Malware Analysis Report

2025-04-13 11:48

Sample ID 221019-f86zssegf2
Target file
SHA256 99ca1c8288eff396d3a8098c0621d77e0ff21c5b3619a9fbc26fd9ec41d511e0
Tags
smokeloader backdoor trojan djvu vidar 517 collection discovery persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

99ca1c8288eff396d3a8098c0621d77e0ff21c5b3619a9fbc26fd9ec41d511e0

Threat Level: Known bad

The file file was found to be: Known bad.

Malicious Activity Summary

smokeloader backdoor trojan djvu vidar 517 collection discovery persistence ransomware spyware stealer

SmokeLoader

Detects Smokeloader packer

Vidar

Djvu Ransomware

Detected Djvu ransomware

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Reads user/profile data of web browsers

Modifies file permissions

Loads dropped DLL

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Accesses 2FA software files, possible credential harvesting

Checks installed software on the system

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Accesses Microsoft Outlook profiles

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

outlook_win_path

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

outlook_office_path

Delays execution with timeout.exe

Checks processor information in registry

Checks SCSI registry key(s)

Suspicious use of WriteProcessMemory

Kills process with taskkill

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-19 05:33

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 05:33

Reported

2022-10-19 05:36

Platform

win7-20220812-en

Max time kernel

150s

Max time network

47s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Detects Smokeloader packer

Description Indicator Process Target
N/A N/A N/A N/A

SmokeLoader

trojan backdoor smokeloader

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Network

N/A

Files

memory/1184-54-0x00000000006E8000-0x00000000006F9000-memory.dmp

memory/1184-55-0x0000000074BB1000-0x0000000074BB3000-memory.dmp

memory/1184-56-0x00000000006E8000-0x00000000006F9000-memory.dmp

memory/1184-57-0x0000000000230000-0x0000000000239000-memory.dmp

memory/1184-58-0x0000000000400000-0x0000000000597000-memory.dmp

memory/1184-59-0x0000000000400000-0x0000000000597000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-10-19 05:33

Reported

2022-10-19 05:36

Platform

win10v2004-20220812-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Smokeloader packer

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

SmokeLoader

trojan backdoor smokeloader

Vidar

stealer vidar

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\E556.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\E1BA.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\E556.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\E1BA.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses 2FA software files, possible credential harvesting

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\4df7088a-8f86-40b4-8bdc-2b874543b1a8\\E556.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\E556.exe N/A

Checks installed software on the system

discovery

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\7F57.exe

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\E816.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\E816.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\E816.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\E816.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7F57.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A
Token: SeShutdownPrivilege N/A N/A N/A
Token: SeCreatePagefilePrivilege N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 372 wrote to memory of 4088 N/A N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 372 wrote to memory of 4088 N/A N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 372 wrote to memory of 4088 N/A N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 372 wrote to memory of 1544 N/A N/A C:\Windows\system32\regsvr32.exe
PID 372 wrote to memory of 1544 N/A N/A C:\Windows\system32\regsvr32.exe
PID 1544 wrote to memory of 2092 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1544 wrote to memory of 2092 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 1544 wrote to memory of 2092 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 372 wrote to memory of 3928 N/A N/A C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 372 wrote to memory of 3928 N/A N/A C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 372 wrote to memory of 3928 N/A N/A C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4088 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 372 wrote to memory of 3600 N/A N/A C:\Users\Admin\AppData\Local\Temp\E816.exe
PID 372 wrote to memory of 3600 N/A N/A C:\Users\Admin\AppData\Local\Temp\E816.exe
PID 372 wrote to memory of 3600 N/A N/A C:\Users\Admin\AppData\Local\Temp\E816.exe
PID 372 wrote to memory of 4852 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 372 wrote to memory of 4852 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 372 wrote to memory of 4852 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 372 wrote to memory of 4852 N/A N/A C:\Windows\SysWOW64\explorer.exe
PID 372 wrote to memory of 2752 N/A N/A C:\Windows\explorer.exe
PID 372 wrote to memory of 2752 N/A N/A C:\Windows\explorer.exe
PID 372 wrote to memory of 2752 N/A N/A C:\Windows\explorer.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 3928 wrote to memory of 1352 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 1352 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Windows\SysWOW64\icacls.exe
PID 1352 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Windows\SysWOW64\icacls.exe
PID 1352 wrote to memory of 3248 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Windows\SysWOW64\icacls.exe
PID 1352 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 1352 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 1352 wrote to memory of 952 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 372 wrote to memory of 4204 N/A N/A C:\Users\Admin\AppData\Local\Temp\5548.exe
PID 372 wrote to memory of 4204 N/A N/A C:\Users\Admin\AppData\Local\Temp\5548.exe
PID 372 wrote to memory of 4204 N/A N/A C:\Users\Admin\AppData\Local\Temp\5548.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 952 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\E556.exe C:\Users\Admin\AppData\Local\Temp\E556.exe
PID 2652 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 2652 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 2652 wrote to memory of 4128 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe
PID 4128 wrote to memory of 672 N/A C:\Users\Admin\AppData\Local\Temp\E1BA.exe C:\Users\Admin\AppData\Local\Temp\E1BA.exe

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Windows\SysWOW64\explorer.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\E3FD.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\E3FD.dll

C:\Users\Admin\AppData\Local\Temp\E556.exe

C:\Users\Admin\AppData\Local\Temp\E556.exe

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

C:\Users\Admin\AppData\Local\Temp\E816.exe

C:\Users\Admin\AppData\Local\Temp\E816.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Users\Admin\AppData\Local\Temp\E556.exe

C:\Users\Admin\AppData\Local\Temp\E556.exe

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\4df7088a-8f86-40b4-8bdc-2b874543b1a8" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\E556.exe

"C:\Users\Admin\AppData\Local\Temp\E556.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\5548.exe

C:\Users\Admin\AppData\Local\Temp\5548.exe

C:\Users\Admin\AppData\Local\Temp\E556.exe

"C:\Users\Admin\AppData\Local\Temp\E556.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

"C:\Users\Admin\AppData\Local\Temp\E1BA.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

"C:\Users\Admin\AppData\Local\Temp\E1BA.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\7F57.exe

C:\Users\Admin\AppData\Local\Temp\7F57.exe

C:\Users\Admin\AppData\Local\Temp\8BEA.exe

C:\Users\Admin\AppData\Local\Temp\8BEA.exe

C:\Users\Admin\AppData\Local\Temp\90AE.exe

C:\Users\Admin\AppData\Local\Temp\90AE.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4216 -ip 4216

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 1996

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\explorer.exe

C:\Windows\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe

"C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe"

C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build3.exe

"C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build3.exe"

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"

C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe

"C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" \/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe" & del C:\PrograData\*.dll & exit

C:\Windows\SysWOW64\taskkill.exe

taskkill /im build2.exe /f

C:\Windows\SysWOW64\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"

C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build2.exe

"C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build2.exe"

C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build3.exe

"C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build3.exe"

C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build2.exe

"C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build2.exe"

Network

Country Destination Domain Proto
US 8.238.20.126:80 tcp
US 8.8.8.8:53 furubujjul.net udp
US 172.67.203.213:80 furubujjul.net tcp
US 8.238.20.126:80 tcp
US 8.247.210.126:80 tcp
RU 185.174.137.174:80 185.174.137.174 tcp
US 8.8.8.8:53 api.2ip.ua udp
NL 162.0.217.254:443 api.2ip.ua tcp
US 172.67.203.213:80 furubujjul.net tcp
NL 162.0.217.254:443 api.2ip.ua tcp
US 20.42.65.84:443 tcp
US 8.8.8.8:53 avtlsgosecure.com udp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
US 8.8.8.8:53 github.com udp
US 140.82.114.3:443 github.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
US 8.8.8.8:53 supremetechnologiesindia.com udp
SG 217.21.74.123:443 supremetechnologiesindia.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
US 8.8.8.8:53 api.2ip.ua udp
NL 162.0.217.254:443 api.2ip.ua tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
US 8.8.8.8:53 1drv.ms udp
US 13.107.42.12:443 1drv.ms tcp
US 8.8.8.8:53 onedrive.live.com udp
US 13.107.42.13:443 onedrive.live.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
NL 162.0.217.254:443 api.2ip.ua tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
US 8.8.8.8:53 bitbucket.org udp
US 104.192.141.1:443 bitbucket.org tcp
US 8.8.8.8:53 bbuseruploads.s3.amazonaws.com udp
US 52.217.141.73:443 bbuseruploads.s3.amazonaws.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
SG 217.21.74.123:443 supremetechnologiesindia.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 45.15.156.37:110 tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
RU 185.173.39.246:80 avtlsgosecure.com tcp
US 8.8.8.8:53 rgyui.top udp
US 8.8.8.8:53 winnlinne.com udp
KR 175.120.254.9:80 rgyui.top tcp
BG 151.251.24.5:80 winnlinne.com tcp
KR 175.120.254.9:80 rgyui.top tcp
BG 151.251.24.5:80 winnlinne.com tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
DE 116.202.186.42:80 116.202.186.42 tcp
US 93.184.220.29:80 tcp
BG 151.251.24.5:80 winnlinne.com tcp

Files

memory/3084-132-0x00000000005F3000-0x0000000000604000-memory.dmp

memory/3084-133-0x00000000001F0000-0x00000000001F9000-memory.dmp

memory/3084-134-0x0000000000400000-0x0000000000597000-memory.dmp

memory/3084-135-0x0000000000400000-0x0000000000597000-memory.dmp

memory/4088-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

MD5 36fc2440660c5f4509c3abcdde9a1c3a
SHA1 23b9d0fe11194e29394beedddfd462225af5118e
SHA256 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d
SHA512 c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

MD5 36fc2440660c5f4509c3abcdde9a1c3a
SHA1 23b9d0fe11194e29394beedddfd462225af5118e
SHA256 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d
SHA512 c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025

memory/1544-139-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E3FD.dll

MD5 198309de59fae38094f89e9c3f819974
SHA1 925559874ad6edb9b98a21328c6322d8476e1618
SHA256 d784f4cb44db7002b485bb59fa81291993a34a81a9d31393682419c7ddd7a01f
SHA512 39e2d3bf17dbd3fa0817fe5779e7786c0edfdde492a2dd7e1e7ae68fa08d9d5d91c5441c2c54a154847f6d31192f25de5c332841d9b7bf2c2223b467f3840660

memory/2092-141-0x0000000000000000-mapping.dmp

memory/3928-142-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E556.exe

MD5 742fda7bfe69e131aa3d3eefdf8c1331
SHA1 cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5
SHA256 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3
SHA512 c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a

C:\Users\Admin\AppData\Local\Temp\E556.exe

MD5 742fda7bfe69e131aa3d3eefdf8c1331
SHA1 cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5
SHA256 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3
SHA512 c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a

C:\Users\Admin\AppData\Local\Temp\E3FD.dll

MD5 198309de59fae38094f89e9c3f819974
SHA1 925559874ad6edb9b98a21328c6322d8476e1618
SHA256 d784f4cb44db7002b485bb59fa81291993a34a81a9d31393682419c7ddd7a01f
SHA512 39e2d3bf17dbd3fa0817fe5779e7786c0edfdde492a2dd7e1e7ae68fa08d9d5d91c5441c2c54a154847f6d31192f25de5c332841d9b7bf2c2223b467f3840660

memory/2652-147-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2652-146-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

MD5 36fc2440660c5f4509c3abcdde9a1c3a
SHA1 23b9d0fe11194e29394beedddfd462225af5118e
SHA256 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d
SHA512 c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025

memory/4088-152-0x0000000002290000-0x00000000023AB000-memory.dmp

memory/2652-153-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3600-151-0x0000000000000000-mapping.dmp

memory/4088-150-0x0000000000862000-0x00000000008F4000-memory.dmp

memory/2652-149-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E816.exe

MD5 2d91cc5c18c0ced93d0797d176a3aba1
SHA1 349409660ff155a7ffd2019535f4f826784017d3
SHA256 d8a3ea89d449674e3b86e93e954e8de6d0afe04e4909c95b3930cc7c50847323
SHA512 6abada6377f1866d42ad021381c0eb54453813030bc2fe3f593cf4d5d60891054ed61d570c4e1eedee012e2cd1f434b4e00753c52b2ef9274f0535cc4d513871

memory/4852-156-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E816.exe

MD5 2d91cc5c18c0ced93d0797d176a3aba1
SHA1 349409660ff155a7ffd2019535f4f826784017d3
SHA256 d8a3ea89d449674e3b86e93e954e8de6d0afe04e4909c95b3930cc7c50847323
SHA512 6abada6377f1866d42ad021381c0eb54453813030bc2fe3f593cf4d5d60891054ed61d570c4e1eedee012e2cd1f434b4e00753c52b2ef9274f0535cc4d513871

memory/2652-157-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2752-158-0x0000000000000000-mapping.dmp

memory/4852-159-0x0000000000870000-0x00000000008E5000-memory.dmp

memory/4852-160-0x0000000000800000-0x000000000086B000-memory.dmp

memory/2092-161-0x0000000003200000-0x0000000003314000-memory.dmp

memory/2752-163-0x00000000004A0000-0x00000000004AC000-memory.dmp

memory/3600-164-0x00000000001F0000-0x00000000001F9000-memory.dmp

memory/2092-162-0x0000000003440000-0x0000000003554000-memory.dmp

memory/3600-165-0x0000000000400000-0x0000000000597000-memory.dmp

memory/1352-166-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E556.exe

MD5 742fda7bfe69e131aa3d3eefdf8c1331
SHA1 cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5
SHA256 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3
SHA512 c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a

memory/3928-171-0x0000000002061000-0x00000000020F2000-memory.dmp

memory/4852-172-0x0000000000800000-0x000000000086B000-memory.dmp

memory/3600-173-0x0000000000713000-0x0000000000724000-memory.dmp

memory/1352-170-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1352-169-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1352-174-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2092-175-0x0000000002CC0000-0x0000000002D82000-memory.dmp

memory/3600-176-0x0000000000400000-0x0000000000597000-memory.dmp

memory/2092-177-0x0000000003560000-0x000000000360D000-memory.dmp

memory/2092-180-0x0000000003440000-0x0000000003554000-memory.dmp

memory/3248-181-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\4df7088a-8f86-40b4-8bdc-2b874543b1a8\E556.exe

MD5 742fda7bfe69e131aa3d3eefdf8c1331
SHA1 cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5
SHA256 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3
SHA512 c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a

memory/952-183-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E556.exe

MD5 742fda7bfe69e131aa3d3eefdf8c1331
SHA1 cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5
SHA256 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3
SHA512 c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a

memory/1352-185-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4204-186-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\5548.exe

MD5 291db64b3f2c354f3b57714df82b4dd9
SHA1 0c0e761f2d420d23216537811a47f471f05faae3
SHA256 7203df4933276db49cad9a404c55a76710e66b3a88ab50bf6b792ab402cdb60a
SHA512 f7369c06246a5932a6cbe1af161423b21b05a14e28664b07b5a9a039b992e11a9da7deaec8cb664df70ab5407ec999ab1ca8fee3bd4ceabe572d061b265df90f

C:\Users\Admin\AppData\Local\Temp\5548.exe

MD5 291db64b3f2c354f3b57714df82b4dd9
SHA1 0c0e761f2d420d23216537811a47f471f05faae3
SHA256 7203df4933276db49cad9a404c55a76710e66b3a88ab50bf6b792ab402cdb60a
SHA512 f7369c06246a5932a6cbe1af161423b21b05a14e28664b07b5a9a039b992e11a9da7deaec8cb664df70ab5407ec999ab1ca8fee3bd4ceabe572d061b265df90f

memory/1772-189-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E556.exe

MD5 742fda7bfe69e131aa3d3eefdf8c1331
SHA1 cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5
SHA256 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3
SHA512 c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a

memory/1772-192-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1772-193-0x0000000000400000-0x0000000000537000-memory.dmp

memory/952-194-0x0000000002068000-0x00000000020F9000-memory.dmp

memory/1772-195-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4128-196-0x0000000000000000-mapping.dmp

memory/2652-198-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

MD5 36fc2440660c5f4509c3abcdde9a1c3a
SHA1 23b9d0fe11194e29394beedddfd462225af5118e
SHA256 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d
SHA512 c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025

memory/672-199-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\E1BA.exe

MD5 36fc2440660c5f4509c3abcdde9a1c3a
SHA1 23b9d0fe11194e29394beedddfd462225af5118e
SHA256 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d
SHA512 c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025

memory/672-202-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4128-204-0x00000000008A0000-0x0000000000932000-memory.dmp

memory/672-203-0x0000000000400000-0x0000000000537000-memory.dmp

memory/672-205-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4216-206-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\7F57.exe

MD5 0d5b6d3c2dd0e9eb170ea1e1e06fb73d
SHA1 b4cd233e78c4b65fea910aefb33cd9cfdc07bfb4
SHA256 e0dc0990501e5fd3d56e2b77d99e6dd7256b576c63e011dbd273195ca380abc6
SHA512 65eb0ba45efe71fd0081f84988658176359926e1cbbd4333372cdcae4fffbdebda7f8a9065d12331476104e67406301e32496b880d51a19a3841ffe68b61ffe2

C:\Users\Admin\AppData\Local\Temp\7F57.exe

MD5 0d5b6d3c2dd0e9eb170ea1e1e06fb73d
SHA1 b4cd233e78c4b65fea910aefb33cd9cfdc07bfb4
SHA256 e0dc0990501e5fd3d56e2b77d99e6dd7256b576c63e011dbd273195ca380abc6
SHA512 65eb0ba45efe71fd0081f84988658176359926e1cbbd4333372cdcae4fffbdebda7f8a9065d12331476104e67406301e32496b880d51a19a3841ffe68b61ffe2

memory/4216-209-0x0000000000793000-0x00000000007C9000-memory.dmp

memory/4216-210-0x0000000000980000-0x00000000009D9000-memory.dmp

memory/4216-211-0x0000000000400000-0x00000000005B9000-memory.dmp

memory/4216-212-0x0000000004D60000-0x0000000005304000-memory.dmp

memory/4216-213-0x0000000005360000-0x0000000005978000-memory.dmp

memory/4216-214-0x00000000059A0000-0x00000000059B2000-memory.dmp

memory/4216-215-0x00000000059C0000-0x0000000005ACA000-memory.dmp

memory/4216-216-0x0000000005AD0000-0x0000000005B0C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8BEA.exe

MD5 cf1cd7888e18f113334c9808f4ddbeda
SHA1 43b2449d750204495a78d4ec18a78803b6739854
SHA256 30981f801025bb25be10c58844c42d051f6826782d4daa1eb8cfe62fbd8dcf1d
SHA512 bafae603b6fc5a8fafebbbf5461e5646ddd4a8c3863495ddf921ab169f45f2dd2861c3ce24623c2bcd02d1d419eaa502683e01c2103dae88d35fb52b5cd7536f

C:\Users\Admin\AppData\Local\Temp\8BEA.exe

MD5 cf1cd7888e18f113334c9808f4ddbeda
SHA1 43b2449d750204495a78d4ec18a78803b6739854
SHA256 30981f801025bb25be10c58844c42d051f6826782d4daa1eb8cfe62fbd8dcf1d
SHA512 bafae603b6fc5a8fafebbbf5461e5646ddd4a8c3863495ddf921ab169f45f2dd2861c3ce24623c2bcd02d1d419eaa502683e01c2103dae88d35fb52b5cd7536f

memory/4616-217-0x0000000000000000-mapping.dmp

memory/4068-220-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\90AE.exe

MD5 29f2ec28627a41db988319686656c43b
SHA1 be48f52c2b5a64462dde716372144e0b2f07c107
SHA256 5b956b5e5f3b322ed1e4b70a8891aee5cde1aaa0648d52173c633ee1714516cf
SHA512 04de4c4f7e30c96f75dd6f7726f2e9472b5bb1702eb023e6108c74d63ce99c70a1f7f773c5f72578cd941b0d719cabc0ff17619835cc8c5e9733751e31d53d49

C:\Users\Admin\AppData\Local\Temp\90AE.exe

MD5 29f2ec28627a41db988319686656c43b
SHA1 be48f52c2b5a64462dde716372144e0b2f07c107
SHA256 5b956b5e5f3b322ed1e4b70a8891aee5cde1aaa0648d52173c633ee1714516cf
SHA512 04de4c4f7e30c96f75dd6f7726f2e9472b5bb1702eb023e6108c74d63ce99c70a1f7f773c5f72578cd941b0d719cabc0ff17619835cc8c5e9733751e31d53d49

memory/4216-223-0x0000000005DE0000-0x0000000005E72000-memory.dmp

memory/4216-224-0x0000000005E80000-0x0000000005EE6000-memory.dmp

memory/4216-225-0x00000000066B0000-0x0000000006726000-memory.dmp

memory/4216-226-0x0000000006760000-0x000000000677E000-memory.dmp

memory/4216-227-0x0000000006910000-0x0000000006960000-memory.dmp

memory/1296-228-0x0000000000000000-mapping.dmp

memory/1296-229-0x00000000014F0000-0x00000000014F7000-memory.dmp

memory/1296-230-0x00000000014E0000-0x00000000014EB000-memory.dmp

memory/4408-231-0x0000000000000000-mapping.dmp

memory/4408-232-0x0000000000BB0000-0x0000000000BB9000-memory.dmp

memory/4408-233-0x0000000000BA0000-0x0000000000BAF000-memory.dmp

memory/2496-234-0x0000000000000000-mapping.dmp

memory/2496-235-0x0000000000860000-0x0000000000865000-memory.dmp

memory/2496-236-0x0000000000850000-0x0000000000859000-memory.dmp

memory/4216-237-0x0000000006970000-0x0000000006B32000-memory.dmp

memory/4216-238-0x0000000006B50000-0x000000000707C000-memory.dmp

memory/644-239-0x0000000000000000-mapping.dmp

memory/644-240-0x0000000001200000-0x0000000001206000-memory.dmp

memory/644-241-0x0000000000FF0000-0x0000000000FFC000-memory.dmp

memory/1012-242-0x0000000000000000-mapping.dmp

memory/1012-243-0x0000000000D70000-0x0000000000D92000-memory.dmp

memory/1012-244-0x0000000000D40000-0x0000000000D67000-memory.dmp

memory/2992-245-0x0000000000000000-mapping.dmp

memory/4216-246-0x0000000000793000-0x00000000007C9000-memory.dmp

memory/4216-247-0x0000000000400000-0x00000000005B9000-memory.dmp

memory/2992-248-0x0000000000C30000-0x0000000000C35000-memory.dmp

memory/2992-249-0x0000000000C20000-0x0000000000C29000-memory.dmp

memory/4988-250-0x0000000000000000-mapping.dmp

memory/4988-251-0x00000000006C0000-0x00000000006C6000-memory.dmp

memory/4988-252-0x00000000006B0000-0x00000000006BB000-memory.dmp

memory/1828-253-0x0000000000000000-mapping.dmp

memory/1828-254-0x0000000000AC0000-0x0000000000AC7000-memory.dmp

memory/1828-255-0x0000000000AB0000-0x0000000000ABD000-memory.dmp

memory/2088-256-0x0000000000000000-mapping.dmp

memory/2088-257-0x00000000007B0000-0x00000000007B8000-memory.dmp

memory/2088-258-0x00000000007A0000-0x00000000007AB000-memory.dmp

memory/1296-259-0x00000000014F0000-0x00000000014F7000-memory.dmp

memory/4408-260-0x0000000000BB0000-0x0000000000BB9000-memory.dmp

C:\SystemID\PersonalID.txt

MD5 93e6ebd9709635bbf8a4315de6b1e3fc
SHA1 4aa76931cfb3427be53bb23ac3ec4c2cd3c9b57d
SHA256 860b7c8f1f9a577faeb82546f3013418aee5639a1afcd1c66259ddb8cc9d98e6
SHA512 d1605438085003bfb4bb1ba87c00f0f1b971bde3458ded3b02fc6d9ae5f6d499e0c0d43e7fadf81c8f485032cd41157a5f699f1e9b9f89a0ab0c45955a671852

C:\Users\Admin\AppData\Local\bowsakkdestx.txt

MD5 e134b33ebc4a28eff7c845e00e5bdbc1
SHA1 ab0a4f50802c16d46b5f320853cb4d9fc35c26ea
SHA256 093b5b6b217b3b3f8ac79ac51de93e4652f05aeebf35b7dbb6925eafc85b3a46
SHA512 12cb2da4b5fec37bf1a6d27656518b43bc5051eb30121506972e45142abc5bab4b66501f7e9e3f9ff1743fb6077ab8e399f5e5481c034a604d95e8a35c3551ed

memory/2496-263-0x0000000000860000-0x0000000000865000-memory.dmp

memory/3384-269-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe

MD5 5fd8c38657bb9393bb4736c880675223
SHA1 f3a03b2e75cef22262f6677e3832b6ad9327905c
SHA256 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6
SHA512 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe

C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe

MD5 5fd8c38657bb9393bb4736c880675223
SHA1 f3a03b2e75cef22262f6677e3832b6ad9327905c
SHA256 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6
SHA512 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe

memory/1656-272-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build3.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build3.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

memory/4924-275-0x0000000000000000-mapping.dmp

memory/376-276-0x0000000000000000-mapping.dmp

memory/376-277-0x0000000000400000-0x0000000000463000-memory.dmp

C:\Users\Admin\AppData\Local\b38ac99e-6abe-4e54-ba9c-cda6ade4fb45\build2.exe

MD5 5fd8c38657bb9393bb4736c880675223
SHA1 f3a03b2e75cef22262f6677e3832b6ad9327905c
SHA256 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6
SHA512 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe

memory/376-281-0x0000000000400000-0x0000000000463000-memory.dmp

memory/376-284-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/4656-305-0x0000000000000000-mapping.dmp

memory/3648-306-0x0000000000000000-mapping.dmp

memory/3012-308-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

memory/1776-311-0x0000000000000000-mapping.dmp

memory/5044-312-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build2.exe

MD5 5fd8c38657bb9393bb4736c880675223
SHA1 f3a03b2e75cef22262f6677e3832b6ad9327905c
SHA256 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6
SHA512 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe

C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build2.exe

MD5 5fd8c38657bb9393bb4736c880675223
SHA1 f3a03b2e75cef22262f6677e3832b6ad9327905c
SHA256 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6
SHA512 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe

memory/828-315-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build3.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build3.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

memory/952-318-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\701b0600-a054-4fcd-9f99-0e2989daf063\build2.exe

MD5 5fd8c38657bb9393bb4736c880675223
SHA1 f3a03b2e75cef22262f6677e3832b6ad9327905c
SHA256 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6
SHA512 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe