Malware Analysis Report

2025-04-13 11:47

Sample ID 221019-sthpwadeh6
Target e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d
SHA256 e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d
Tags
djvu vidar 517 discovery persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d

Threat Level: Known bad

The file e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d was found to be: Known bad.

Malicious Activity Summary

djvu vidar 517 discovery persistence ransomware spyware stealer

Vidar

Detected Djvu ransomware

Djvu Ransomware

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Reads user/profile data of web browsers

Accesses 2FA software files, possible credential harvesting

Checks installed software on the system

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Kills process with taskkill

Checks processor information in registry

Delays execution with timeout.exe

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-10-19 15:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-10-19 15:24

Reported

2022-10-19 15:27

Platform

win10-20220901-en

Max time kernel

72s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Vidar

stealer vidar

Downloads MZ/PE file

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses 2FA software files, possible credential harvesting

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3f649837-45b2-4c32-93ca-cea6ae3e2f49\\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe N/A

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 2796 wrote to memory of 3868 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 3868 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Windows\SysWOW64\icacls.exe
PID 3868 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Windows\SysWOW64\icacls.exe
PID 3868 wrote to memory of 3712 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Windows\SysWOW64\icacls.exe
PID 3868 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 3868 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 3868 wrote to memory of 4040 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4040 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe
PID 4672 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 4672 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 4672 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 4672 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe
PID 4672 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe
PID 4672 wrote to memory of 424 N/A C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe
PID 3112 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 3112 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 3112 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 3112 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 3112 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 3112 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 3112 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 3112 wrote to memory of 648 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe
PID 424 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe C:\Windows\SysWOW64\schtasks.exe
PID 424 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe C:\Windows\SysWOW64\schtasks.exe
PID 424 wrote to memory of 196 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe C:\Windows\SysWOW64\schtasks.exe
PID 648 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Windows\SysWOW64\cmd.exe
PID 648 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Windows\SysWOW64\cmd.exe
PID 648 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe C:\Windows\SysWOW64\cmd.exe
PID 4268 wrote to memory of 5036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4268 wrote to memory of 5036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4268 wrote to memory of 5036 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskkill.exe
PID 4268 wrote to memory of 3616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4268 wrote to memory of 3616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4268 wrote to memory of 3616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4280 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Windows\SysWOW64\schtasks.exe
PID 4280 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Windows\SysWOW64\schtasks.exe
PID 4280 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe C:\Windows\SysWOW64\schtasks.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe

"C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe"

C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe

"C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\3f649837-45b2-4c32-93ca-cea6ae3e2f49" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe

"C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe

"C:\Users\Admin\AppData\Local\Temp\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe

"C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe"

C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe

"C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe"

C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe

"C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe"

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" ˆ>n/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe" & del C:\PrograData\*.dll & exit

C:\Windows\SysWOW64\taskkill.exe

taskkill /im build2.exe /f

C:\Windows\SysWOW64\timeout.exe

timeout /t 6

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

C:\Windows\SysWOW64\schtasks.exe

/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
NL 162.0.217.254:443 api.2ip.ua tcp
NL 162.0.217.254:443 api.2ip.ua tcp
US 8.8.8.8:53 rgyui.top udp
US 8.8.8.8:53 winnlinne.com udp
MX 187.212.210.12:80 winnlinne.com tcp
AR 186.182.55.44:80 rgyui.top tcp
MX 187.212.210.12:80 winnlinne.com tcp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
DE 116.202.186.42:80 116.202.186.42 tcp
US 20.42.65.89:443 tcp

Files

memory/2796-120-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-121-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-122-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-123-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-124-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-125-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-126-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-127-0x00000000006F3000-0x0000000000785000-memory.dmp

memory/2796-128-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-129-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-130-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-131-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-132-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-133-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-134-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-135-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-136-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-138-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-137-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-139-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-140-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-141-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-142-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-143-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-144-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-145-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-146-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-147-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/2796-149-0x0000000002470000-0x000000000258B000-memory.dmp

memory/3868-150-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-148-0x0000000000620000-0x000000000076A000-memory.dmp

memory/3868-151-0x0000000000424141-mapping.dmp

memory/3868-152-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-153-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-154-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-155-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-156-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-157-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3868-158-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-159-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-160-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-161-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-162-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-163-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-164-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-165-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-166-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-167-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-168-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-169-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-170-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-171-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-172-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-173-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-174-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-175-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-176-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-177-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-178-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-179-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-180-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-181-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-182-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-183-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-184-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-185-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-186-0x0000000077570000-0x00000000776FE000-memory.dmp

memory/3868-196-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3712-222-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\3f649837-45b2-4c32-93ca-cea6ae3e2f49\e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d.exe

MD5 c22635c443e935cc8253b6995f380c17
SHA1 d45265bacf92d91e39a712ee1838131c8cb5edef
SHA256 e832cbf4510f760b87fa2f9a9e7c009b9a83570266f0b428c1df646d98ada05d
SHA512 edd62057ba1247cdc634a5882640a254dc50c7d1c4c6bc55b6d3a8b666dc1d023694f12cab9fdfcba1e9fee58a33a5eb701b8e948accda51079df758c51636a2

memory/3868-250-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4040-248-0x0000000000000000-mapping.dmp

memory/4672-277-0x0000000000424141-mapping.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 97ab7ffd65186e85f453dc7c02637528
SHA1 f22312a6a44613be85c0370878456a965f869a40
SHA256 630df8e970cc3b1ad508db713dd8be52e0ac7a5826f3f264a266232f9a1c23ee
SHA512 37d90c98e72ad55b2cbb938541c81bac1aa9d2b8a7e19f0fbfaa365b49e7bef2d3199f03e46aa9fbf3055f3701d21860820c451065f7e425d39bf86ca606bfb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

MD5 0d4087ddcc4267b53303a7002b238c31
SHA1 bf0a0d0346eba627f4d72cadcf1b62a2898e81e3
SHA256 a57c09290ee098b2769731c6ce46cf97a369640d00aea13748bc6d744c7140b6
SHA512 c10e2846cd15e979ff28653e654fdf4d0dab48912052a0aba93ad567bb4880d5dd1395f554c6368e2aa8bfef63b1ede75025f4f43651d72097a593ddefa84bbb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5 35248626e22753e7931c1bb37e72b824
SHA1 14bc86e045e82285a0f3e1588f0eb4d90b728edc
SHA256 48f98d10f4e97cfb249ca5ca37b8824f45d8d0246a7437edeabf381e98f89284
SHA512 60b29acba93ed13164626c4c8c9d5d0c242bd263fda44b049afaab78d1d61ebe6e1a89fe9fb691c8bae9a809209086b9f7154b1d78b2d1042535c295db9749fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

MD5 006c98bc42ac1d15f0ec70e3488783c5
SHA1 a8c8302826468c903b511e206d6d058e2c3acdaa
SHA256 e24883740fbed2781e4df4e5387cd95c3345ec9944edeeb36babd2c10135fa00
SHA512 e0caea17f99a18483e0195c5311942c195ef42532f1868bfb5c64b3f6cb72cc0fc58414176a9bfc66452e11d17c2058eafb483a41890f502ec76dc3a6807f2f4

memory/4672-351-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3112-369-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe

MD5 5fd8c38657bb9393bb4736c880675223
SHA1 f3a03b2e75cef22262f6677e3832b6ad9327905c
SHA256 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6
SHA512 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe

C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe

MD5 5fd8c38657bb9393bb4736c880675223
SHA1 f3a03b2e75cef22262f6677e3832b6ad9327905c
SHA256 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6
SHA512 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe

memory/424-394-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build3.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

memory/3112-420-0x000000000084A000-0x0000000000876000-memory.dmp

memory/3112-423-0x00000000007E0000-0x000000000082F000-memory.dmp

memory/648-436-0x0000000000429CBD-mapping.dmp

C:\Users\Admin\AppData\Local\ce4985ab-c4a8-4a7e-a5d9-66eb5ab1bd6b\build2.exe

MD5 5fd8c38657bb9393bb4736c880675223
SHA1 f3a03b2e75cef22262f6677e3832b6ad9327905c
SHA256 2a5101345def285c8f52ad39f00261ba9e0375d3de73206d0b8c72ce3b6259c6
SHA512 43c82f6db716792a770a3573a9d20cb69a2421ccc2bb875e57f4270d92c9289ee684deda19e3232c50f4675aaf86de173f73376a00f927a8d9847f60b8b732fe

memory/3112-442-0x000000000084A000-0x0000000000876000-memory.dmp

memory/196-444-0x0000000000000000-mapping.dmp

memory/648-499-0x0000000000400000-0x0000000000463000-memory.dmp

memory/4672-527-0x0000000000400000-0x0000000000537000-memory.dmp

\ProgramData\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/4268-567-0x0000000000000000-mapping.dmp

memory/5036-573-0x0000000000000000-mapping.dmp

memory/648-575-0x0000000000400000-0x0000000000463000-memory.dmp

memory/3616-617-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

MD5 9ead10c08e72ae41921191f8db39bc16
SHA1 abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA256 8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512 aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

memory/4220-673-0x0000000000000000-mapping.dmp