Analysis Overview
SHA256
d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4
Threat Level: Known bad
The file d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4 was found to be: Known bad.
Malicious Activity Summary
Vidar
Detected Djvu ransomware
Djvu Ransomware
Executes dropped EXE
Downloads MZ/PE file
Modifies file permissions
Loads dropped DLL
Reads user/profile data of web browsers
Looks up external IP address via web service
Checks installed software on the system
Adds Run key to start application
Accesses cryptocurrency files/wallets, possible credential harvesting
Accesses 2FA software files, possible credential harvesting
Suspicious use of SetThreadContext
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Kills process with taskkill
Checks processor information in registry
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-10-19 03:03
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-10-19 03:03
Reported
2022-10-19 03:06
Platform
win10-20220812-en
Max time kernel
91s
Max time network
152s
Command Line
Signatures
Detected Djvu ransomware
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Djvu Ransomware
Vidar
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build3.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\icacls.exe | N/A |
Reads user/profile data of web browsers
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ddfaede7-8ef0-4e86-80c0-284c041182b6\\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe\" --AutoStart" | C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe | N/A |
Checks installed software on the system
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2736 set thread context of 3756 | N/A | C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe | C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe |
| PID 3324 set thread context of 2220 | N/A | C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe | C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe |
| PID 4520 set thread context of 1188 | N/A | C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe | C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe |
Enumerates physical storage devices
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe
"C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe"
C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe
"C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe"
C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\ddfaede7-8ef0-4e86-80c0-284c041182b6" /deny *S-1-1-0:(OI)(CI)(DE,DC)
C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe
"C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe
"C:\Users\Admin\AppData\Local\Temp\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe
"C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe"
C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe
"C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe"
C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build3.exe
"C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build3.exe"
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" bx/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe" & del C:\PrograData\*.dll & exit
C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
C:\Windows\SysWOW64\timeout.exe
timeout /t 6
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.2ip.ua | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | rgyui.top | udp |
| US | 8.8.8.8:53 | winnlinne.com | udp |
| AR | 181.167.134.24:80 | rgyui.top | tcp |
| MN | 203.91.116.53:80 | winnlinne.com | tcp |
| US | 104.208.16.88:443 | tcp | |
| MN | 203.91.116.53:80 | winnlinne.com | tcp |
| US | 8.8.8.8:53 | t.me | udp |
| NL | 149.154.167.99:443 | t.me | tcp |
| DE | 116.202.186.42:80 | 116.202.186.42 | tcp |
Files
memory/2736-115-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-116-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-117-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-118-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-119-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-120-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-121-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-122-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-123-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-124-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-125-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-126-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-127-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-128-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-129-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-131-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-132-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-133-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-134-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-135-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-136-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-138-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-137-0x00000000005F0000-0x000000000073A000-memory.dmp
memory/2736-140-0x0000000002270000-0x000000000238B000-memory.dmp
memory/2736-141-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-139-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-142-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-143-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/2736-144-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-145-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3756-146-0x0000000000424141-mapping.dmp
memory/3756-147-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-148-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-149-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-150-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-151-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-152-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3756-153-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-154-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-155-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-156-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-157-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-158-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-159-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-160-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-161-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-163-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-164-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-162-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-165-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-166-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-167-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-168-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-169-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-170-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-171-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-172-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-173-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-174-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-175-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-176-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-177-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-178-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-179-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-180-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-181-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-182-0x00000000774C0000-0x000000007764E000-memory.dmp
memory/3756-199-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2960-217-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\ddfaede7-8ef0-4e86-80c0-284c041182b6\d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4.exe
| MD5 | f14f1cfdea35a4362820fb5c8913032b |
| SHA1 | 23e66d8944f871da13fb91666b5fae686bd57e07 |
| SHA256 | d1800226a1884f849d8de867121c8e9eb10567b6adf53d47e8af43be060d0ff4 |
| SHA512 | f3465d8b28c9f9ff99bc059c7921a2fe425937210cc0cf1c9bc1a38e390e8e13c99c70d6192e8edcaecf6aa25584e668c7d9b9317aac232a22c4f9b8b1d9fa5d |
memory/3324-243-0x0000000000000000-mapping.dmp
memory/3756-245-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2220-272-0x0000000000424141-mapping.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | 098f3a7bf2423aa018dee9e3bd2e7c80 |
| SHA1 | 7335c353b9c0b6cdef1a822e6cd1cb6d58d41096 |
| SHA256 | 5c2348018a6e4249f6ae4e0f373a461b5dcbe49be8c3efaf328c60535a468e50 |
| SHA512 | f2b7aaa70bd63228c41338bc7c085badc36966303d98506dfc476ba5cbc7accff5efd80334b8e08d97fffe224fccd8fd95b7b8a5a5653ed7b30b486e1f60e052 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | 97ab7ffd65186e85f453dc7c02637528 |
| SHA1 | f22312a6a44613be85c0370878456a965f869a40 |
| SHA256 | 630df8e970cc3b1ad508db713dd8be52e0ac7a5826f3f264a266232f9a1c23ee |
| SHA512 | 37d90c98e72ad55b2cbb938541c81bac1aa9d2b8a7e19f0fbfaa365b49e7bef2d3199f03e46aa9fbf3055f3701d21860820c451065f7e425d39bf86ca606bfb0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 49b72c8d8eaa278d5a7c0670f78169ac |
| SHA1 | 6f7f4ae8174cc644fe77e942349fbeb71a588898 |
| SHA256 | 518797193782e0e94cdbe1c3c18cdc3e3706dd3be7bf3e0cac57701ecccd8f99 |
| SHA512 | 2f2722988afeaa898428c6cf98a83f6b35e9fe10fb11098d6c462865b09b940cfa31bfb597ff3c6180a1d93703d2772136735caa66a8cadef09581ff2b630203 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 006c98bc42ac1d15f0ec70e3488783c5 |
| SHA1 | a8c8302826468c903b511e206d6d058e2c3acdaa |
| SHA256 | e24883740fbed2781e4df4e5387cd95c3345ec9944edeeb36babd2c10135fa00 |
| SHA512 | e0caea17f99a18483e0195c5311942c195ef42532f1868bfb5c64b3f6cb72cc0fc58414176a9bfc66452e11d17c2058eafb483a41890f502ec76dc3a6807f2f4 |
memory/2220-345-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4520-364-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
memory/1188-397-0x0000000000429CBD-mapping.dmp
memory/4520-399-0x00000000021C0000-0x000000000220F000-memory.dmp
C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
memory/2220-402-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4188-432-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Local\9e95aef5-1567-4c85-bc09-bf813bdf0e5a\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/876-476-0x0000000000000000-mapping.dmp
memory/1188-475-0x0000000000400000-0x0000000000463000-memory.dmp
\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
memory/1188-557-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1792-562-0x0000000000000000-mapping.dmp
memory/4264-568-0x0000000000000000-mapping.dmp
memory/1188-582-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4232-612-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/2200-668-0x0000000000000000-mapping.dmp