Analysis Overview
SHA256
1e2cccc0f24a39856eeff87ee08f3e1baf14e7bd1155a0c6e5671019b01b1fa9
Threat Level: Known bad
The file file was found to be: Known bad.
Malicious Activity Summary
DcRat
Vidar
Djvu Ransomware
Detected Djvu ransomware
SmokeLoader
Detects Smokeloader packer
DCRat payload
Executes dropped EXE
Downloads MZ/PE file
Reads user/profile data of web browsers
Checks computer location settings
Loads dropped DLL
Uses the VBS compiler for execution
Modifies file permissions
Legitimate hosting services abused for malware hosting/C2
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Looks up external IP address via web service
Checks installed software on the system
Adds Run key to start application
Accesses 2FA software files, possible credential harvesting
Suspicious use of SetThreadContext
Enumerates physical storage devices
Program crash
Suspicious behavior: MapViewOfSection
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
outlook_office_path
Suspicious behavior: GetForegroundWindowSpam
outlook_win_path
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Kills process with taskkill
Delays execution with timeout.exe
Checks SCSI registry key(s)
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-10-19 08:03
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2022-10-19 08:03
Reported
2022-10-19 08:06
Platform
win10v2004-20220901-en
Max time kernel
150s
Max time network
150s
Command Line
Signatures
DcRat
Detected Djvu ransomware
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Smokeloader packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Djvu Ransomware
SmokeLoader
Vidar
DCRat payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Downloads MZ/PE file
Executes dropped EXE
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\3633.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\3923.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\3633.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\3923.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\regsvr32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe | N/A |
Modifies file permissions
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\icacls.exe | N/A |
Reads user/profile data of web browsers
Uses the VBS compiler for execution
Accesses 2FA software files, possible credential harvesting
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6d12ff1f-009e-46cb-aeec-b27d67caf3fa\\3923.exe\" --AutoStart" | C:\Users\Admin\AppData\Local\Temp\3923.exe | N/A |
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
| N/A | api.2ip.ua | N/A | N/A |
Suspicious use of SetThreadContext
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\CEFE.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\3B47.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\3B47.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\3B47.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Kills process with taskkill
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3B47.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\taskkill.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\CEFE.exe | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Windows\SysWOW64\explorer.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
C:\Users\Admin\AppData\Local\Temp\3633.exe
C:\Users\Admin\AppData\Local\Temp\3633.exe
C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3847.dll
C:\Windows\SysWOW64\regsvr32.exe
/s C:\Users\Admin\AppData\Local\Temp\3847.dll
C:\Users\Admin\AppData\Local\Temp\3923.exe
C:\Users\Admin\AppData\Local\Temp\3923.exe
C:\Users\Admin\AppData\Local\Temp\3B47.exe
C:\Users\Admin\AppData\Local\Temp\3B47.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Users\Admin\AppData\Local\Temp\3923.exe
C:\Users\Admin\AppData\Local\Temp\3923.exe
C:\Users\Admin\AppData\Local\Temp\3633.exe
C:\Users\Admin\AppData\Local\Temp\3633.exe
C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\6d12ff1f-009e-46cb-aeec-b27d67caf3fa" /deny *S-1-1-0:(OI)(CI)(DE,DC)
C:\Users\Admin\AppData\Local\Temp\3633.exe
"C:\Users\Admin\AppData\Local\Temp\3633.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\3633.exe
"C:\Users\Admin\AppData\Local\Temp\3633.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\Temp\3923.exe
"C:\Users\Admin\AppData\Local\Temp\3923.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe
"C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe"
C:\Users\Admin\AppData\Local\Temp\3923.exe
"C:\Users\Admin\AppData\Local\Temp\3923.exe" --Admin IsNotAutoStart IsNotTask
C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe
"C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe"
C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build3.exe
"C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build3.exe"
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build2.exe
"C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build2.exe"
C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build2.exe
"C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build2.exe"
C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build3.exe
"C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build3.exe"
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" C/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe" & del C:\PrograData\*.dll & exit
C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
C:\Windows\SysWOW64\timeout.exe
timeout /t 6
C:\Users\Admin\AppData\Local\Temp\AC32.exe
C:\Users\Admin\AppData\Local\Temp\AC32.exe
C:\Users\Admin\AppData\Local\Temp\BF0F.exe
C:\Users\Admin\AppData\Local\Temp\BF0F.exe
C:\Users\Admin\AppData\Local\Temp\CEFE.exe
C:\Users\Admin\AppData\Local\Temp\CEFE.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
C:\Users\Admin\AppData\Local\Temp\DEDE.exe
C:\Users\Admin\AppData\Local\Temp\DEDE.exe
C:\Users\Admin\AppData\Local\Temp\E279.exe
C:\Users\Admin\AppData\Local\Temp\E279.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 88628 -ip 88628
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 88628 -s 1676
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
Network
| Country | Destination | Domain | Proto |
| US | 20.42.65.84:443 | tcp | |
| US | 8.8.8.8:53 | furubujjul.net | udp |
| US | 172.67.203.213:80 | furubujjul.net | tcp |
| RU | 185.174.137.174:80 | 185.174.137.174 | tcp |
| US | 172.67.203.213:80 | furubujjul.net | tcp |
| US | 8.8.8.8:53 | api.2ip.ua | udp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | winnlinne.com | udp |
| US | 8.8.8.8:53 | rgyui.top | udp |
| KW | 37.34.248.24:80 | rgyui.top | tcp |
| MN | 203.91.116.53:80 | winnlinne.com | tcp |
| MN | 203.91.116.53:80 | winnlinne.com | tcp |
| NL | 162.0.217.254:443 | api.2ip.ua | tcp |
| US | 8.8.8.8:53 | rgyui.top | udp |
| PA | 190.122.162.239:80 | rgyui.top | tcp |
| US | 8.8.8.8:53 | t.me | udp |
| NL | 149.154.167.99:443 | t.me | tcp |
| DE | 116.202.186.42:80 | 116.202.186.42 | tcp |
| MN | 203.91.116.53:80 | winnlinne.com | tcp |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| US | 8.8.8.8:53 | avtlsgosecure.com | udp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 140.82.113.4:443 | github.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 8.8.8.8:53 | supremetechnologiesindia.com | udp |
| SG | 217.21.74.123:443 | supremetechnologiesindia.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 8.8.8.8:53 | 1drv.ms | udp |
| US | 13.107.42.12:443 | 1drv.ms | tcp |
| US | 8.8.8.8:53 | onedrive.live.com | udp |
| US | 13.107.42.13:443 | onedrive.live.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 8.8.8.8:53 | siasky.net | udp |
| US | 162.244.80.49:443 | siasky.net | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 8.8.8.8:53 | bitbucket.org | udp |
| US | 104.192.141.1:443 | bitbucket.org | tcp |
| US | 8.8.8.8:53 | bbuseruploads.s3.amazonaws.com | udp |
| US | 52.216.185.67:443 | bbuseruploads.s3.amazonaws.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| SG | 217.21.74.123:443 | supremetechnologiesindia.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 45.15.156.37:110 | tcp | |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| RU | 185.173.39.246:80 | avtlsgosecure.com | tcp |
| US | 93.184.221.240:80 | tcp | |
| RU | 185.174.136.187:80 | 185.174.136.187 | tcp |
| RU | 185.174.136.187:80 | 185.174.136.187 | tcp |
| NL | 104.80.229.204:443 | tcp | |
| RU | 185.174.136.187:80 | tcp |
Files
memory/4788-132-0x0000000000603000-0x0000000000614000-memory.dmp
memory/4788-133-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/4788-134-0x0000000000400000-0x0000000000597000-memory.dmp
memory/4788-135-0x0000000000400000-0x0000000000597000-memory.dmp
memory/5012-136-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\3633.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
C:\Users\Admin\AppData\Local\Temp\3633.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
memory/2260-139-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\3847.dll
| MD5 | 198309de59fae38094f89e9c3f819974 |
| SHA1 | 925559874ad6edb9b98a21328c6322d8476e1618 |
| SHA256 | d784f4cb44db7002b485bb59fa81291993a34a81a9d31393682419c7ddd7a01f |
| SHA512 | 39e2d3bf17dbd3fa0817fe5779e7786c0edfdde492a2dd7e1e7ae68fa08d9d5d91c5441c2c54a154847f6d31192f25de5c332841d9b7bf2c2223b467f3840660 |
memory/2292-141-0x0000000000000000-mapping.dmp
memory/1604-142-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\3923.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
C:\Users\Admin\AppData\Local\Temp\3923.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
C:\Users\Admin\AppData\Local\Temp\3847.dll
| MD5 | 198309de59fae38094f89e9c3f819974 |
| SHA1 | 925559874ad6edb9b98a21328c6322d8476e1618 |
| SHA256 | d784f4cb44db7002b485bb59fa81291993a34a81a9d31393682419c7ddd7a01f |
| SHA512 | 39e2d3bf17dbd3fa0817fe5779e7786c0edfdde492a2dd7e1e7ae68fa08d9d5d91c5441c2c54a154847f6d31192f25de5c332841d9b7bf2c2223b467f3840660 |
memory/3100-146-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\3B47.exe
| MD5 | 777292dc65b739d5337a8c0e21b100ca |
| SHA1 | ddbacd59c2e763143bf1e32d71d7d3e4fc4d60bb |
| SHA256 | 8f098d3db473a169c44697130f8af8d54d2cef231d17fb384fe5a2b2ccff6715 |
| SHA512 | 5050939595837ddd44de06d2de57bbc0310444f8838f3a3e24c9a35100d9061e5514bc22d5dbaf31c6972261b6849d3d3804d763d9ae3d5e3b27b832815164be |
C:\Users\Admin\AppData\Local\Temp\3B47.exe
| MD5 | 777292dc65b739d5337a8c0e21b100ca |
| SHA1 | ddbacd59c2e763143bf1e32d71d7d3e4fc4d60bb |
| SHA256 | 8f098d3db473a169c44697130f8af8d54d2cef231d17fb384fe5a2b2ccff6715 |
| SHA512 | 5050939595837ddd44de06d2de57bbc0310444f8838f3a3e24c9a35100d9061e5514bc22d5dbaf31c6972261b6849d3d3804d763d9ae3d5e3b27b832815164be |
memory/2264-149-0x0000000000000000-mapping.dmp
memory/1064-150-0x0000000000000000-mapping.dmp
memory/2264-151-0x0000000000300000-0x0000000000375000-memory.dmp
memory/2264-152-0x0000000000290000-0x00000000002FB000-memory.dmp
memory/1064-154-0x0000000000630000-0x000000000063C000-memory.dmp
memory/5012-155-0x00000000021D0000-0x00000000022EB000-memory.dmp
memory/5012-153-0x0000000000899000-0x000000000092B000-memory.dmp
memory/2292-156-0x0000000003670000-0x0000000003784000-memory.dmp
memory/2292-157-0x0000000003430000-0x0000000003544000-memory.dmp
memory/3100-160-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/3100-159-0x00000000005F3000-0x0000000000604000-memory.dmp
memory/2264-158-0x0000000000290000-0x00000000002FB000-memory.dmp
memory/3100-161-0x0000000000400000-0x0000000000597000-memory.dmp
memory/1752-162-0x0000000000000000-mapping.dmp
memory/1752-166-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3923.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
memory/1752-163-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2848-164-0x0000000000000000-mapping.dmp
memory/1604-168-0x0000000002031000-0x00000000020C2000-memory.dmp
memory/2848-170-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2848-172-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1752-171-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3633.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
memory/1752-173-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2848-174-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | 97ab7ffd65186e85f453dc7c02637528 |
| SHA1 | f22312a6a44613be85c0370878456a965f869a40 |
| SHA256 | 630df8e970cc3b1ad508db713dd8be52e0ac7a5826f3f264a266232f9a1c23ee |
| SHA512 | 37d90c98e72ad55b2cbb938541c81bac1aa9d2b8a7e19f0fbfaa365b49e7bef2d3199f03e46aa9fbf3055f3701d21860820c451065f7e425d39bf86ca606bfb0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | e75ab684898228b0d72827ca26ed3379 |
| SHA1 | 16bde13d5a3d31db71331831fb231efd068db9e1 |
| SHA256 | 7ae23b770417158e2e23fe617a3ecf57384d4c4147c1d2cf23df6f8d33a58e68 |
| SHA512 | c72d5c83c2b878aa3a4f674df92ed22aa2bb6527c2a1d18638be0e09597f3abc451d38156c04a179371e3a9291ff871d366e5470c3496a45e39e8ec4cc534804 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 006c98bc42ac1d15f0ec70e3488783c5 |
| SHA1 | a8c8302826468c903b511e206d6d058e2c3acdaa |
| SHA256 | e24883740fbed2781e4df4e5387cd95c3345ec9944edeeb36babd2c10135fa00 |
| SHA512 | e0caea17f99a18483e0195c5311942c195ef42532f1868bfb5c64b3f6cb72cc0fc58414176a9bfc66452e11d17c2058eafb483a41890f502ec76dc3a6807f2f4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | e4d559b63ffd84541a14e3e09f312aeb |
| SHA1 | 51b3754a2cffd181e772e4c26ebf1b9ed2afe345 |
| SHA256 | b595e1bda55c808902b23b9da6e8b621a9283ec55751f80a0e65417d96ed9fe1 |
| SHA512 | 9d04c2c0917aece38bb9a147aa7f02415874975f1d483fbc73c6fd333d71b8cf9f5012a4d2d03da52eadd583155bc4f250d0bc92d0e879154d4a33e761a17224 |
memory/3604-179-0x0000000000000000-mapping.dmp
memory/1088-180-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\3633.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
memory/2848-181-0x0000000000400000-0x0000000000537000-memory.dmp
memory/5112-183-0x0000000000000000-mapping.dmp
memory/3100-187-0x0000000000400000-0x0000000000597000-memory.dmp
memory/1088-188-0x00000000006F5000-0x0000000000787000-memory.dmp
memory/5112-189-0x0000000000400000-0x0000000000537000-memory.dmp
memory/5112-186-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3633.exe
| MD5 | 36fc2440660c5f4509c3abcdde9a1c3a |
| SHA1 | 23b9d0fe11194e29394beedddfd462225af5118e |
| SHA256 | 78f55fd75a0e521099c5f29bc271195d0ac94fbd3a5332b022eae4f0f304df2d |
| SHA512 | c77645c4fcc5c41129d6528d768919c0b470840417a49a0fb899e30740bae25ff5819fab37d765db1a5b86406343b561a8e03aa0033cf44a0afae711d3f4f025 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | 97ab7ffd65186e85f453dc7c02637528 |
| SHA1 | f22312a6a44613be85c0370878456a965f869a40 |
| SHA256 | 630df8e970cc3b1ad508db713dd8be52e0ac7a5826f3f264a266232f9a1c23ee |
| SHA512 | 37d90c98e72ad55b2cbb938541c81bac1aa9d2b8a7e19f0fbfaa365b49e7bef2d3199f03e46aa9fbf3055f3701d21860820c451065f7e425d39bf86ca606bfb0 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 006c98bc42ac1d15f0ec70e3488783c5 |
| SHA1 | a8c8302826468c903b511e206d6d058e2c3acdaa |
| SHA256 | e24883740fbed2781e4df4e5387cd95c3345ec9944edeeb36babd2c10135fa00 |
| SHA512 | e0caea17f99a18483e0195c5311942c195ef42532f1868bfb5c64b3f6cb72cc0fc58414176a9bfc66452e11d17c2058eafb483a41890f502ec76dc3a6807f2f4 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
| MD5 | 402df0e7f8c20de0e101c5da1007cf4e |
| SHA1 | 8ffcd55b1d1048e1a410c2e56c1247aff44bf1c3 |
| SHA256 | 905dfe9499339dd9ab4a89689d24c09ed9370712247d97668951137b4885abbd |
| SHA512 | 24376d8525cd4b57072121c85f5af41ed470fd3cf9d0cf77bf7e05e1aa51161d1d63935bda4b2cd1dda4ce6504c2facaa677d24672d19ef0ce2a532d56728de8 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
| MD5 | 25ab23c5085cc921c959832cb725ac2d |
| SHA1 | 31a6e95c0481f96143b148d0918a809b64426359 |
| SHA256 | a27006824c37d23534a38cdde0c18cf634e03707063d057e8402c50b7640940a |
| SHA512 | dcdcb3df74d62ab7eabd9f50d57ddf2b2bf2840e046864415ff34a8d768e8917dc74f9d02a1c748d89ee4c2e85037dc55e1c8f681c13fde5d864434ec500e133 |
C:\Users\Admin\AppData\Local\6d12ff1f-009e-46cb-aeec-b27d67caf3fa\3923.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
memory/5112-195-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1752-197-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2856-196-0x0000000000000000-mapping.dmp
memory/2292-199-0x00000000037A0000-0x0000000003862000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\3923.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
memory/2292-200-0x0000000003880000-0x000000000392D000-memory.dmp
memory/2292-203-0x0000000003670000-0x0000000003784000-memory.dmp
memory/3332-204-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
memory/2856-207-0x000000000200F000-0x00000000020A0000-memory.dmp
memory/1100-208-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\3923.exe
| MD5 | 742fda7bfe69e131aa3d3eefdf8c1331 |
| SHA1 | cf9ba02eb8d2f0ce7ed0de673d400cac1d6e58e5 |
| SHA256 | 50b28d1991ce1176d2f27a7181a7c42a72fee62ea3b08815984d3c9ab13aafc3 |
| SHA512 | c68421172fc131d71c26086456502dd7db80e02487407ed686c12f86c9a3574fc620aca019bd17fe744fac911ffebbc92027868f00ef2fa7ce6db7ecb3cf967a |
memory/1100-211-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1100-212-0x0000000000400000-0x0000000000537000-memory.dmp
C:\SystemID\PersonalID.txt
| MD5 | faba7c65ae1d24d1b05e6bcc13fbecac |
| SHA1 | 6c2e304b7aa7d9458556c0765bb1dc905d61020e |
| SHA256 | 773aa9a66cf8d85c68992d59a48c7f1352c47e95f435542ea43f0f8c605e716f |
| SHA512 | 3ddb022d5a8ea669d92a51ac058a249b134889846d5a56ac7da638a38ae6d6fcb199fcdefc76c9f587ec8da8138dfce57c2936b9b698eb8e911ac673d19c3e1c |
C:\Users\Admin\AppData\Local\bowsakkdestx.txt
| MD5 | 8a11f355b2ad76b53abb941d2bad4e5c |
| SHA1 | 0bd27c91ca1c20e1875fdc1b2926eee70bc5fb90 |
| SHA256 | 266f25d5478eeaccf96a22254e487d10637474793791428d18edd2225ec71516 |
| SHA512 | 58bd40d4c8a25243fe5959ca6d9b29230089b7508a5ccdf3fdaede242ed188954f0e9c7b18b4ae9bb3300da605acf7da7c22668735fb8ff42cd54019f3ce6aa3 |
memory/1100-215-0x0000000000400000-0x0000000000537000-memory.dmp
C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/1044-217-0x0000000000000000-mapping.dmp
memory/2240-216-0x0000000000000000-mapping.dmp
memory/2240-218-0x0000000000400000-0x0000000000463000-memory.dmp
C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
memory/3332-224-0x000000000088D000-0x00000000008B9000-memory.dmp
memory/2240-226-0x0000000000400000-0x0000000000463000-memory.dmp
memory/3332-225-0x0000000000810000-0x000000000085F000-memory.dmp
memory/4088-221-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\d17891cf-a296-4152-9c29-f7b846d78efe\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/2240-227-0x0000000000400000-0x0000000000463000-memory.dmp
memory/60-228-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
memory/2240-231-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/3276-250-0x0000000000000000-mapping.dmp
memory/4492-252-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
memory/3560-260-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build3.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/60-256-0x00000000005B0000-0x00000000006B0000-memory.dmp
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
C:\Users\Admin\AppData\Local\72075b4a-78a6-47ba-9d88-ea160fa98d79\build2.exe
| MD5 | 5fd8c38657bb9393bb4736c880675223 |
| SHA1 | f3a03b2e75cef22262f6677e3832b6ad9327905c |
| SHA256 | 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6 |
| SHA512 | 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe |
memory/5112-263-0x0000000000400000-0x0000000000537000-memory.dmp
memory/3276-264-0x0000000000400000-0x0000000000463000-memory.dmp
memory/8-265-0x0000000000000000-mapping.dmp
memory/4544-266-0x0000000000000000-mapping.dmp
memory/2240-267-0x0000000000400000-0x0000000000463000-memory.dmp
memory/5036-268-0x0000000000000000-mapping.dmp
memory/1100-269-0x0000000000400000-0x0000000000537000-memory.dmp
memory/60-270-0x00000000005B0000-0x00000000006B0000-memory.dmp
memory/2044-271-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\AC32.exe
| MD5 | afe0427e2b13bd48a876efd73920b329 |
| SHA1 | 92c8dbf8befc5a30f55e8c3a8c9b752acddbc1fa |
| SHA256 | 616a594fa1acf24ab1b53c1ea907aff5ca28255389526366457be3ff766267cf |
| SHA512 | d76f9f640bcca6a78f146e8b7aef3974aba155bfed178ffed06328c1780d4d068dd754b24a9d42dfc9d6a91d0fc8340cbbd312c9ed547f6cec7318cb0893757f |
C:\Users\Admin\AppData\Local\Temp\AC32.exe
| MD5 | afe0427e2b13bd48a876efd73920b329 |
| SHA1 | 92c8dbf8befc5a30f55e8c3a8c9b752acddbc1fa |
| SHA256 | 616a594fa1acf24ab1b53c1ea907aff5ca28255389526366457be3ff766267cf |
| SHA512 | d76f9f640bcca6a78f146e8b7aef3974aba155bfed178ffed06328c1780d4d068dd754b24a9d42dfc9d6a91d0fc8340cbbd312c9ed547f6cec7318cb0893757f |
memory/2264-274-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\BF0F.exe
| MD5 | d0a63ffb935e576faaf899e0325eaf37 |
| SHA1 | 6442898ac83279e2efef17c86e436f42b122d458 |
| SHA256 | 14c5e0e844ec8606e24a139aabc000b4f97b74dd2ce0ebfa8a71dc596e319314 |
| SHA512 | 250002da51e06a6edd444b4f5c4e3b3f53f2b2e765cda4090ab3255f539eeb219ae47bec101dc349cf530213476f4d7bfcfd9a54d521d61a3f3f84646bbb9bad |
C:\Users\Admin\AppData\Local\Temp\BF0F.exe
| MD5 | d0a63ffb935e576faaf899e0325eaf37 |
| SHA1 | 6442898ac83279e2efef17c86e436f42b122d458 |
| SHA256 | 14c5e0e844ec8606e24a139aabc000b4f97b74dd2ce0ebfa8a71dc596e319314 |
| SHA512 | 250002da51e06a6edd444b4f5c4e3b3f53f2b2e765cda4090ab3255f539eeb219ae47bec101dc349cf530213476f4d7bfcfd9a54d521d61a3f3f84646bbb9bad |
memory/88628-277-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\CEFE.exe
| MD5 | 0d5b6d3c2dd0e9eb170ea1e1e06fb73d |
| SHA1 | b4cd233e78c4b65fea910aefb33cd9cfdc07bfb4 |
| SHA256 | e0dc0990501e5fd3d56e2b77d99e6dd7256b576c63e011dbd273195ca380abc6 |
| SHA512 | 65eb0ba45efe71fd0081f84988658176359926e1cbbd4333372cdcae4fffbdebda7f8a9065d12331476104e67406301e32496b880d51a19a3841ffe68b61ffe2 |
C:\Users\Admin\AppData\Local\Temp\CEFE.exe
| MD5 | 0d5b6d3c2dd0e9eb170ea1e1e06fb73d |
| SHA1 | b4cd233e78c4b65fea910aefb33cd9cfdc07bfb4 |
| SHA256 | e0dc0990501e5fd3d56e2b77d99e6dd7256b576c63e011dbd273195ca380abc6 |
| SHA512 | 65eb0ba45efe71fd0081f84988658176359926e1cbbd4333372cdcae4fffbdebda7f8a9065d12331476104e67406301e32496b880d51a19a3841ffe68b61ffe2 |
memory/99944-280-0x0000000000000000-mapping.dmp
memory/99944-281-0x0000000000400000-0x0000000000570000-memory.dmp
memory/99944-287-0x0000000005D50000-0x00000000062F4000-memory.dmp
memory/88628-288-0x00000000008F3000-0x000000000092A000-memory.dmp
memory/88628-289-0x0000000000860000-0x00000000008B9000-memory.dmp
memory/88628-290-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/88628-291-0x00000000051F0000-0x0000000005808000-memory.dmp
memory/88628-292-0x0000000005860000-0x0000000005872000-memory.dmp
memory/99944-293-0x0000000005990000-0x00000000059E0000-memory.dmp
memory/99944-294-0x0000000006830000-0x0000000006D5C000-memory.dmp
memory/88628-295-0x0000000005880000-0x000000000598A000-memory.dmp
memory/99944-296-0x0000000006370000-0x00000000063D6000-memory.dmp
memory/88628-297-0x0000000005990000-0x00000000059CC000-memory.dmp
memory/100108-298-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\DEDE.exe
| MD5 | d93324a616729517a3062d21a6e06b3b |
| SHA1 | 6066c5473691809c5402c37a7ed6254112831a07 |
| SHA256 | ef4725f79586257a5dfc8dd43e69a36ef1722bbad65e0e8a0b38686ee3164631 |
| SHA512 | 3123327c9f5ac8651da4e7fc488c6da8fb1c632699f81143da3901b707fbcfa9b05802d5046a5ad91f2aafc900590ee223dcb3c34b96a5072d771148e7bdf303 |
C:\Users\Admin\AppData\Local\Temp\DEDE.exe
| MD5 | d93324a616729517a3062d21a6e06b3b |
| SHA1 | 6066c5473691809c5402c37a7ed6254112831a07 |
| SHA256 | ef4725f79586257a5dfc8dd43e69a36ef1722bbad65e0e8a0b38686ee3164631 |
| SHA512 | 3123327c9f5ac8651da4e7fc488c6da8fb1c632699f81143da3901b707fbcfa9b05802d5046a5ad91f2aafc900590ee223dcb3c34b96a5072d771148e7bdf303 |
memory/88628-301-0x0000000006380000-0x0000000006412000-memory.dmp
memory/100164-302-0x0000000000000000-mapping.dmp
C:\Users\Admin\AppData\Local\Temp\E279.exe
| MD5 | ec438afe4420c7c78e8f1edfd42a1b60 |
| SHA1 | 9e487d28ee5b9236c154753cdac489df12659047 |
| SHA256 | 3db03409cf96e3b5e4a41f8e6e64278840a673cc73c0c2c81ce8f9240e26d72e |
| SHA512 | 82f23fa0a89623ed9f5e0d9292959f03b1514b3f9e2cabb593eff7cdee4362d9cec3623b5238fecbd5a0541dbdf6bba89c17f0e9ec91c3cc3e14e53a61c38dc0 |
C:\Users\Admin\AppData\Local\Temp\E279.exe
| MD5 | ec438afe4420c7c78e8f1edfd42a1b60 |
| SHA1 | 9e487d28ee5b9236c154753cdac489df12659047 |
| SHA256 | 3db03409cf96e3b5e4a41f8e6e64278840a673cc73c0c2c81ce8f9240e26d72e |
| SHA512 | 82f23fa0a89623ed9f5e0d9292959f03b1514b3f9e2cabb593eff7cdee4362d9cec3623b5238fecbd5a0541dbdf6bba89c17f0e9ec91c3cc3e14e53a61c38dc0 |
memory/88628-305-0x0000000006440000-0x0000000006602000-memory.dmp
memory/88628-306-0x0000000006D60000-0x0000000006DD6000-memory.dmp
memory/88628-307-0x0000000006E10000-0x0000000006E2E000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
| MD5 | 9ead10c08e72ae41921191f8db39bc16 |
| SHA1 | abe3bce01cd34afc88e2c838173f8c2bd0090ae1 |
| SHA256 | 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0 |
| SHA512 | aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a |
memory/100244-310-0x0000000000000000-mapping.dmp
memory/100280-311-0x0000000000000000-mapping.dmp
memory/100244-312-0x0000000000930000-0x0000000000937000-memory.dmp
memory/100244-313-0x0000000000920000-0x000000000092B000-memory.dmp
memory/100344-314-0x0000000000000000-mapping.dmp
memory/100344-315-0x0000000000D80000-0x0000000000D89000-memory.dmp
memory/100344-316-0x0000000000D70000-0x0000000000D7F000-memory.dmp
memory/1092-317-0x0000000000000000-mapping.dmp
memory/1092-318-0x00000000009A0000-0x00000000009A5000-memory.dmp
memory/1092-319-0x0000000000990000-0x0000000000999000-memory.dmp
memory/3776-320-0x0000000000000000-mapping.dmp
memory/3776-321-0x00000000012D0000-0x00000000012D6000-memory.dmp
memory/3776-322-0x00000000012C0000-0x00000000012CC000-memory.dmp
memory/4848-323-0x0000000000000000-mapping.dmp
memory/4848-324-0x0000000000970000-0x0000000000992000-memory.dmp
memory/4848-325-0x0000000000940000-0x0000000000967000-memory.dmp
memory/99944-326-0x0000000006810000-0x000000000681A000-memory.dmp
memory/836-327-0x0000000000000000-mapping.dmp
memory/836-328-0x0000000000930000-0x0000000000935000-memory.dmp
memory/836-329-0x0000000000920000-0x0000000000929000-memory.dmp
memory/3644-330-0x0000000000000000-mapping.dmp
memory/88628-331-0x00000000008F3000-0x000000000092A000-memory.dmp
memory/4652-335-0x0000000000000000-mapping.dmp
memory/3788-338-0x0000000000000000-mapping.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2022-10-19 08:03
Reported
2022-10-19 08:06
Platform
win7-20220812-en
Max time kernel
151s
Max time network
45s
Command Line
Signatures
Detects Smokeloader packer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
SmokeLoader
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\file.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
Network
Files
memory/1100-54-0x0000000000788000-0x0000000000799000-memory.dmp
memory/1100-55-0x00000000763F1000-0x00000000763F3000-memory.dmp
memory/1100-57-0x0000000000220000-0x0000000000229000-memory.dmp
memory/1100-56-0x0000000000788000-0x0000000000799000-memory.dmp
memory/1100-58-0x0000000000400000-0x0000000000597000-memory.dmp
memory/1100-59-0x0000000000400000-0x0000000000597000-memory.dmp