Analysis

  • max time kernel
    298s
  • max time network
    199s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    05-02-2024 04:55

General

  • Target

    81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe

  • Size

    736KB

  • MD5

    adb72c7dec5dd45c7f172f4d2d01e1ae

  • SHA1

    9a375b6d4a413807e7775b87722b3f10ce1fe511

  • SHA256

    81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3

  • SHA512

    e9da509a506028ee72cfb986bba23a158ee40f58f516b423b1cc7d20472299fc0791b7faf86ed13c94db7a98791a4bae63c783013793012dec43951783001c3c

  • SSDEEP

    12288:k6B0LvP6A0BEE0/wPSZUh6p7N23h8ByUtgLtRGVA50z9btGdQCAP:kT7cgZUO7Y3WzgpchJGiCAP

Malware Config

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .cdcc

  • offline_id

    LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

C2

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110

Attributes
  • profile_id_v2

    1b9d7ec5a25ab9d78c31777a0016a097

Signatures

  • Detect Vidar Stealer 5 IoCs
  • Detected Djvu ransomware 14 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 11 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
    "C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
      "C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe"
      2⤵
      • Adds Run key to start application
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2272
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\6ebf333e-252d-412e-8f0d-5ef1b39cb9a7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2544
      • C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
        "C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1220
        • C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
          "C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2500
          • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
            "C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1756
          • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe
            "C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2268
            • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe
              "C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:972
  • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
    "C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe"
    1⤵
    • Executes dropped EXE
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 1436
      2⤵
      • Loads dropped DLL
      • Program crash
      PID:1600
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:1968
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {AEEDEC5F-66B4-4E11-B883-B1276A144815} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]
    1⤵
      PID:2816
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:2456
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          3⤵
          • Executes dropped EXE
          PID:2184
          • C:\Windows\SysWOW64\schtasks.exe
            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
            4⤵
            • Creates scheduled task(s)
            PID:1924
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:1440
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          3⤵
          • Executes dropped EXE
          PID:2416
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:1832
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          3⤵
          • Executes dropped EXE
          PID:1828
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:1748
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          3⤵
          • Executes dropped EXE
          PID:2668
      • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        PID:1228
        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
          3⤵
          • Executes dropped EXE
          PID:1480

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Execution

    Scheduled Task/Job

    1
    T1053

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Scheduled Task/Job

    1
    T1053

    Defense Evasion

    File and Directory Permissions Modification

    1
    T1222

    Modify Registry

    2
    T1112

    Subvert Trust Controls

    1
    T1553

    Install Root Certificate

    1
    T1553.004

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
      Filesize

      1KB

      MD5

      c59708a86e78530488f2356251e775a2

      SHA1

      17e33e077261cdd9e54d4e58dfb168f15ee93efb

      SHA256

      71719971666e64a4f767e8f9d0b52e822189c4bfb1fe449a0e7c8066c82813c2

      SHA512

      42afd4d2c791ea8cb239130cf4f4d43da0ec39c63049c56796e082282e2ba2f0cd0fd8934b7de3b359ca433b0609ad159fda6f92168168f2d4517f13fbbb3fbf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      1KB

      MD5

      1f1a3b101012e27df35286ed1cf74aa6

      SHA1

      46f36d1c9715589e45558bd53b721e8f7f52a888

      SHA256

      7f0b1fe38c7502bea9c056e7a462ab9f507dd9124f84b1d4666fb7d37cf1b83c

      SHA512

      d6f6787de85049d884bf8906292b0df134287cc548f9f3fadd60d44545652d55c296ed50e72687f776f0bf6b131102b4bf9b33143998cb897f21427fbc8306a3

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      45KB

      MD5

      2784d0f7b7fb739c8ed5c045c07b0a5c

      SHA1

      bf6a0d9991cf8bf66ca364ac684d0984805649e7

      SHA256

      ee2d0ed076b9c03214136102870c8ba50fc9004fc2724b40839b3c84f3caaca7

      SHA512

      d7d89a80e80cabc20fd959fed775ca74656aec67795b6c8c76d40390e94a15de24e4242f126cd91ed52f01ab24031ec0368169ac6f8e078febfb265a9977466d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
      Filesize

      724B

      MD5

      8202a1cd02e7d69597995cabbe881a12

      SHA1

      8858d9d934b7aa9330ee73de6c476acf19929ff6

      SHA256

      58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

      SHA512

      97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
      Filesize

      410B

      MD5

      31d1c566632a231a3de6adcff4446074

      SHA1

      7838fae10b9151661aeadbec89349837bcbc2b29

      SHA256

      30c4f2971513af17002b7fb669910a90273ed9181578be3a0289092ef07cd7db

      SHA512

      b4607fa44a17d600153af12db4ece350cdf9758146e454d0cf91f8141221ea54b246b182829f6665578f330baf6455a2ac7caf8a834a6d1233867d088e6549fc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      344B

      MD5

      e01d20811fabb7ccfbf51d35cce86f07

      SHA1

      65670d5d06072e9de8775af50e2e80b7d612e451

      SHA256

      acf1fa5e057e2e618e8599ef77f1fd5064ad90234e7c1d09907cc31f853e9299

      SHA512

      87eabe7db3c343ad5776773e52dbc31c733e3175a9b372acdcedb80f1760bd472c4ee625d083c3a67252264b390ad903ac10f1e94978b6336a5d343a3b8718d5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
      Filesize

      392B

      MD5

      1df57f99a35e595f90d4f7395b988226

      SHA1

      343f926a42a70b6d050d01abd9b3205d0a73c868

      SHA256

      20b2438061596fe186b7f5f5f306f9ca42f9495484a434cd8b3b5cb09ba7fd18

      SHA512

      f90b37112d0aec4665e30e020a35e80d586d32397803c66672ebb3f94704c3b157b669e4d2a9cb8f9e530134bc585d6fd68d4042f480bd0f399c26d8569d0906

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
      Filesize

      242B

      MD5

      cbcd8ec8e0ada7e54d0b5cdab31f032e

      SHA1

      7b3264b2cc0bd16786f3ff22eee63f87597c148d

      SHA256

      2f8170723599fbd3629274ec3086870ad99beab7e0069dc306c6305efd581730

      SHA512

      3124937271304931b8eadeb0644e5c3a352a704644f32996866d001701979443e70df72b793b8c45b070116c1ab349b10d1932f74acc1cf492a16a8c381943fd

    • C:\Users\Admin\AppData\Local\6ebf333e-252d-412e-8f0d-5ef1b39cb9a7\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
      Filesize

      31KB

      MD5

      bc50292f6edd3d2d0e4921062259b7d6

      SHA1

      44df636ca4c3ff843a3b06d52d666be21eb03e33

      SHA256

      1ab746bf3c81c77ca2dc34948202f38da36f1fa4103a9d8990e3df26c802c8c9

      SHA512

      341537c7b524abbd565e767907f14ae4345747656eebab133ddc6c350339075a9bd6f293f2503c41bc1691c1c3ab787ce5cff265cb13ebfbb26f9d87eea6ba5f

    • C:\Users\Admin\AppData\Local\Temp\Tar28A7.tmp
      Filesize

      35KB

      MD5

      d9e561e87fd838af90a4ab909fb5fdeb

      SHA1

      c6ee7abe55522ca2220ddc832cf222a28dd55bf6

      SHA256

      d052b784995fe0634ccace1f4dea0042a6f2cca7ecbde964bd944c1e0c99d7ff

      SHA512

      af25b45edb943e2c6f001f91fc67bdc534d42e7f6210c3c0cc7485b2e04b6d589bf52b8eeb9f3cf644ac281dddae7cb7bdad23730422fd69f2b0123d82311ed3

    • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      174KB

      MD5

      9ebe58d4a5f747e99a8e6201d039537b

      SHA1

      d0b9f9d3589797b4d7327457698478ff8dcb5b2a

      SHA256

      daf6cb55b74d089202215ab7016820e12add90d112a258f88f18ff556046352b

      SHA512

      d2abb5cf8c79c3ce0225e68245191122d1487fe4dca0566f39afcea6f50249e1ed47e8725768475ae5930d8455123282716f26c82770d922e423f5550b6cec95

    • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      91KB

      MD5

      79c8701ae8241cfe3e40924fce7c3604

      SHA1

      2b11661840ee01bed614363b4ae8a38a001710b8

      SHA256

      0588aebedc0a4d1cd9a9e139c7b4a3135d879b0e4c32c58c9a32ab4b2dfcb7a8

      SHA512

      ed6aed3fb9be420cb79758bf5294bba37a3439cd849fc05d86e236482ab9e28d581cd892ffe1500ff5f52657d34b3c645d8490ef4247e03a638a0d0cef256107

    • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      72KB

      MD5

      0c266be5d61a1e450e239e904797a7c8

      SHA1

      cbea52418ec7c1dc4da8383ca6ef36e4d0513a67

      SHA256

      a7a7c9c6e7250404e750fd45f827da8877c0c4a9362592ddb87814eb2934cc16

      SHA512

      172116ce2f779769decfd7971118d3bd3c4b81321d52675e8c9b402fae2992a242e7994663a9c31c729ad99a06852c16f00bc21060dc9d1ff86ca3b31140cb43

    • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      101KB

      MD5

      51555884dc7a4a2db4b664c1364ce8ec

      SHA1

      1597ef27d6fac3fc08e18e40b84ee49c3497d226

      SHA256

      81d2c6501ac149e421e399589b1443b533f06eef366c5c69943549db953fc363

      SHA512

      63d3d63562418e662a05f328caffa0ec56691f22a5c6fb72199f76539566ce9aa5826cb5bd56c7b2ec10286c2917e57aab4cbb3032d37e5b81662e192a51ab3f

    • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe
      Filesize

      40KB

      MD5

      795570726715d7594dc8ada2a2e51aad

      SHA1

      38647effee4945f476f3cc2f21869fe11dafb64b

      SHA256

      5855408fa41c7c0ec086d4a6905a2a1f5f8c90d2e06fd52c97a8af6ac3b23b7b

      SHA512

      a53870c76cc13f7a75f4735d6822483397bae24d48ea5e7f8c58559f4c2dbae5581d55b7220c06b6baf371692bb5979fca5eed984f96e16b4d017d18dd7ec46f

    • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe
      Filesize

      24KB

      MD5

      5d9f1ba5d42477c72424982da5077225

      SHA1

      294c50cea983daf790254f76aa6713e4ac7e9eda

      SHA256

      a23e1f733f8cdd1f264c2f03b868ea7d12231757f0f62db0aff61a6cf213d3a4

      SHA512

      32f7c0eb3c33c586cbe6de97cbbdd5ce7aa6727ebd29fe36d022c4fac5b06e3a3fe3d21a0d18283e41eed52af36ca8c992ce50a7cdb1061152535e807e3af124

    • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe
      Filesize

      42KB

      MD5

      af6bedca8640a78ca12e41456673c8ed

      SHA1

      d6090d286ec93f5ff013a6a033685ecf173a7f10

      SHA256

      956fce2092cc240e15db08f639a3ddb3468b0418ce313d1af5d171f160b62796

      SHA512

      f03341928338e1427f85a70a12caf7870468b1a4874d0f4fa2f562cd1a8f58c9150d3e6619a0527ee97690d2830f93994a5ee25602117290e2da89aca8fdf4d8

    • C:\Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe
      Filesize

      49KB

      MD5

      12c821df779c5855f6cd196381ff14b1

      SHA1

      42762892e1847f6e45548f4e3684157aa71620d3

      SHA256

      f69ef6345394d7d2362dca8f42662b2a18b0c992f7be69dd70036ee1e251a0ac

      SHA512

      b7d99eedb1bad2bcc096a8deceaaeff44d42df29f565ad051513f29925f5beafd22707b6f132abfe584c4da240818de591b97737cd0e4b89cb098b379f97d929

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      299KB

      MD5

      41b883a061c95e9b9cb17d4ca50de770

      SHA1

      1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

      SHA256

      fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

      SHA512

      cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      154KB

      MD5

      b872c0f943505bcdeae26cf558030e34

      SHA1

      b1f5e8a1847087c9fd83712826a4d438313bd5bc

      SHA256

      67335186b401c8de328c349b1aed1de679bb526e206f91a14a1b8965de84c59c

      SHA512

      82950005edd5f3a9af040fa0e82a7450eaeaf8ec1ba2152400da5ee16227ff2d50522f7db3b37ea9ef155bbcd24ac809a33787a6ed4859150a83a5aa1a18eef2

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      89KB

      MD5

      5d5b6400d2f92c01543899b633034364

      SHA1

      4453dc65da26109ed9dc7eecbc7d2c6ce3bd5494

      SHA256

      21ec243f2b8fec02745c8a91b491589c862bf7f8e71b26783c7a62da50e03fb9

      SHA512

      5aeb3fe98a81706ccb27bbc1fc2ef9df5410177906a24e1ea9503d1395e0911ecdb9018b1cdb642858e06b1c670a38c12ad1769740eb7a59a8c1bce46df72113

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      1KB

      MD5

      d35c806c95b926208b06f305860de044

      SHA1

      fd111b2072749c0e2b3f1bb7102e4fbcdd8b931b

      SHA256

      722325dfc7e0a3d8b9c5bcf978e54f9a90a83ffa5d14372a51dc7c3609fee061

      SHA512

      cb5f66f83bd6a8ddad6d740479d17352d3a8249ab6fec7ea0ee071dcc7f9855ed378dee61bb65e92d272e3fb8187282ce08d0694550cfa610bf6e6508ec5b6a6

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      61KB

      MD5

      b97e6873480ae4ff6012739993211cba

      SHA1

      6d77690ad6891cb1dc819fcfa7155d04878619ed

      SHA256

      83c17503418b3247f282de21e6daafcffef95576c4ef2f5dc625d90391a54e3f

      SHA512

      b9ec703ce64a8ea69ff57a352b8f263738aba7e219db4ce81b53b39c028330ed8f27e87a8eaeff1774c22b7f7bd662cc28df676a3baf256283830c69935a536a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      94KB

      MD5

      a405866bf4b99ec40e50a38dd13b05a8

      SHA1

      20872331164a6cce856d9097d3a95152a4fb6ecb

      SHA256

      11a2c8cab608ebe57723855cb335eeba1dae8cd199996e56d4f4d4f8cd95e56a

      SHA512

      bd12035d58cdf7b0ab0de0cce486a8a3c9438c386104255d31115a501ff8fd2e7d7f587973edaa6930cdb24f89daf2a2093852bb311ae086d38138b4ed1f0f8e

    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      Filesize

      9KB

      MD5

      9f2a96367a52c87cfc6a9126f452cc2d

      SHA1

      6df22db4fb95700b0f121bf2e6d345ff9075079d

      SHA256

      d19625b085e39f32ee3a9740cc622b0328aa321d83cae210599351d1402a3f47

      SHA512

      d72cd533c12a1d435e43d8f2a7a31b1595feaa8069bb39a99e4467751090e57f8f6fe0b262a5a78ea5bf3ff55e35bf3dc1ab653468fef7527bbacf5a505e967d

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      36KB

      MD5

      1cdbb51d258ffe38cd24a89693f05922

      SHA1

      7a180861322f00c3a86198d8d33f8ca40cbdbd1b

      SHA256

      240e57cc53d60d1bbfa5d6e10b897ffc32b720c959de4dbf773f9e9992db335e

      SHA512

      0ef8022fee93ce97460fc6d11aba2cd66f9e9c681bdaa2237cdbaca03ad1a39ea87028cddcd3814fc51f20e9f7eb2e5b1eb3a71fae79ab13d9431efa3cca3aa9

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      37KB

      MD5

      ddf29afa9502baf8359b3358d44a2ff5

      SHA1

      10a752c0f0c9c2a67ea4da181b14155086f987e4

      SHA256

      613048a85ee6484352d6aa2c0847520c18569dfdc117312934740ee9dc7acf96

      SHA512

      fc3feff09575dfa665c6d4121ba25839e7962755f9fb1db15616cb4415ca31cd40d5785c142db629e43ce1b70f373f389716fe236ec747bbe13c5f9d185f1280

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      44KB

      MD5

      6e89882ee0beeff381185c8d8994121f

      SHA1

      3a741a7ad7364e1cbd378a6b1aa6a515ebaafa14

      SHA256

      a6cd5a78a24d4c4e8a4185cc646aea28cfe549d6a9a2b54342219cbf13ef2d8c

      SHA512

      14f81ec4cff458e741ab4e362ade2caae4a378064d6277ac3d54c63fc01175e5761a2f13e0e9b922244bcda6909adc6243e84f0a63d535234d31124c75c5f5e6

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      15KB

      MD5

      ae6ed5434b77f7e4d22378a2ef7a8388

      SHA1

      46239f1b64e42cbf04a42c08e08917a631cab9e0

      SHA256

      ae592bf279b731f8d446765e47775ce9e7f29d4f9473d8cee3633dc6189d5948

      SHA512

      d8ffd3c0e2f2792bf140a91067cb1289a496915d83dfbfd08504df9f20b9167006570a34c63682c0e31c51fbeee0172d4ccfb9552572d51f6a4fb2bc5acff845

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      81KB

      MD5

      dd724fa54366c422c3edc358fa479196

      SHA1

      20159710a91e157ecee1903ecb5cc4f26d908f57

      SHA256

      029c5690e3b5401bde116feebe1c99c432baa0955b695dda23237b013b2efcfb

      SHA512

      5a9687c85020fccc1644612a06178e428cc50efe69c6ecc9f549b4557c69be759a4a2a043118e2dc8382716d107ec0b9ac8371cc2c0f1f0a938624d85ed95964

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      60KB

      MD5

      109dcd1db9ff460d090d56b95d3eae96

      SHA1

      66b0c179972b39fe3ea5cb0cc9eb1e8a214d33d4

      SHA256

      792a509c39abdd9ac05e99f7260912238442b6cbf35ac187de17ac40bbe7f7dd

      SHA512

      a3823ae4a459e48999822a611c89e68f8d744b1087dccaec7209218c2b08c349eba60cf20cf109f311efe586ba3418c96286cfa1a9c06a13b001ae5ec1be4975

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      43KB

      MD5

      65c95f9904c8ab1c61d9efc422709e9a

      SHA1

      088dbaca9687f5d47d3d960c8c22dbd134e5fa21

      SHA256

      1a262fe7875a43ee61a31a3c4789157e62b99d5cbeed3e67d99992026feaa178

      SHA512

      13c916630b5d36cd64db9e640e301b0fe621dfc41879881972cb2f081eca73d45d144f45e6ce74b33826f0047b1cdefb606fa1703a1f908a9b1b107a430a715f

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      184KB

      MD5

      2cca896f8a107fa1c7237b7e834dd132

      SHA1

      5baed89bfeab501b215e679fcf9f3729756420fe

      SHA256

      c350a1fb072235d55e18d26609037dadfa06c465cc0c65f11424f74977e99069

      SHA512

      1ac8e9142f58a63f1d2d97e9a148d2e977f445819486cf9d6d63cf8f920c1ee1e5c52bc8658209439aaa976aea0438cb378d99b38f7ca228079e29add430d2f0

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build2.exe
      Filesize

      52KB

      MD5

      db6debfefaf8da56a43424fba9584537

      SHA1

      62264e391b1d6c234851105e46b2d32e25d6876b

      SHA256

      051829ed57a98dfed27c966aaa03b961a9e1d3a791cd73fae29b8b9271fa5a0b

      SHA512

      01735e9492c167e52575b784a597d222b849ded3a332566593f7c15de45a27d506286a5e766388d4050229bc2cf99f7ec15c59b689c25908ccd65ce27a375931

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe
      Filesize

      13KB

      MD5

      184dd737e2c28fc725132f054804ec90

      SHA1

      01da031a3271cc80c13af854e9afd6cafe1ad52c

      SHA256

      010f695fa9a711ffc2ddada7e6a6b8d293df467c6a6fd086efed46aeee866319

      SHA512

      12d8dbb733800d92eda1c71eb81a7d669616d77ce94f32c1d254cfc3f9745f5386b83513d7bc5ced25f46c526172df14e94e82b921ee4ede8ced62e72c134d9d

    • \Users\Admin\AppData\Local\bd4d2e6b-c47e-4da4-8af3-793964b92b0c\build3.exe
      Filesize

      75KB

      MD5

      31681ed1798bdfff8d24129684b909eb

      SHA1

      d60ef033fb66079882ee1d0cdfc1b99ebec8135b

      SHA256

      a5c6a320fd7a78bd92db17dcd4d4467d5a90ae7819e4c3c1d4d498d35205db3e

      SHA512

      62f68238eb0cf3eca1240381efa1621695ccbd3f8c8ca726fe13ec4fef45283f3f49d7bd5c7d4a8397e1366d1f8882363445d0f7fe8d697a683b13ed502508ea

    • memory/972-228-0x0000000000400000-0x0000000000406000-memory.dmp
      Filesize

      24KB

    • memory/972-226-0x0000000000400000-0x0000000000406000-memory.dmp
      Filesize

      24KB

    • memory/972-221-0x0000000000400000-0x0000000000406000-memory.dmp
      Filesize

      24KB

    • memory/1220-46-0x0000000001C50000-0x0000000001CE1000-memory.dmp
      Filesize

      580KB

    • memory/1220-255-0x0000000001C50000-0x0000000001CE1000-memory.dmp
      Filesize

      580KB

    • memory/1220-48-0x0000000001C50000-0x0000000001CE1000-memory.dmp
      Filesize

      580KB

    • memory/1228-386-0x00000000008E2000-0x00000000008F2000-memory.dmp
      Filesize

      64KB

    • memory/1440-301-0x00000000008F2000-0x0000000000902000-memory.dmp
      Filesize

      64KB

    • memory/1588-100-0x0000000000400000-0x0000000000643000-memory.dmp
      Filesize

      2.3MB

    • memory/1588-101-0x0000000000400000-0x0000000000643000-memory.dmp
      Filesize

      2.3MB

    • memory/1588-93-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

    • memory/1588-95-0x0000000000400000-0x0000000000643000-memory.dmp
      Filesize

      2.3MB

    • memory/1588-256-0x0000000000400000-0x0000000000643000-memory.dmp
      Filesize

      2.3MB

    • memory/1748-358-0x0000000000972000-0x0000000000982000-memory.dmp
      Filesize

      64KB

    • memory/1756-98-0x0000000000650000-0x000000000066B000-memory.dmp
      Filesize

      108KB

    • memory/1756-258-0x0000000000230000-0x0000000000260000-memory.dmp
      Filesize

      192KB

    • memory/1756-99-0x0000000000230000-0x0000000000260000-memory.dmp
      Filesize

      192KB

    • memory/1832-328-0x00000000008A2000-0x00000000008B2000-memory.dmp
      Filesize

      64KB

    • memory/2268-225-0x0000000000220000-0x0000000000224000-memory.dmp
      Filesize

      16KB

    • memory/2268-223-0x00000000008E2000-0x00000000008F3000-memory.dmp
      Filesize

      68KB

    • memory/2272-9-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2272-8-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2272-5-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2272-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
      Filesize

      4KB

    • memory/2272-45-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2456-269-0x0000000000230000-0x0000000000330000-memory.dmp
      Filesize

      1024KB

    • memory/2500-75-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2500-53-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2500-71-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2500-54-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2500-70-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2500-78-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2500-77-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2500-79-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2500-178-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

    • memory/2948-1-0x00000000004D0000-0x0000000000561000-memory.dmp
      Filesize

      580KB

    • memory/2948-3-0x0000000001CE0000-0x0000000001DFB000-memory.dmp
      Filesize

      1.1MB

    • memory/2948-0-0x00000000004D0000-0x0000000000561000-memory.dmp
      Filesize

      580KB

    • memory/2948-7-0x00000000004D0000-0x0000000000561000-memory.dmp
      Filesize

      580KB