Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2023 10:25

General

  • Target

    NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe

  • Size

    807KB

  • MD5

    c8f255dd1d501e90d5b383fe057d056b

  • SHA1

    66549427459c996431584a6d597e5b755f0f4bae

  • SHA256

    ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054

  • SHA512

    0cf26c04a2c6abf39b684e9501cf0dbc82b0f8d0ecd3d53b62c192c2b1e31d548ea58ce2054f4be40f4afe5a7b7d398c99e75e2a0a62d5ab0070cca45dacff0c

  • SSDEEP

    24576:yQhoQwr33TTTXutUnq2/DFcrfun0EOAO7sHcQEzEJSgaBrI:yQho3r33DDdrhnXRpjJS

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/test1/get.php

Attributes
  • extension

    .jazi

  • offline_id

    UlJXrkKDIkENh0vb5W9For2Yyh6riGytjO5p2St1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://zexeq.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iu965qqEb1 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0830Usdk

rsa_pubkey.plain

Extracted

Family

vidar

Version

6.7

Botnet

aef20f7eb91ec5457d74e4fa0796c2bf

C2

https://t.me/s4p0g

https://steamcommunity.com/profiles/76561199575355834

Attributes
  • profile_id_v2

    aef20f7eb91ec5457d74e4fa0796c2bf

Signatures

  • Detected Djvu ransomware 14 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1548
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\aac7e028-a5ef-487a-9bd7-ef8c78f0a273" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2900
      • C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2904
        • C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe
          "C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2740
          • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
            "C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:268
            • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
              "C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe"
              6⤵
              • Executes dropped EXE
              • Modifies system certificate store
              • Suspicious use of WriteProcessMemory
              PID:1516
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 1456
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:2072
          • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe
            "C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1592
            • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe
              "C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1772
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                7⤵
                • Creates scheduled task(s)
                PID:1644
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {E793B235-4CCF-4096-A331-4B5D0B1638DD} S-1-5-21-2952504676-3105837840-1406404655-1000:URUOZWGF\Admin:Interactive:[1]
    1⤵
      PID:1228
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:2848
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          3⤵
          • Executes dropped EXE
          PID:2820
          • C:\Windows\SysWOW64\schtasks.exe
            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
            4⤵
            • Creates scheduled task(s)
            PID:2652
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:2624
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          3⤵
          • Executes dropped EXE
          PID:2096

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Defense Evasion

    File and Directory Permissions Modification

    1
    T1222

    Modify Registry

    2
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
      Filesize

      1KB

      MD5

      6a1c010468acf13f71d518cc418e0f0c

      SHA1

      e89d312d492ad10ecbd783087b9e746863b3176c

      SHA256

      04e650c7f37ea6c059b5d352e7f8eb5bc155442f941520c6e9d374d5e505b72a

      SHA512

      e7a3961b07ed24783525397476f98096d5ae08d7c3060c894897a562fb59266419ced93674a7215439bcb74bb20b8aed7992acd99d9e028fd9fcb63cd68d02af

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
      Filesize

      724B

      MD5

      8202a1cd02e7d69597995cabbe881a12

      SHA1

      8858d9d934b7aa9330ee73de6c476acf19929ff6

      SHA256

      58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

      SHA512

      97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
      Filesize

      410B

      MD5

      515db32510cafcc131be5b6ade5b31c2

      SHA1

      31b68b28e9effeeabcd3ad0972133f3f712bf361

      SHA256

      e35d13bac6f2c5091541315acfb838badfc91b712191f1f9bef35812c7fcba51

      SHA512

      05d76367fe9ce2d00f8d9f49f2d17dd7b41e0b5e56469b51aed2db95e354897e324999631eb3be38dd01678e4fc9ca28677c92e0a04849102dceb9046959bf0f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      3209982ad5a33376c8ae3536d68a5444

      SHA1

      f4891979e5796ee79c9373032e4d27b69d8bb31c

      SHA256

      1ba5ef7e10e2a5fdf2672d62c216154e1552b50e259fd2912a3a816d60a6dde0

      SHA512

      488825b4586c613bf470f40fb34e784c30152b7d46f93e9ee4adb6d6c4858e0a79c6d8025c501333cb37af82e2ef46b8077e0ad1cabbbac7314e982d5eda814e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      14a60417a45d799b5af84a5435e8b5db

      SHA1

      ac64c016e2a1e3fff1df5e6029d02d126ccd93de

      SHA256

      f934c15925d9d46045efafe0fb302f656508da8103cfbd3abe86e70d5a86a792

      SHA512

      9c2734be0ef862d7f03b818db20027090525cd3453a24e57a891a3d852f913d0c8e887b69c75e64407afa9578605b58f5afd1346dde382d665aa245dbb03ae82

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
      Filesize

      392B

      MD5

      d52daa1413a9815f2f2069f05d4a4ae9

      SHA1

      77e38cd1be329e3371ed9125f30c6b59faf18861

      SHA256

      25fcf5ff0a67323c44b1ca5bd0bd6fa7d5f3aeb397bc55cba17d049872a29061

      SHA512

      d4fbd4081ebef10ecaac18ef785c54f238097e860c726e9a6ae3ddbc84db5604839b0e366b4526e8e028edd3582609cc9a2ca2c5c2c3f0ed355e159564f33762

    • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Local\Temp\Cab7FE9.tmp
      Filesize

      61KB

      MD5

      f3441b8572aae8801c04f3060b550443

      SHA1

      4ef0a35436125d6821831ef36c28ffaf196cda15

      SHA256

      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

      SHA512

      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    • C:\Users\Admin\AppData\Local\Temp\Tar9B47.tmp
      Filesize

      163KB

      MD5

      9441737383d21192400eca82fda910ec

      SHA1

      725e0d606a4fc9ba44aa8ffde65bed15e65367e4

      SHA256

      bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

      SHA512

      7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

    • C:\Users\Admin\AppData\Local\Temp\Tar9D21.tmp
      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • C:\Users\Admin\AppData\Local\aac7e028-a5ef-487a-9bd7-ef8c78f0a273\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe
      Filesize

      807KB

      MD5

      c8f255dd1d501e90d5b383fe057d056b

      SHA1

      66549427459c996431584a6d597e5b755f0f4bae

      SHA256

      ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054

      SHA512

      0cf26c04a2c6abf39b684e9501cf0dbc82b0f8d0ecd3d53b62c192c2b1e31d548ea58ce2054f4be40f4afe5a7b7d398c99e75e2a0a62d5ab0070cca45dacff0c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • \Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • \Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • \Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • \Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • \Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • \Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build2.exe
      Filesize

      328KB

      MD5

      8d6be514da06d4376ac1effe95572578

      SHA1

      c2a7b7ae2e895bcfe4455e9b18f3336249a496c5

      SHA256

      7658a56d7ea6afcc08a4f44652e04d98b5f83b8ec232b341ffa59aa77cd568ec

      SHA512

      b13d721d65fb1a54f067805f72ea32e2a9ff729d0898024f880fec51647292c9a55d0c8f9498e5573eb8c5597810011dccb96167f86be44a55348c4bb65bd13a

    • \Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • \Users\Admin\AppData\Local\305cda30-c986-4876-97bf-3647f6871cab\build3.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • memory/268-76-0x0000000000220000-0x0000000000257000-memory.dmp
      Filesize

      220KB

    • memory/268-74-0x0000000002C70000-0x0000000002D70000-memory.dmp
      Filesize

      1024KB

    • memory/268-240-0x0000000002C70000-0x0000000002D70000-memory.dmp
      Filesize

      1024KB

    • memory/1516-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

    • memory/1516-79-0x0000000000400000-0x0000000000649000-memory.dmp
      Filesize

      2.3MB

    • memory/1516-73-0x0000000000400000-0x0000000000649000-memory.dmp
      Filesize

      2.3MB

    • memory/1516-78-0x0000000000400000-0x0000000000649000-memory.dmp
      Filesize

      2.3MB

    • memory/1516-238-0x0000000000400000-0x0000000000649000-memory.dmp
      Filesize

      2.3MB

    • memory/1548-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

    • memory/1548-5-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/1548-7-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/1548-8-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/1548-26-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/1592-207-0x0000000000220000-0x0000000000224000-memory.dmp
      Filesize

      16KB

    • memory/1592-243-0x0000000000220000-0x0000000000224000-memory.dmp
      Filesize

      16KB

    • memory/1592-205-0x0000000000870000-0x0000000000970000-memory.dmp
      Filesize

      1024KB

    • memory/1772-210-0x0000000000400000-0x0000000000406000-memory.dmp
      Filesize

      24KB

    • memory/1772-206-0x0000000000400000-0x0000000000406000-memory.dmp
      Filesize

      24KB

    • memory/1772-212-0x0000000000400000-0x0000000000406000-memory.dmp
      Filesize

      24KB

    • memory/2268-0-0x0000000000860000-0x00000000008F2000-memory.dmp
      Filesize

      584KB

    • memory/2268-2-0x0000000000860000-0x00000000008F2000-memory.dmp
      Filesize

      584KB

    • memory/2268-4-0x00000000021E0000-0x00000000022FB000-memory.dmp
      Filesize

      1.1MB

    • memory/2624-287-0x00000000008E2000-0x00000000008F2000-memory.dmp
      Filesize

      64KB

    • memory/2740-49-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-36-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-50-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-54-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-128-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-56-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-57-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-35-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2740-80-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2848-257-0x00000000008B0000-0x00000000009B0000-memory.dmp
      Filesize

      1024KB

    • memory/2904-28-0x0000000000230000-0x00000000002C2000-memory.dmp
      Filesize

      584KB

    • memory/2904-29-0x0000000000230000-0x00000000002C2000-memory.dmp
      Filesize

      584KB

    • memory/2904-34-0x0000000000230000-0x00000000002C2000-memory.dmp
      Filesize

      584KB