build2.exe	build2.exe
PID 2404 wrote to memory of 2276	2404	build2.exe	build2.exe
PID 2404 wrote to memory of 2276	2404	build2.exe	build2.exe