djvu | cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967

Analysis

max time kernel
297s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
Size

862KB
MD5

2ebbaa453f84b6190ac7e31505790871
SHA1

c29801a72428c479c5c9e48a0395b93267d6f85b
SHA256

cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967
SHA512

5bfe8d6c6b5aef663617d693a543041e52eea7a5fbb2bc26b9fd597d7c57ba5abfa9706c4176e29d7191b3ab3020479c984417e48036f31a25a413082da6c891
SSDEEP

24576:djKhL0znCNiCGR2Adu/ipE6cuQX/2Rafpno3SLHbg:JKSLWG7w/ipE6cF/2kfGSLH0

Score

10^/10

djvu vidar 1b9d7ec5a25ab9d78c31777a0016a097 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110

Attributes

profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097

Signatures

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/2620-79-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral1/memory/2620-80-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral1/memory/2620-76-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral1/memory/2256-75-0x00000000002D0000-0x0000000000300000-memory.dmp	family_vidar_v7
behavioral1/memory/2620-229-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 15 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2356-4-0x0000000001D30000-0x0000000001E4B000-memory.dmp	family_djvu
behavioral1/memory/2360-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2360-7-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2360-8-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2360-26-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2832-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2832-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2832-50-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2832-49-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2832-54-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2832-57-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2832-56-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2832-58-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2832-91-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2880-284-0x00000000008E0000-0x00000000009E0000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 14 IoCs

Processes:

build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exe

pid	process
2256	build2.exe
2620	build2.exe
348	build3.exe
2280	build3.exe
2836	mstsca.exe
1920	mstsca.exe
2880	mstsca.exe
1936	mstsca.exe
1784	mstsca.exe
2524	mstsca.exe
2632	mstsca.exe
1184	mstsca.exe
2928	mstsca.exe
1696	mstsca.exe

Loads dropped DLL 11 IoCs

Processes:

cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exeWerFault.exe

pid	process
2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
592	WerFault.exe
592	WerFault.exe
592	WerFault.exe
592	WerFault.exe
592	WerFault.exe
592	WerFault.exe
592	WerFault.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2676 icacls.exe

pid	process
2676	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a6508b0f-d297-4cab-b771-c7f066e3496d\\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe\" --AutoStart"	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.2ip.ua
4 api.2ip.ua
9 api.2ip.ua

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
9	api.2ip.ua

Suspicious use of SetThreadContext 9 IoCs

Processes:

cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.execbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exe

description	pid	process	target process
PID 2356 set thread context of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 set thread context of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2256 set thread context of 2620	2256	build2.exe	build2.exe
PID 348 set thread context of 2280	348	build3.exe	build3.exe
PID 2836 set thread context of 1920	2836	mstsca.exe	mstsca.exe
PID 2880 set thread context of 1936	2880	mstsca.exe	mstsca.exe
PID 1784 set thread context of 2524	1784	mstsca.exe	mstsca.exe
PID 2632 set thread context of 1184	2632	mstsca.exe	mstsca.exe
PID 2928 set thread context of 1696	2928	mstsca.exe	mstsca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

592 2620 WerFault.exe build2.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1508 schtasks.exe
2420 schtasks.exe

pid	pid_target	process	target process
592	2620	WerFault.exe	build2.exe

pid	process
1508	schtasks.exe
2420	schtasks.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

build2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.execbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe

pid	process
2360	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.execbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.execbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.execbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exebuild2.exebuild3.exebuild3.exebuild2.exe

description	pid	process	target process
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2356 wrote to memory of 2360	2356	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2360 wrote to memory of 2676	2360	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	icacls.exe
PID 2360 wrote to memory of 2676	2360	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	icacls.exe
PID 2360 wrote to memory of 2676	2360	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	icacls.exe
PID 2360 wrote to memory of 2676	2360	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	icacls.exe
PID 2360 wrote to memory of 2820	2360	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2360 wrote to memory of 2820	2360	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2360 wrote to memory of 2820	2360	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2360 wrote to memory of 2820	2360	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2820 wrote to memory of 2832	2820	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
PID 2832 wrote to memory of 2256	2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	build2.exe
PID 2832 wrote to memory of 2256	2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	build2.exe
PID 2832 wrote to memory of 2256	2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	build2.exe
PID 2832 wrote to memory of 2256	2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2256 wrote to memory of 2620	2256	build2.exe	build2.exe
PID 2832 wrote to memory of 348	2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	build3.exe
PID 2832 wrote to memory of 348	2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	build3.exe
PID 2832 wrote to memory of 348	2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	build3.exe
PID 2832 wrote to memory of 348	2832	cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 348 wrote to memory of 2280	348	build3.exe	build3.exe
PID 2280 wrote to memory of 1508	2280	build3.exe	schtasks.exe
PID 2280 wrote to memory of 1508	2280	build3.exe	schtasks.exe
PID 2280 wrote to memory of 1508	2280	build3.exe	schtasks.exe
PID 2280 wrote to memory of 1508	2280	build3.exe	schtasks.exe
PID 2620 wrote to memory of 592	2620	build2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
"C:\Users\Admin\AppData\Local\Temp\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
"C:\Users\Admin\AppData\Local\Temp\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\a6508b0f-d297-4cab-b771-c7f066e3496d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2676

C:\Users\Admin\AppData\Local\Temp\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
"C:\Users\Admin\AppData\Local\Temp\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\AppData\Local\Temp\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
"C:\Users\Admin\AppData\Local\Temp\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2832

C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe
"C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2256

C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe
"C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:348

C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe
"C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:1508

C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe
"C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe"
1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2620

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2620 -s 1432
2⤵
- Loads dropped DLL
- Program crash
PID:592

C:\Windows\system32\taskeng.exe
taskeng.exe {3B7E35E4-8221-4F90-B433-F126E87943BE} S-1-5-21-3818056530-936619650-3554021955-1000:SFVRQGEO\Admin:Interactive:[1]
1⤵
PID:2952

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2836

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:1920

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
4⤵
- Creates scheduled task(s)
PID:2420

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2880

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:1936

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1784

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:2524

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2632

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:1184

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2928

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:1696

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
8112ab2a9d7578692e66734917d00015

SHA1
5dc1f7cb2c66c925d195fb98784917d108a001dd

SHA256
919561b1927726f5218e79f21184c4bf7117db4466686fc93d3d5dbc1380033b

SHA512
538f1f36b44d628d2ade163cc40deb58b50cb7fbd56019d9526c8233c30771db8542ed5786d311322dfd2e9d44e979da9513c4a0bbc7416b47bb7beca90013d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
b6fcc41427a318c0ebc981249136edd7

SHA1
256b041e3b456b2311f2b54f92d2a268f41b38f1

SHA256
e32c2fe23c059c8545dda6101797775c3d3b1c27967cb478a962d75ef4f83fd8

SHA512
a66b5e203d5773d9eba38f8e7a16104c6a198be58e5e4c52c704ad06d59931980d574c72c770560c5b0a92ec68f3aa92b4c0f8f9cebf7e9267fb9e0c2b75f4ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
1e29e0ebcb246a0222cff69c60daec80

SHA1
384a647774b1ecf72b2f2d829946179a2d6f9925

SHA256
20d065e5036230030325d88356976446b89e2838c8ca57ed9a616615e7b7f26f

SHA512
0bc9374ed10f0292fa4ef30604fd3917faee817c9a98df0218248c7f33b6789bed89eb46e49c067c999b37ef7902d0a1b8e5fa3f69ed2e2c0e52c761795f773a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
f15742057b1a05de5c3333bc552414dc

SHA1
6dc2ee6ee5f3c95748f071f13c368464e1532bb6

SHA256
09e5a2895e62e0a6f9b46b647161222a9915c4c49b90008f0f18d63ab52d61dd

SHA512
cc98881ea51e4910d0af707a1ce043baa2260c770d56b95fcbb339a00d79f6fb98279f53030581e1f9ceda2aa182db17567a8cda425b57d386a4f5888e34d9aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
f37625199a5501e92d9b571a94cc6c54

SHA1
5dbc8fd99887932e1f7e09311ca69aaa10738b83

SHA256
168e8b1b8bb7351a2a2cd8a747754abde5c860b0f4825e6b0a1aacf12063dc83

SHA512
3ec470442f4b34febbbb8318e3220382dce3f172775c07261b94f2471bf0b0ee76f48def6d503085d3755e030e8294bf655a55c959f702d1ebea03ecfe0f40c4

Download Submit
C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe
Filesize
226KB

MD5
16ddfd9e172ce699703cb6cc516c2e9c

SHA1
32cbc29ab8c8bb07ae077370e1c2158e546b145b

SHA256
b14daafc4d11e36df79cdf2aed645959df8416c0e4eca396ad606bd4520fb271

SHA512
49f052e91082c1dcc0e92d05778316cd0ff81556335cb409b4d1394b5f6f4f3fee0f5498142b5abd32e92987b5e4be24512cc8997497322562696f934f19031a

Download Submit
C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe
Filesize
136KB

MD5
7de91bbc2172dbd51682e129fc3f9f51

SHA1
6e9ee876639b4612987c50699f83fa33871469b4

SHA256
77ac3fb06decd19997011a9c79f39aa508cd506e04943318ed5800fc3ed6cb60

SHA512
a8e93a8b329cdd82afad69390a08393f3b580f9867a2dd001e2e83c76262804f9defc8eade36c28ad452ea761f9acde60388ae19499cd4d8a77b023a2ab6056d

Download Submit
C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe
Filesize
45KB

MD5
dcceebec97dd6ae117945f23eab2470f

SHA1
e855d3a02f307e47d6e161f034750d818eb4aa5b

SHA256
1c5eb663482dff546241439bb61b4a182aae235801b72d58f4a8becc28224fb6

SHA512
93d2481665c6e17853bd51f2136f770062d8037886de8390f0fba32f963cc3dc4879afbd3c96345c9ab60f866a9220e624c7a7b4a4ac66648e6bab86f3b5571e

Download Submit
C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe
Filesize
110KB

MD5
b2f634217978525e5316e9e1dd2e3965

SHA1
f3275c0c6d5bd717566dc835029af43db49918c7

SHA256
2e95621dc50175b38a1cc5ea9e4c1b2f480d0fa8d782fc9630f08fdbbfdd68f4

SHA512
1437a2f9dbf168c8dec8b7c2ab8f513762d3623f97a39b02087f46c9cf1703849f85c6c64ec8f72b28eae52a59bbf64e5690ba7fb7e667c3eac14de79605be3d

Download Submit
C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe
Filesize
126KB

MD5
be440d6175fef920ea21c4a3e803dc3f

SHA1
7882ad3e0a822f168999375a500e5a6aa1f4fb40

SHA256
62d840037ae31d58710e3842a111d0c649e1f4a3faab40c01f5c871d8933e6c0

SHA512
8a19e55784118907901911076e5b09c771ef346666714e9b104bb194033dbb8676f063db5777fbea9462dcd7a0fcf9a6672c9003e3173e67f3c7b2d21b743495

Download Submit
C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe
Filesize
82KB

MD5
48621d9eb70a8473f54e47384715bc7b

SHA1
b7748009fc829314e8e6fb181c2b60c7c89f0983

SHA256
33cdfb3352783d83b0455f705f5837123394da20dd9fcfa331d01bf215ccc79d

SHA512
b3b34e9e7f24499e88227268ba71a75811349009672be1f4c152c2a3ca0ed687854be58907912a8d7e528214182639528a91e5dcbcef79efa711550e783de973

Download Submit
C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe
Filesize
20KB

MD5
0e00e6c1d7e3995153d55403adead90d

SHA1
aff426af87dcec1b10e2efd2cc5c4d6286388bbc

SHA256
0b8be29d0db4adcc1843ece5e065d910d8d460764ea459ac2c56beaf802c3a70

SHA512
a55273dc4083f36686f7cc446993214e2ac5e53935870b60a493401942bae0d06ff06471093128ff8b7061b92880c47d57a29ac4adce9a3c8f0eeea9b1171608

Download Submit
C:\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe
Filesize
84KB

MD5
b7d82dc7dbe3058d17d76988d68413cc

SHA1
2981867884fe5a8b50206c9558d1f475ebd76b6e

SHA256
8d708fbe76d9f9e19ee5c82573e749aa0c6a96cef08b1786c85d6385388ef645

SHA512
1195a286db1833d1112601e275a9faced3f95a5042a56962844f3ea6470a81b3e74a9d9c57a0f6761dd8155ccc40cb81f6fe5d9cf628a7ffb13193e3e6204614

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F4A.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45C8.tmp
Filesize
44KB

MD5
11aeef672562db27477b878c58f1b3fb

SHA1
b66fa72e0f12a4a8e0cad5165d0779a9916e2eae

SHA256
0d8a2893be616ec27cb5fe0dc9afe47190842f9c053c5c17143fe3a014158ab2

SHA512
e67ed806d09b2428900b0c8d8ce8c23c3ded92110bbbc36722fb60ce4b6036f205d1f63fecfec89650656f02c6bcf7efec03292f684b6c498f1301cccbbf4774

Download Submit
C:\Users\Admin\AppData\Local\a6508b0f-d297-4cab-b771-c7f066e3496d\cbb4e198bd38eb973662e33128c585ebf5dcd0797136d4b5ced3c28cdb2fa967.exe
Filesize
82KB

MD5
f7d675b5cbb845199e7348c89afa9a11

SHA1
75c6d607fb2b268dc9ce953a2858fc016c412258

SHA256
17ecd3627c3c904e979d929a488ef03e7a3797eac3b8cfbcf0730f830fb58807

SHA512
c70c5b95385a5538c6dfae10ce76b99e978182f676b7dc042c7a3d6e16871e9c89964a5c137b9d3704d03cd9c6e5de4bad09e35bc9ab979b195f3ebc8b31a3b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
127KB

MD5
4f578dc9bef26ac44735d2367061751f

SHA1
c683735a33cf8ed0246d4d257a12eb8c4d06b821

SHA256
1ef882144e2443386d4b3ab0ece475bfdbc8700d06332afa48b4a6d7d4fbd170

SHA512
357a806a76c4c1fdbdbf9effd0984d1f0aadd9bacb43c82ce9eca757b351bd53302e5e211adcd9f7a19d7394596b575824968cc4fadca2235c60a1730a4b0044

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
1KB

MD5
d35c806c95b926208b06f305860de044

SHA1
fd111b2072749c0e2b3f1bb7102e4fbcdd8b931b

SHA256
722325dfc7e0a3d8b9c5bcf978e54f9a90a83ffa5d14372a51dc7c3609fee061

SHA512
cb5f66f83bd6a8ddad6d740479d17352d3a8249ab6fec7ea0ee071dcc7f9855ed378dee61bb65e92d272e3fb8187282ce08d0694550cfa610bf6e6508ec5b6a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
44KB

MD5
cea17a72c4b30e0e87a896bd84a3a368

SHA1
0c35b7369e02b48767aafe861e5bf1a44f8ff33b

SHA256
125bdf1e83d86a48f1274c272782327dfc82b29ff33263add10fa20e2d051fce

SHA512
23ab20af33c8adc80566b387bfb92646786c3259264de4ddc4269dac25992b9b2ff2781763c3365aca163a4549337c142375d9ebf30e316d77a7b18d7de1b017

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
98KB

MD5
55b96dd01edbfb70974fb85b01edd9cc

SHA1
c892d0d9378f99e448e3a3d65fbc357997170438

SHA256
4c024a0f22e3bc66e33f186ab45e3b26b0be3593b333b8c96907fe19646e4262

SHA512
057e8cf77803365bc234d0f1ef655d8747e141cf175c8eece0ce55754e8c49da89cb0753ca09a755846cfb55c11fe1c852fe32f1d4a4bb6d3023597932cf0b60

Download Submit
\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe
Filesize
385KB

MD5
63e4a9cd7a8b37335b5f18cefc5dd9d2

SHA1
c781a30935afc452b108cc78724b60f389b78874

SHA256
c1e75efde3fd1da605135e5c3ffab0073299c80632d136f8eeba9d4a7c98c70f

SHA512
3818b5966938704c5830acb5426db7791f6ae476853248d8984b1aff35a6722a0684bea54a53ef6ded1f301f6de9ed044d45f007457a9c0f3a7ea3afc7bf0ecc

Download Submit
\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe
Filesize
239KB

MD5
3e22f476ba957c6b37e5ca5a39457af5

SHA1
90c2dff1dd67d4d5469f4e34098319616993f470

SHA256
0fb7ced541db8cfb8cbe1b748e5604c5c1ab1ef1dc4936104fc7547047fd3189

SHA512
73b215050417ac98080cf8bc83cf7e35579495d90e1dd718d53cefeb20a74d5b5b07387bf948caf97d30c102a48b16a614ffebe844d0360b71ddfd9c76221184

Download Submit
\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build2.exe
Filesize
99KB

MD5
05fccc0bb585ffa6a9b2a16b9b1e715b

SHA1
d58e914bab7f05112d8532edb368ea0d98a4ec22

SHA256
c22917d2f827c20cd1303ad6aef1901269a106230ac841a3e42db253df11569d

SHA512
0dd3e19e1d88bf5f72186273a3400d7868f3189503cc0451f47f766784391c2d6ffd0328885e64354e7a0269b2497469b0811e71a3c326a4037edb5017ce5253

Download Submit
\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe
Filesize
58KB

MD5
5d78ffd207af6daad67c5cc10c59d7b8

SHA1
f4e51f7d383bba54f4ca1028d17f0db92e195440

SHA256
ea395170c8dc64f1734617be7549fcd381c0d083384d57d281f68f1e22999016

SHA512
7caa23b7ee69be70b2b7bfb9d831f1b9de948231f7785ef4020ab4cd6daa4ab94d82001a861ce6c9b0b390da39c8cc15173821de89be0775b1fe1451591947d1

Download Submit
\Users\Admin\AppData\Local\5ea7031f-9b8c-426f-9ffd-35b4dd8fef83\build3.exe
Filesize
156KB

MD5
b364a0e2f1603baa729ee9b664975304

SHA1
1ce51db905f4e30ffdc5fa2cf9b2d27bb038788b

SHA256
87610e2dc026883eb95aefea512c12bc8ff4da821958ef1f5b75f4375d4c846a

SHA512
db2a9600034245553ba6c0e019a6eada99cf09a2c968b96851323d4d97c305d858b7d1c1936d72e1aba8c9e61a2ca55ee97490c80297e28344f9727c95e820f8

Download Submit
memory/348-106-0x0000000000952000-0x0000000000963000-memory.dmp

Filesize
68KB

Download
memory/348-117-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1784-304-0x00000000009A2000-0x00000000009B2000-memory.dmp

Filesize
64KB

Download
memory/2256-73-0x0000000000500000-0x0000000000600000-memory.dmp

Filesize
1024KB

Download
memory/2256-75-0x00000000002D0000-0x0000000000300000-memory.dmp

Filesize
192KB

Download
memory/2280-128-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2280-118-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2280-102-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2280-104-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2356-4-0x0000000001D30000-0x0000000001E4B000-memory.dmp

Filesize
1.1MB

Download
memory/2356-0-0x0000000000280000-0x0000000000312000-memory.dmp

Filesize
584KB

Download
memory/2356-2-0x0000000000280000-0x0000000000312000-memory.dmp

Filesize
584KB

Download
memory/2360-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2360-8-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2360-26-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2360-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2360-7-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2620-76-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2620-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2620-79-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2620-229-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2620-80-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2632-338-0x0000000000312000-0x0000000000322000-memory.dmp

Filesize
64KB

Download
memory/2820-34-0x0000000000300000-0x0000000000392000-memory.dmp

Filesize
584KB

Download
memory/2820-27-0x0000000000300000-0x0000000000392000-memory.dmp

Filesize
584KB

Download
memory/2820-29-0x0000000000300000-0x0000000000392000-memory.dmp

Filesize
584KB

Download
memory/2832-49-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2832-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2832-35-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2832-50-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2832-91-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2832-54-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2832-57-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2832-56-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2832-58-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-238-0x0000000000900000-0x0000000000A00000-memory.dmp

Filesize
1024KB

Download
memory/2880-273-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/2880-284-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/2928-372-0x00000000009C2000-0x00000000009D2000-memory.dmp

Filesize
64KB

Download