djvu | f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f

Analysis

max time kernel
293s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 23:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
Size

785KB
MD5

0d4d8f1fbf7ef6cc30dfc1b267b0cd2c
SHA1

5e4c154733ec0964ac050b32ec54bfffa7def0fc
SHA256

f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f
SHA512

19f181995db6ca50a7f89f63fcc3ed6836c5b6de7fcd50db2f24fd6a098042b85b3c71264fa480c8b49e100468604cf3976453274e41d0e80db33c3d9e253c12
SSDEEP

12288:3/2PQ0JBxk/q//UmITXZZ2HcHJK3oFziEcybA6deZ3V5M:3/o/GqnlIzwIJKAzcyk6k5V6

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/test1/get.php

Attributes

extension
.vepi
offline_id
EGfa5svnSGFJka7LZBQoqff0QtO1IpTauoDvGvt1
payload_url
http://sdfjhuz.com/dl/build2.exe
http://cajgtus.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0871PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 13 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2880-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2320-5-0x0000000004600000-0x000000000471B000-memory.dmp	family_djvu
behavioral1/memory/2880-7-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2880-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2880-43-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2712-48-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2712-64-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2712-65-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2712-66-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2712-73-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2712-70-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2712-72-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2712-74-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2536 icacls.exe

pid	process
2536	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\5b5393f5-7948-41b7-8ad9-401e38036ed5\\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe\" --AutoStart"	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.2ip.ua
4 api.2ip.ua
16 api.2ip.ua

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
16	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

Processes:

f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exef1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe

description	pid	process	target process
PID 2320 set thread context of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 set thread context of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exef1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exef1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe

pid	process
2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
2712	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
2712	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exef1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exef1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe

C:\Users\Admin\AppData\Local\Temp\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
"C:\Users\Admin\AppData\Local\Temp\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2320

C:\Users\Admin\AppData\Local\Temp\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
"C:\Users\Admin\AppData\Local\Temp\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe"
2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\5b5393f5-7948-41b7-8ad9-401e38036ed5" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2536

C:\Users\Admin\AppData\Local\Temp\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
"C:\Users\Admin\AppData\Local\Temp\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2520

C:\Users\Admin\AppData\Local\Temp\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
"C:\Users\Admin\AppData\Local\Temp\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:2712

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
03c0f8ee77d876972cda274ac80f5e52

SHA1
a42ee63d82fae2390b4a3ee55dcaea356bc4e0d3

SHA256
d10478a42647f37ccbe419912d8ce3d35ccb84b5e83d8fce98d0b9baad81ccfe

SHA512
9d4c9deb0185c342cb20c17503e459a460313fd599a58e3a0e34c5e202bd4e44cf67f96275291eee922c55407404e71822bd5ae9924808544c3461e4e0080faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
80e49a74c391d7fab20ac4f705c04de6

SHA1
c0a4d094e6f4a991e43efd58987af74debe4b5bc

SHA256
aea7fe68d1333d46575467ac779d9f41006c490eaf6c86d4e9f8d2c23e9698f0

SHA512
87cdc0ecdbd143127319b3c0ff3a2e1aa1991961c14158ba7b14ce4ef3cf603857764d9a288a35584565becbe1709b3151411618150c336a6a9638076def7d9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
3f18e96e3372cd3a9e9ea99d73b58592

SHA1
cb89bb11475d7c7112cbbdcacfaeccc424db3209

SHA256
a9b60bc801bbe3a74e6eaf9e05b03beb62bcc792239c498f28b65678acf2c378

SHA512
b103e43024815c3fd9253834be3f0168d1ae78a315af3768c0e00edcccefadea6c16ac995014a127cec86d15aaec54862643b6b98105ee24a0cde2c7ed9bcab5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
a8edc466a3d6ef2ebb012fbadddc2687

SHA1
541472e6b75a73ad1cb86b6adc4c42e7357e6d3b

SHA256
ab60fb913125f7a94f75b0eeebcdf438ca4f04d99ee413f8d02380e2f8a6b9de

SHA512
5792a382287b8e1e5adf5add307517ac8010be47a85a67357a9039efa59b90c89dd91a18281fc5f86782a72b3f7078f41c54836338bcba476d4c5b120a59a2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
57aa930077a398d8140ce3fc77c2e6ac

SHA1
bc16c8d4f92ed737e44d1a69b05a6f658cfbec8a

SHA256
917147a3500b55905419a0fdde5ffd885b80e00037aa0060f68ad6b1f23fd1b1

SHA512
17b94630cad02f7d3935ef7f3ff2460ee6bacf662cd92de7a88d8ce62ad847716694845e8b6460d7c21be8c8ade8df6ee8a1a949ba3e942939b93eb9946503ee

Download Submit
C:\Users\Admin\AppData\Local\5b5393f5-7948-41b7-8ad9-401e38036ed5\f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
Filesize
785KB

MD5
0d4d8f1fbf7ef6cc30dfc1b267b0cd2c

SHA1
5e4c154733ec0964ac050b32ec54bfffa7def0fc

SHA256
f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f

SHA512
19f181995db6ca50a7f89f63fcc3ed6836c5b6de7fcd50db2f24fd6a098042b85b3c71264fa480c8b49e100468604cf3976453274e41d0e80db33c3d9e253c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar201F.tmp
Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
memory/2320-68-0x0000000000400000-0x0000000002D22000-memory.dmp

Filesize
41.1MB

Download
memory/2320-5-0x0000000004600000-0x000000000471B000-memory.dmp

Filesize
1.1MB

Download
memory/2320-0-0x00000000002E0000-0x0000000000371000-memory.dmp

Filesize
580KB

Download
memory/2520-45-0x0000000000320000-0x00000000003B1000-memory.dmp

Filesize
580KB

Download
memory/2712-64-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2712-65-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2712-48-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2712-66-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2712-73-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2712-70-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2712-72-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2712-74-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2880-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2880-43-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2880-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2880-7-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2880-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

description	pid	process	target process
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2320 wrote to memory of 2880	2320	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2880 wrote to memory of 2536	2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	icacls.exe
PID 2880 wrote to memory of 2536	2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	icacls.exe
PID 2880 wrote to memory of 2536	2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	icacls.exe
PID 2880 wrote to memory of 2536	2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	icacls.exe
PID 2880 wrote to memory of 2520	2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2880 wrote to memory of 2520	2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2880 wrote to memory of 2520	2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2880 wrote to memory of 2520	2880	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe
PID 2520 wrote to memory of 2712	2520	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe	f1068bf1348c18992c05859a866a75203ed9da51f418541ea2405a23136a579f.exe