Malware Analysis Report

2024-10-19 01:46

Sample ID 240725-rzdgnstfmq
Target 06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
SHA256 06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a
Tags
djvu aspackv2 discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a

Threat Level: Known bad

The file 06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe was found to be: Known bad.

Malicious Activity Summary

djvu aspackv2 discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Loads dropped DLL

Checks computer location settings

ASPack v2.12-2.42

Modifies file permissions

Executes dropped EXE

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-25 14:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 14:37

Reported

2024-07-25 14:40

Platform

win7-20240704-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1bcc1f6d-4d06-4323-964b-855aed832750\\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Windows Defender\MSASCui.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\SuspendCompare.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1828 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe
PID 1828 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe
PID 1828 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe
PID 1828 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1828 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 2872 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Windows\SysWOW64\icacls.exe
PID 2872 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Windows\SysWOW64\icacls.exe
PID 2872 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Windows\SysWOW64\icacls.exe
PID 2872 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Windows\SysWOW64\icacls.exe
PID 2872 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 2872 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 2872 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 2872 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 1788 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\oFykh.exe C:\Windows\SysWOW64\cmd.exe
PID 1788 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\oFykh.exe C:\Windows\SysWOW64\cmd.exe
PID 1788 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\oFykh.exe C:\Windows\SysWOW64\cmd.exe
PID 1788 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\oFykh.exe C:\Windows\SysWOW64\cmd.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 3036 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe"

C:\Users\Admin\AppData\Local\Temp\oFykh.exe

C:\Users\Admin\AppData\Local\Temp\oFykh.exe

C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\1bcc1f6d-4d06-4323-964b-855aed832750" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\4dad40de.bat" "

C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 rgyui.top udp
US 8.8.8.8:53 winnlinne.com udp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.16.170.49:80 crl.microsoft.com tcp

Files

memory/1828-1-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/1828-8-0x0000000000280000-0x0000000000311000-memory.dmp

\Users\Admin\AppData\Local\Temp\oFykh.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/1788-13-0x0000000000F40000-0x0000000000F49000-memory.dmp

memory/1828-12-0x0000000000F40000-0x0000000000F49000-memory.dmp

memory/1828-11-0x0000000000F40000-0x0000000000F49000-memory.dmp

memory/2872-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1828-28-0x0000000001E30000-0x0000000001F4B000-memory.dmp

memory/2872-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1828-26-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/2872-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2872-24-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1828-29-0x0000000000280000-0x0000000000311000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\0540095B.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GA43GQEJ\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

C:\Users\Admin\AppData\Local\1bcc1f6d-4d06-4323-964b-855aed832750\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

MD5 6dbbf4219ef0f8f36ddc3ca4cccc87ba
SHA1 3e28977bcc084ce28666e8cb04139f2d6d3e1545
SHA256 06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a
SHA512 5d4ee1617f950f7096cdb7fa7ac716e1d6260a38b0430ae04a0fa339149ea6202191bae04f26f88442057982c955b0c6e9aeec0a475f8a63efefebf68ad44199

memory/2872-64-0x0000000003A00000-0x0000000003AD0000-memory.dmp

memory/3036-69-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/2872-68-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-66-0x0000000000340000-0x00000000003D1000-memory.dmp

memory/1788-79-0x0000000000F40000-0x0000000000F49000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4dad40de.bat

MD5 d3754e433f7c2105f7bf2fe61e48c628
SHA1 41b80554cc83797eab49c83dffd3c1bdf866e619
SHA256 54f2ecf5cec3932815cade6a4d9b7b8b529f5c45189b7c830a200c1feadf8a65
SHA512 ea92c1ee08f23d9abcf396e3e46a6de860294887eb2d849e53e85caeb7a03892503f1cfa66e431e1051b56cadde2e52f4fef797e2520d3cda84ada8340c45ae8

memory/3036-84-0x0000000001F20000-0x0000000001FF0000-memory.dmp

memory/1668-86-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-85-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/3036-81-0x0000000000400000-0x00000000004D0000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 8b070b7216b2b9dad1284e12d6cb30af
SHA1 e46387d3dd32e7654b2de15f0ed7c98358028279
SHA256 de2ab4e74d125649a3485d95ef57f5707ca0f930fd1035acebf913343f72ba8d
SHA512 f8bf2b3998a165371a78247fd8808bc073c3afd2e6a24a1684aaa671cf1d72aab708103a0fbc9f0487fbbbf54c91a56a6f4564e63e99e7ab4c4ead60eb3ee70a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 1bfe0a81db078ea084ff82fe545176fe
SHA1 50b116f578bd272922fa8eae94f7b02fd3b88384
SHA256 5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
SHA512 37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 108b1f935c1caa83d80d6a1344cfd3a4
SHA1 7e747ab96e23400a88d31be1ec8daee6af5b1edf
SHA256 b7f54b958c05c2d162ac351dc47869bbf34b68a1bda680cc69b3278f25a605f5
SHA512 d3144fd0f7c8422e87d34672cd170479f66887d33d118c38cc0908eaac30dcc5978e0ec3a10f34d9d8cacb78d6690559ea49336d33c5e078eb47d946ddd653d2

C:\Users\Admin\AppData\Local\Temp\CabE688.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/1668-99-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1668-98-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1668-100-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1828-101-0x0000000000280000-0x0000000000311000-memory.dmp

memory/1668-104-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1668-106-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1668-107-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1668-108-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1668-109-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 14:37

Reported

2024-07-25 14:40

Platform

win10v2004-20240709-en

Max time kernel

141s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\43c81bc3-c724-4f16-b14c-9cb81baaf735\\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxOutlook.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\SoundRec.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\oFykh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4248 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe
PID 4248 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe
PID 4248 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\oFykh.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4248 wrote to memory of 4632 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4632 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Windows\SysWOW64\icacls.exe
PID 4632 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Windows\SysWOW64\icacls.exe
PID 4632 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Windows\SysWOW64\icacls.exe
PID 4632 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4632 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4632 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 4772 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\oFykh.exe C:\Windows\SysWOW64\cmd.exe
PID 4772 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\oFykh.exe C:\Windows\SysWOW64\cmd.exe
PID 4772 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\oFykh.exe C:\Windows\SysWOW64\cmd.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe
PID 5040 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe"

C:\Users\Admin\AppData\Local\Temp\oFykh.exe

C:\Users\Admin\AppData\Local\Temp\oFykh.exe

C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\43c81bc3-c724-4f16-b14c-9cb81baaf735" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\41865dac.bat" "

C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

"C:\Users\Admin\AppData\Local\Temp\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 rgyui.top udp
US 8.8.8.8:53 winnlinne.com udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 winnlinne.com udp
US 8.8.8.8:53 winnlinne.com udp
US 8.8.8.8:53 winnlinne.com udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 37.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp

Files

memory/4248-0-0x0000000000400000-0x00000000004D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\oFykh.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/4772-6-0x0000000000640000-0x0000000000649000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\559B0027.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCRJMNF7\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

memory/4248-29-0x0000000000730000-0x00000000007C8000-memory.dmp

memory/4632-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4248-30-0x00000000021F0000-0x000000000230B000-memory.dmp

memory/4632-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4248-34-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/4632-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4632-33-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\43c81bc3-c724-4f16-b14c-9cb81baaf735\06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a.exe

MD5 6dbbf4219ef0f8f36ddc3ca4cccc87ba
SHA1 3e28977bcc084ce28666e8cb04139f2d6d3e1545
SHA256 06388962bb9c2499117a658ac496d9bcc76e29cf560f551fef971996f037327a
SHA512 5d4ee1617f950f7096cdb7fa7ac716e1d6260a38b0430ae04a0fa339149ea6202191bae04f26f88442057982c955b0c6e9aeec0a475f8a63efefebf68ad44199

memory/4632-47-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5040-48-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/4772-67-0x0000000000640000-0x0000000000649000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41865dac.bat

MD5 105bb76da17cc336e25e20b664b9189f
SHA1 5ee180eebc65d71d89376f5b25da3671bb70553f
SHA256 38ec6fdf06f313c1bcde67d0645a7ec660c8af3bcc5dea39195910a5ff2a5771
SHA512 a573494f58b10ad5a7ea956363afa4dd4329ab4183950c81bb9e615446c9e448f8834fcee58add97d3aa0c18631a1828b8f5440dc053cacdf2e625cc28d599db

memory/5040-69-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/5040-72-0x0000000000400000-0x00000000004D0000-memory.dmp

memory/1028-71-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 1bfe0a81db078ea084ff82fe545176fe
SHA1 50b116f578bd272922fa8eae94f7b02fd3b88384
SHA256 5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
SHA512 37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 c04b503a1c3d2a3c63fb55a4d1524350
SHA1 ba24b8ebdef62927e449af83fcc7e498dbcaebf9
SHA256 0828e949a9f113298501c86f4361b6aff12974acd79e261e7bb2bc438b18cd8c
SHA512 6d13bc5153a6f0c992e9eb0fec922dabad1f5739f5fe65774ddaf53358507693248963b3b9a8b1f3e2d624cd846a8edc7ec9d71ac1f572d3a89e3b9557a06746

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 72189049a70475b2147ab41498789c9b
SHA1 27f47d54ef9da708506f2530f66ed51fcd741c48
SHA256 33f3df7cc289f5452641ea05c6853c6aaf3a16a61fc216eda43759aca096c379
SHA512 df42f6cfc496fd988457ad427702eff1ce766e0b6b9cb61fba8feade7bcd5eacd169cb4eb08317523e449aacf89ef152267e5656580c8cd574764a0b4e189e21

memory/1028-77-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-78-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-79-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-82-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-84-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-85-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-86-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-87-0x0000000000400000-0x0000000000537000-memory.dmp