Analysis Overview
SHA256
99ca1c8288eff396d3a8098c0621d77e0ff21c5b3619a9fbc26fd9ec41d511e0
Threat Level: Known bad
The file file.exe was found to be: Known bad.
Malicious Activity Summary
SmokeLoader
Djvu Ransomware
Vidar
Detects Smokeloader packer
Detected Djvu ransomware
Downloads MZ/PE file
Executes dropped EXE
Reads user/profile data of web browsers
Loads dropped DLL
Checks computer location settings
Modifies file permissions
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Legitimate hosting services abused for malware hosting/C2
Accesses 2FA software files, possible credential harvesting
Adds Run key to start application
Accesses Microsoft Outlook profiles
Suspicious use of SetThreadContext
Program crash
Enumerates physical storage devices
Creates scheduled task(s)
outlook_win_path
Suspicious behavior: GetForegroundWindowSpam
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
Suspicious use of WriteProcessMemory
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Checks SCSI registry key(s)
outlook_office_path
Delays execution with timeout.exe
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-10-19 05:31
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-10-19 05:31
Reported
2022-10-19 05:33
Platform
win7-20220812-en
Max time kernel
150s
Max time network
45s
Command Line
Signatures
Detects Smokeloader packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
SmokeLoader
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
Network
Files
memory/1860-54-0x0000000000698000-0x00000000006A9000-memory.dmp
memory/1860-55-0x00000000751A1000-0x00000000751A3000-memory.dmp
memory/1860-57-0x0000000000230000-0x0000000000239000-memory.dmp
memory/1860-56-0x0000000000698000-0x00000000006A9000-memory.dmp
memory/1860-58-0x0000000000400000-0x0000000000597000-memory.dmp
memory/1860-59-0x0000000000400000-0x0000000000597000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-10-19 05:31
Reported
2022-10-19 05:33
Platform
win10v2004-20220812-en
Max time kernel
152s
Max time network
152s
Command Line
Signatures
Detected Djvu ransomware
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Smokeloader packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Djvu Ransomware
SmokeLoader
Vidar
Downloads MZ/PE file
Executes dropped EXE
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\2913.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\2C71.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\2913.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\2C71.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\icacls.exe | N/A |
Reads user/profile data of web browsers
Accesses 2FA software files, possible credential harvesting
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\597715ed-eaaa-4000-9d2b-05d565dc41be\\2913.exe\" --AutoStart" | C:\Users\Admin\AppData\Local\Temp\2913.exe | N/A |
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 960 set thread context of 5100 | N/A | C:\Users\Admin\AppData\Local\Temp\2913.exe | C:\Users\Admin\AppData\Local\Temp\2913.exe |
| PID 1576 set thread context of 728 | N/A | C:\Users\Admin\AppData\Local\Temp\2C71.exe | C:\Users\Admin\AppData\Local\Temp\2C71.exe |
| PID 2372 set thread context of 1756 | N/A | C:\Users\Admin\AppData\Local\Temp\2913.exe | C:\Users\Admin\AppData\Local\Temp\2913.exe |
| PID 936 set thread context of 4672 | N/A | C:\Users\Admin\AppData\Local\Temp\2C71.exe | C:\Users\Admin\AppData\Local\Temp\2C71.exe |
| PID 2964 set thread context of 3064 | N/A | C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe | C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe |
| PID 916 set thread context of 1416 | N/A | C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build2.exe | C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build2.exe |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\D45C.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\3144.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\3144.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\3144.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3144.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\D45C.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\2913.exe
C:\Users\Admin\AppData\Local\Temp\2913.exe
C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\2B47.dll
C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\2B47.dll
C:\Users\Admin\AppData\Local\Temp\2C71.exe
C:\Users\Admin\AppData\Local\Temp\2C71.exe
C:\Users\Admin\AppData\Local\Temp\2913.exe
C:\Users\Admin\AppData\Local\Temp\2913.exe
C:\Users\Admin\AppData\Local\Temp\3144.exe
C:\Users\Admin\AppData\Local\Temp\3144.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Users\Admin\AppData\Local\Temp\2C71.exe
C:\Users\Admin\AppData\Local\Temp\2C71.exe
C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\597715ed-eaaa-4000-9d2b-05d565dc41be" /deny *S-1-1-0:(OI)(CI)(DE,DC)
C:\Users\Admin\AppData\Local\Temp\2913.exe
"C:\Users\Admin\AppData\Local\Temp\2913.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\2913.exe
"C:\Users\Admin\AppData\Local\Temp\2913.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\2C71.exe
"C:\Users\Admin\AppData\Local\Temp\2C71.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\2C71.exe
"C:\Users\Admin\AppData\Local\Temp\2C71.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\A646.exe
C:\Users\Admin\AppData\Local\Temp\A646.exe
C:\Users\Admin\AppData\Local\Temp\D45C.exe
C:\Users\Admin\AppData\Local\Temp\D45C.exe
C:\Users\Admin\AppData\Local\Temp\E5E2.exe
C:\Users\Admin\AppData\Local\Temp\E5E2.exe
C:\Users\Admin\AppData\Local\Temp\EB61.exe
C:\Users\Admin\AppData\Local\Temp\EB61.exe
C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe
"C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe"
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe
"C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe"
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build3.exe
"C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build3.exe"
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1084 -ip 1084
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 1040
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build2.exe
"C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build2.exe"
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build2.exe
"C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build2.exe"
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build3.exe
"C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build3.exe"
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" Ð~/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe" & del C:\PrograData\*.dll & exit
C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
C:\Windows\SysWOW64\timeout.exe
timeout /t 6
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | furubujjul.net | udp |
| US | 172.67.203.213:80 | furubujjul.net | tcp |
| RU | 185.174.137.174:80 | 185.174.137.174 | tcp |
| US | 8.8.8.8:53 | api.2ip.ua | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 172.67.203.213:80 | furubujjul.net | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | 226.101.242.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | avtlsgosecure.com | udp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 8.8.8.8:53 | api.2ip.ua | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 140.82.112.4:443 | github.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 8.8.8.8:53 | supremetechnologiesindia.com | udp |
| SG | 217.21.74.123:443 | supremetechnologiesindia.com | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 8.8.8.8:53 | 1drv.ms | udp |
| US | 13.107.42.12:443 | 1drv.ms | tcp |
| US | 8.8.8.8:53 | onedrive.live.com | udp |
| US | 13.107.42.13:443 | onedrive.live.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 8.8.8.8:53 | bitbucket.org | udp |
| US | 104.192.141.1:443 | bitbucket.org | tcp |
| US | 8.8.8.8:53 | bbuseruploads.s3.amazonaws.com | udp |
| US | 52.216.1.32:443 | bbuseruploads.s3.amazonaws.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| SG | 217.21.74.123:443 | supremetechnologiesindia.com | tcp |
| US | 8.8.8.8:53 | rgyui.top | udp |
| US | 8.8.8.8:53 | winnlinne.com | udp |
| PE | 190.117.75.91:80 | rgyui.top | tcp |
| KW | 37.34.248.24:80 | winnlinne.com | tcp |
| RU | 45.15.156.37:110 | tcp | |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| KW | 37.34.248.24:80 | winnlinne.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| PE | 190.117.75.91:80 | rgyui.top | tcp |
| US | 8.8.8.8:53 | t.me | udp |
| NL | 149.154.167.99:443 | t.me | tcp |
| DE | 116.202.186.42:80 | 116.202.186.42 | tcp |
| NL | 178.79.208.1:80 | tcp | |
| KW | 37.34.248.24:80 | winnlinne.com | tcp |
Files
memory/4372-132-0x0000000000953000-0x0000000000964000-memory.dmp
memory/4372-133-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/4372-134-0x0000000000400000-0x0000000000597000-memory.dmp
memory/4372-135-0x0000000000953000-0x0000000000964000-memory.dmp
memory/4372-136-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/4372-137-0x0000000000400000-0x0000000000597000-memory.dmp
memory/960-138-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\2913.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
C:\Users\Admin\AppData\Local\Temp\2913.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
memory/1800-141-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\2B47.dll
| MD5 | 198309de59fae38094f89e9c3f819974 |
| SHA1 | 925559874ad6edb9b98a21328c6322d8476e1618 |
| SHA256 | d784f4cb44db7002b485bb59fa81291993a34a81a9d31393682419c7ddd7a01f |
| SHA512 | 39e2d3bf17dbd3fa0817fe5779e7786c0edfdde492a2dd7e1e7ae68fa08d9d5d91c5441c2c54a154847f6d31192f25de5c332841d9b7bf2c2223b467f3840660 |
memory/4480-143-0x0000000000000000-mapping.dmp
memory/1576-144-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\2C71.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
C:\Users\Admin\AppData\Local\Temp\2C71.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
memory/4480-149-0x0000000002340000-0x000000000254B000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2B47.dll
| MD5 | 198309de59fae38094f89e9c3f819974 |
| SHA1 | 925559874ad6edb9b98a21328c6322d8476e1618 |
| SHA256 | d784f4cb44db7002b485bb59fa81291993a34a81a9d31393682419c7ddd7a01f |
| SHA512 | 39e2d3bf17dbd3fa0817fe5779e7786c0edfdde492a2dd7e1e7ae68fa08d9d5d91c5441c2c54a154847f6d31192f25de5c332841d9b7bf2c2223b467f3840660 |
C:\Users\Admin\AppData\Local\Temp\2B47.dll
| MD5 | 198309de59fae38094f89e9c3f819974 |
| SHA1 | 925559874ad6edb9b98a21328c6322d8476e1618 |
| SHA256 | d784f4cb44db7002b485bb59fa81291993a34a81a9d31393682419c7ddd7a01f |
| SHA512 | 39e2d3bf17dbd3fa0817fe5779e7786c0edfdde492a2dd7e1e7ae68fa08d9d5d91c5441c2c54a154847f6d31192f25de5c332841d9b7bf2c2223b467f3840660 |
memory/5100-150-0x0000000000000000-mapping.dmp
memory/5100-151-0x0000000000400000-0x0000000000537000-memory.dmp
memory/960-154-0x00000000006FC000-0x000000000078E000-memory.dmp
memory/1060-157-0x0000000000000000-mapping.dmp
memory/5100-156-0x0000000000400000-0x0000000000537000-memory.dmp
memory/960-155-0x00000000022B0000-0x00000000023CB000-memory.dmp
memory/5100-153-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2913.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
C:\Users\Admin\AppData\Local\Temp\3144.exe
| MD5 | 2d91cc5c18c0ced93d0797d176a3aba1 |
| SHA1 | 349409660ff155a7ffd2019535f4f826784017d3 |
| SHA256 | d8a3ea89d449674e3b86e93e954e8de6d0afe04e4909c95b3930cc7c50847323 |
| SHA512 | 6abada6377f1866d42ad021381c0eb54453813030bc2fe3f593cf4d5d60891054ed61d570c4e1eedee012e2cd1f434b4e00753c52b2ef9274f0535cc4d513871 |
C:\Users\Admin\AppData\Local\Temp\3144.exe
| MD5 | 2d91cc5c18c0ced93d0797d176a3aba1 |
| SHA1 | 349409660ff155a7ffd2019535f4f826784017d3 |
| SHA256 | d8a3ea89d449674e3b86e93e954e8de6d0afe04e4909c95b3930cc7c50847323 |
| SHA512 | 6abada6377f1866d42ad021381c0eb54453813030bc2fe3f593cf4d5d60891054ed61d570c4e1eedee012e2cd1f434b4e00753c52b2ef9274f0535cc4d513871 |
memory/4760-160-0x0000000000000000-mapping.dmp
memory/5100-161-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3588-162-0x0000000000000000-mapping.dmp
memory/4480-163-0x0000000002BA0000-0x0000000002CB4000-memory.dmp
memory/4760-165-0x0000000001270000-0x00000000012DB000-memory.dmp
memory/4760-164-0x00000000012E0000-0x0000000001355000-memory.dmp
memory/4480-167-0x0000000002DE0000-0x0000000002EF4000-memory.dmp
memory/3588-166-0x0000000000A10000-0x0000000000A1C000-memory.dmp
memory/4760-168-0x0000000001270000-0x00000000012DB000-memory.dmp
memory/728-169-0x0000000000000000-mapping.dmp
memory/1576-171-0x0000000002050000-0x00000000020E1000-memory.dmp
memory/1060-172-0x00000000008D3000-0x00000000008E4000-memory.dmp
memory/1060-174-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/728-177-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1060-176-0x0000000000400000-0x0000000000597000-memory.dmp
memory/728-175-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2C71.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
memory/728-178-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1060-179-0x0000000000400000-0x0000000000597000-memory.dmp
memory/4480-180-0x0000000002F00000-0x0000000002FC2000-memory.dmp
memory/4480-181-0x0000000002FE0000-0x000000000308D000-memory.dmp
memory/4480-184-0x0000000002DE0000-0x0000000002EF4000-memory.dmp
memory/2704-185-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\597715ed-eaaa-4000-9d2b-05d565dc41be\2913.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
memory/2372-187-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\2913.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
memory/5100-189-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1756-190-0x0000000000000000-mapping.dmp
memory/1756-193-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1756-195-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2372-194-0x000000000062A000-0x00000000006BC000-memory.dmp
memory/1756-196-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\2913.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
C:\Users\Admin\AppData\Local\Temp\2C71.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
memory/728-199-0x0000000000400000-0x0000000000537000-memory.dmp
memory/936-197-0x0000000000000000-mapping.dmp
memory/4672-200-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\2C71.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
memory/4672-203-0x0000000000400000-0x0000000000537000-memory.dmp
memory/4672-205-0x0000000000400000-0x0000000000537000-memory.dmp
memory/936-204-0x0000000001FCB000-0x000000000205C000-memory.dmp
memory/4672-206-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1352-207-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\A646.exe
| MD5 | 291db64b3f2c354f3b57714df82b4dd9 |
| SHA1 | 0c0e761f2d420d23216537811a47f471f05faae3 |
| SHA256 | 7203df4933276db49cad9a404c55a76710e66b3a88ab50bf6b792ab402cdb60a |
| SHA512 | f7369c06246a5932a6cbe1af161423b21b05a14e28664b07b5a9a039b992e11a9da7deaec8cb664df70ab5407ec999ab1ca8fee3bd4ceabe572d061b265df90f |
C:\Users\Admin\AppData\Local\Temp\A646.exe
| MD5 | 291db64b3f2c354f3b57714df82b4dd9 |
| SHA1 | 0c0e761f2d420d23216537811a47f471f05faae3 |
| SHA256 | 7203df4933276db49cad9a404c55a76710e66b3a88ab50bf6b792ab402cdb60a |
| SHA512 | f7369c06246a5932a6cbe1af161423b21b05a14e28664b07b5a9a039b992e11a9da7deaec8cb664df70ab5407ec999ab1ca8fee3bd4ceabe572d061b265df90f |
memory/1084-210-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\D45C.exe
| MD5 | 0d5b6d3c2dd0e9eb170ea1e1e06fb73d |
| SHA1 | b4cd233e78c4b65fea910aefb33cd9cfdc07bfb4 |
| SHA256 | e0dc0990501e5fd3d56e2b77d99e6dd7256b576c63e011dbd273195ca380abc6 |
| SHA512 | 65eb0ba45efe71fd0081f84988658176359926e1cbbd4333372cdcae4fffbdebda7f8a9065d12331476104e67406301e32496b880d51a19a3841ffe68b61ffe2 |
C:\Users\Admin\AppData\Local\Temp\D45C.exe
| MD5 | 0d5b6d3c2dd0e9eb170ea1e1e06fb73d |
| SHA1 | b4cd233e78c4b65fea910aefb33cd9cfdc07bfb4 |
| SHA256 | e0dc0990501e5fd3d56e2b77d99e6dd7256b576c63e011dbd273195ca380abc6 |
| SHA512 | 65eb0ba45efe71fd0081f84988658176359926e1cbbd4333372cdcae4fffbdebda7f8a9065d12331476104e67406301e32496b880d51a19a3841ffe68b61ffe2 |
memory/1084-213-0x0000000000973000-0x00000000009A9000-memory.dmp
memory/1084-214-0x0000000004E90000-0x0000000005434000-memory.dmp
memory/1084-215-0x0000000000710000-0x0000000000769000-memory.dmp
memory/1084-216-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/1084-217-0x0000000005440000-0x0000000005A58000-memory.dmp
memory/1084-218-0x0000000004DC0000-0x0000000004DD2000-memory.dmp
memory/1084-219-0x0000000005A60000-0x0000000005B6A000-memory.dmp
memory/1084-220-0x0000000004DE0000-0x0000000004E1C000-memory.dmp
memory/1084-221-0x0000000005DE0000-0x0000000005E72000-memory.dmp
memory/1084-222-0x0000000005E80000-0x0000000005EE6000-memory.dmp
memory/4420-223-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\E5E2.exe
| MD5 | cf1cd7888e18f113334c9808f4ddbeda |
| SHA1 | 43b2449d750204495a78d4ec18a78803b6739854 |
| SHA256 | 30981f801025bb25be10c58844c42d051f6826782d4daa1eb8cfe62fbd8dcf1d |
| SHA512 | bafae603b6fc5a8fafebbbf5461e5646ddd4a8c3863495ddf921ab169f45f2dd2861c3ce24623c2bcd02d1d419eaa502683e01c2103dae88d35fb52b5cd7536f |
C:\Users\Admin\AppData\Local\Temp\E5E2.exe
| MD5 | cf1cd7888e18f113334c9808f4ddbeda |
| SHA1 | 43b2449d750204495a78d4ec18a78803b6739854 |
| SHA256 | 30981f801025bb25be10c58844c42d051f6826782d4daa1eb8cfe62fbd8dcf1d |
| SHA512 | bafae603b6fc5a8fafebbbf5461e5646ddd4a8c3863495ddf921ab169f45f2dd2861c3ce24623c2bcd02d1d419eaa502683e01c2103dae88d35fb52b5cd7536f |
memory/1084-226-0x00000000066D0000-0x0000000006746000-memory.dmp
memory/1084-227-0x0000000006780000-0x000000000679E000-memory.dmp
memory/1304-228-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\EB61.exe
| MD5 | 29f2ec28627a41db988319686656c43b |
| SHA1 | be48f52c2b5a64462dde716372144e0b2f07c107 |
| SHA256 | 5b956b5e5f3b322ed1e4b70a8891aee5cde1aaa0648d52173c633ee1714516cf |
| SHA512 | 04de4c4f7e30c96f75dd6f7726f2e9472b5bb1702eb023e6108c74d63ce99c70a1f7f773c5f72578cd941b0d719cabc0ff17619835cc8c5e9733751e31d53d49 |
C:\Users\Admin\AppData\Local\Temp\EB61.exe
| MD5 | 29f2ec28627a41db988319686656c43b |
| SHA1 | be48f52c2b5a64462dde716372144e0b2f07c107 |
| SHA256 | 5b956b5e5f3b322ed1e4b70a8891aee5cde1aaa0648d52173c633ee1714516cf |
| SHA512 | 04de4c4f7e30c96f75dd6f7726f2e9472b5bb1702eb023e6108c74d63ce99c70a1f7f773c5f72578cd941b0d719cabc0ff17619835cc8c5e9733751e31d53d49 |
memory/2964-231-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
C:\SystemID\PersonalID.txt
| MD5 | 93e6ebd9709635bbf8a4315de6b1e3fc |
| SHA1 | 4aa76931cfb3427be53bb23ac3ec4c2cd3c9b57d |
| SHA256 | 860b7c8f1f9a577faeb82546f3013418aee5639a1afcd1c66259ddb8cc9d98e6 |
| SHA512 | d1605438085003bfb4bb1ba87c00f0f1b971bde3458ded3b02fc6d9ae5f6d499e0c0d43e7fadf81c8f485032cd41157a5f699f1e9b9f89a0ab0c45955a671852 |
C:\Users\Admin\AppData\Local\bowsakkdestx.txt
| MD5 | e134b33ebc4a28eff7c845e00e5bdbc1 |
| SHA1 | ab0a4f50802c16d46b5f320853cb4d9fc35c26ea |
| SHA256 | 093b5b6b217b3b3f8ac79ac51de93e4652f05aeebf35b7dbb6925eafc85b3a46 |
| SHA512 | 12cb2da4b5fec37bf1a6d27656518b43bc5051eb30121506972e45142abc5bab4b66501f7e9e3f9ff1743fb6077ab8e399f5e5481c034a604d95e8a35c3551ed |
memory/4508-236-0x0000000000000000-mapping.dmp
memory/1084-237-0x0000000007670000-0x0000000007832000-memory.dmp
memory/1084-238-0x0000000007840000-0x0000000007D6C000-memory.dmp
memory/3064-239-0x0000000000000000-mapping.dmp
memory/3064-240-0x0000000000400000-0x0000000000463000-memory.dmp
C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
memory/3064-244-0x0000000000400000-0x0000000000463000-memory.dmp
memory/2964-243-0x00000000005DD000-0x0000000000609000-memory.dmp
memory/2964-245-0x00000000021E0000-0x000000000222F000-memory.dmp
memory/1084-246-0x00000000069B0000-0x0000000006A00000-memory.dmp
memory/1924-247-0x0000000000000000-mapping.dmp
memory/4508-248-0x00000000009C0000-0x00000000009C7000-memory.dmp
memory/4508-249-0x00000000009B0000-0x00000000009BB000-memory.dmp
memory/3064-250-0x0000000000400000-0x0000000000463000-memory.dmp
memory/1924-251-0x0000000000520000-0x000000000052F000-memory.dmp
memory/4536-252-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Local\7f384cdb-d3ba-4e35-b90b-3386725f82dc\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/3240-255-0x0000000000000000-mapping.dmp
memory/4372-256-0x0000000000000000-mapping.dmp
memory/4372-258-0x0000000000670000-0x0000000000679000-memory.dmp
memory/1924-257-0x0000000000530000-0x0000000000539000-memory.dmp
memory/1068-259-0x0000000000000000-mapping.dmp
memory/4372-260-0x0000000000680000-0x0000000000685000-memory.dmp
memory/1068-261-0x00000000009E0000-0x00000000009EC000-memory.dmp
memory/916-262-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
memory/2032-266-0x0000000000000000-mapping.dmp
memory/1084-267-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/1084-265-0x0000000000973000-0x00000000009A9000-memory.dmp
memory/1068-268-0x00000000009F0000-0x00000000009F6000-memory.dmp
memory/3064-269-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2828-287-0x0000000000000000-mapping.dmp
memory/2032-288-0x0000000000570000-0x0000000000592000-memory.dmp
memory/2828-292-0x0000000001280000-0x0000000001285000-memory.dmp
memory/1416-291-0x0000000000000000-mapping.dmp
memory/2828-293-0x0000000001270000-0x0000000001279000-memory.dmp
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
memory/2032-289-0x0000000000540000-0x0000000000567000-memory.dmp
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
memory/916-299-0x000000000071D000-0x0000000000749000-memory.dmp
C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
memory/4276-300-0x0000000000000000-mapping.dmp
memory/1416-301-0x0000000000400000-0x0000000000463000-memory.dmp
memory/4276-302-0x00000000004B0000-0x00000000004B6000-memory.dmp
memory/4276-303-0x00000000004A0000-0x00000000004AB000-memory.dmp
memory/3740-304-0x0000000000000000-mapping.dmp
memory/2156-307-0x0000000000000000-mapping.dmp
memory/3320-310-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Local\1f97d220-ab5b-4bc5-9131-c91c1cc0fda3\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/1036-314-0x0000000000000000-mapping.dmp
memory/4880-315-0x0000000000000000-mapping.dmp
memory/4424-316-0x0000000000000000-mapping.dmp
memory/4784-319-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/4120-331-0x0000000000000000-mapping.dmp