djvu | afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60

Analysis

max time kernel
308s
max time network
289s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
29/03/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe
Size

817KB
MD5

0aa26eb97a218a0e29fd68234bbede16
SHA1

4e581939ea05fe439adbcc636448cc6bd257a923
SHA256

afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60
SHA512

8ac60d7537c6b7820e8c3a4cad6e4406bb5245bb89072b6940644f0cbfe5450997c4a2ea4ce4a53105af81548c9a8531de784cd1a01bdfb9b43ce0bd385d5f35
SSDEEP

12288:aUnpxP1bz92pPsss5Ky6rb/QPghm8xsEAKp2M9W7H2KJoGDg5EEhWS+19fEVT:5xPJ9eXs5KFzQCpqM9AXxDjS+ffG

Score

10^/10

djvu vidar 5739ef2bbcd39fcd59c5746bfe4238c5 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://sajdfue.com/test2/get.php

Attributes

extension
.looy
offline_id
1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://sajdfue.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0858PsawqS

rsa_pubkey.plain

Extracted

Family

vidar

Version

8.6

Botnet

5739ef2bbcd39fcd59c5746bfe4238c5

https://steamcommunity.com/profiles/76561199658817715

https://t.me/sa9ok

Attributes

profile_id_v2
5739ef2bbcd39fcd59c5746bfe4238c5
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 7 IoCs

stealer

resource	yara_rule
behavioral2/memory/1848-46-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/4292-50-0x0000000002050000-0x0000000002081000-memory.dmp	family_vidar_v7
behavioral2/memory/1848-51-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/1848-52-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/1848-75-0x0000000000400000-0x0000000000644000-memory.dmp	family_vidar_v7
behavioral2/memory/1340-118-0x0000000000810000-0x0000000000910000-memory.dmp	family_vidar_v7
behavioral2/memory/756-146-0x0000000000960000-0x0000000000A60000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 17 IoCs

resource	yara_rule
behavioral2/memory/3600-3-0x0000000002870000-0x000000000298B000-memory.dmp	family_djvu
behavioral2/memory/2304-2-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2304-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2304-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2304-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2304-17-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-53-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-55-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2112-64-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 13 IoCs

pid	Process
4292	build2.exe
1848	build2.exe
2416	build3.exe
3560	build3.exe
5084	mstsca.exe
2196	mstsca.exe
1340	mstsca.exe
944	mstsca.exe
756	mstsca.exe
4332	mstsca.exe
2300	mstsca.exe
1292	mstsca.exe
2104	mstsca.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3524	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2772066395-907917261-1982757236-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\bdb3a8d8-43fa-4212-8135-721e7cb2b7bb\\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe\" --AutoStart"	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.2ip.ua
11	api.2ip.ua
1	api.2ip.ua

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 3600 set thread context of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 2328 set thread context of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 4292 set thread context of 1848	4292	build2.exe	78
PID 2416 set thread context of 3560	2416	build3.exe	83
PID 5084 set thread context of 2196	5084	mstsca.exe	87
PID 1340 set thread context of 944	1340	mstsca.exe	91
PID 756 set thread context of 4332	756	mstsca.exe	93
PID 2300 set thread context of 1292	2300	mstsca.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	1848	WerFault.exe	78

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
436	schtasks.exe
4452	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2304	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe
2304	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe
2112	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe
2112	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 3600 wrote to memory of 2304	3600	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	72
PID 2304 wrote to memory of 3524	2304	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	73
PID 2304 wrote to memory of 3524	2304	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	73
PID 2304 wrote to memory of 3524	2304	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	73
PID 2304 wrote to memory of 2328	2304	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	74
PID 2304 wrote to memory of 2328	2304	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	74
PID 2304 wrote to memory of 2328	2304	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	74
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2328 wrote to memory of 2112	2328	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	76
PID 2112 wrote to memory of 4292	2112	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	77
PID 2112 wrote to memory of 4292	2112	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	77
PID 2112 wrote to memory of 4292	2112	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	77
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 4292 wrote to memory of 1848	4292	build2.exe	78
PID 2112 wrote to memory of 2416	2112	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	79
PID 2112 wrote to memory of 2416	2112	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	79
PID 2112 wrote to memory of 2416	2112	afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe	79
PID 2416 wrote to memory of 3560	2416	build3.exe	83
PID 2416 wrote to memory of 3560	2416	build3.exe	83
PID 2416 wrote to memory of 3560	2416	build3.exe	83
PID 2416 wrote to memory of 3560	2416	build3.exe	83
PID 2416 wrote to memory of 3560	2416	build3.exe	83
PID 2416 wrote to memory of 3560	2416	build3.exe	83
PID 2416 wrote to memory of 3560	2416	build3.exe	83
PID 2416 wrote to memory of 3560	2416	build3.exe	83
PID 2416 wrote to memory of 3560	2416	build3.exe	83
PID 3560 wrote to memory of 436	3560	build3.exe	84
PID 3560 wrote to memory of 436	3560	build3.exe	84
PID 3560 wrote to memory of 436	3560	build3.exe	84
PID 5084 wrote to memory of 2196	5084	mstsca.exe	87
PID 5084 wrote to memory of 2196	5084	mstsca.exe	87
PID 5084 wrote to memory of 2196	5084	mstsca.exe	87
PID 5084 wrote to memory of 2196	5084	mstsca.exe	87
PID 5084 wrote to memory of 2196	5084	mstsca.exe	87
PID 5084 wrote to memory of 2196	5084	mstsca.exe	87
PID 5084 wrote to memory of 2196	5084	mstsca.exe	87
PID 5084 wrote to memory of 2196	5084	mstsca.exe	87
PID 5084 wrote to memory of 2196	5084	mstsca.exe	87
PID 2196 wrote to memory of 4452	2196	mstsca.exe	88

C:\Users\Admin\AppData\Local\Temp\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe
"C:\Users\Admin\AppData\Local\Temp\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe
  "C:\Users\Admin\AppData\Local\Temp\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\bdb3a8d8-43fa-4212-8135-721e7cb2b7bb" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3524
- - C:\Users\Admin\AppData\Local\Temp\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe
    "C:\Users\Admin\AppData\Local\Temp\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe
      "C:\Users\Admin\AppData\Local\Temp\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2112
    - - C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build2.exe
        
        "C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4292
      - C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build2.exe
        
        "C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build2.exe"
        6⤵
        Executes dropped EXE
        
        PID:1848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 1056
        7⤵
        Program crash
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build3.exe
        
        "C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2416
      - C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build3.exe
        
        "C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build3.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:436

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4452

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1340
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  PID:944

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:756
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  PID:4332

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2300
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  PID:1292

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
2a789d6b366b95c47c2e68c27f863f81

SHA1
1b123bd94179f5b8746bc960691ddb9546855e05

SHA256
ba4990d90cdd27ce932e39c10e178659436aeb5a290faa47f4825da9eca6bc94

SHA512
027180aabc65ae3ca35f83161b11d289d87af854656483ac2cf703d94f695c4d5bce0fce1901278ab4cbfc985c9b9aa1f455c889913834c4b1734a365c7f8e3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
ca3f7152c562a788e452ff5dd3af22a4

SHA1
1c8e33f4891818460b0db3bbcf5b1f07a20101a4

SHA256
6a1f77911b0bc359e5607f4ea8db1d5dcca5920898bdd54cd700e08a094bdbc5

SHA512
2b19931f7d691c4df92ceec799fd6214d008156beecefd7326b5b2f9779692611092293add0b3c9008006c40c3283208bf92e0fefb5a2d3668273a45d28b0955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
8816329cc0a9bea518a322b5166ba215

SHA1
1ae4009f0c864c86cdb9591f5bda467ff9774b10

SHA256
582dc87afeb11232acfe06c2bd4ae7b9f5f5425f5e8fd2950ab2d9ef6727fa16

SHA512
626d28f5385fa95ef00d1147876c69c4654dd01ad172a1f20c1fd3750f6f8801cef73424137417a12d4ae797d447b0ffa6e8cc4027ec42ca1206a53005ac41a5

Download Submit
C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build2.exe

Filesize
277KB

MD5
8dae8b6a6be6e3527183594d1c26a2d3

SHA1
b87e40cee60869a36e79c88c8a3a34baf0bc4889

SHA256
afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5

SHA512
0bf065700db647efba39a13a58242a595907e6c11885575cf0bdad9e23ab40583c8a6535464e46d75d075e20d88b7a6305a761df9da787fdc8728483dd48f96e

Download Submit
C:\Users\Admin\AppData\Local\49d5de7d-bc75-4e72-b44b-12034ea16616\build3.exe

Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
C:\Users\Admin\AppData\Local\bdb3a8d8-43fa-4212-8135-721e7cb2b7bb\afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60.exe

Filesize
817KB

MD5
0aa26eb97a218a0e29fd68234bbede16

SHA1
4e581939ea05fe439adbcc636448cc6bd257a923

SHA256
afd414546738f66693ca9965dc07881786022d260a583f5b7bc15ad8ae87cd60

SHA512
8ac60d7537c6b7820e8c3a4cad6e4406bb5245bb89072b6940644f0cbfe5450997c4a2ea4ce4a53105af81548c9a8531de784cd1a01bdfb9b43ce0bd385d5f35

Download Submit
memory/756-146-0x0000000000960000-0x0000000000A60000-memory.dmp

Filesize
1024KB

Download
memory/1340-118-0x0000000000810000-0x0000000000910000-memory.dmp

Filesize
1024KB

Download
memory/1848-51-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1848-46-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1848-52-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1848-75-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/2112-24-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-55-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-30-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-22-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-64-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2112-53-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2300-174-0x000000000082E000-0x000000000083E000-memory.dmp

Filesize
64KB

Download
memory/2304-17-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2304-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2304-2-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2304-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2304-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2328-20-0x0000000002620000-0x00000000026B8000-memory.dmp

Filesize
608KB

Download
memory/2416-71-0x0000000000A30000-0x0000000000A34000-memory.dmp

Filesize
16KB

Download
memory/2416-68-0x0000000000B00000-0x0000000000C00000-memory.dmp

Filesize
1024KB

Download
memory/3560-72-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3560-73-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3560-67-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3560-78-0x0000000000410000-0x00000000004D5000-memory.dmp

Filesize
788KB

Download
memory/3600-1-0x0000000002770000-0x000000000280B000-memory.dmp

Filesize
620KB

Download
memory/3600-3-0x0000000002870000-0x000000000298B000-memory.dmp

Filesize
1.1MB

Download
memory/4292-50-0x0000000002050000-0x0000000002081000-memory.dmp

Filesize
196KB

Download
memory/4292-77-0x0000000002050000-0x0000000002081000-memory.dmp

Filesize
196KB

Download
memory/4292-49-0x00000000006B0000-0x00000000007B0000-memory.dmp

Filesize
1024KB

Download
memory/5084-93-0x0000000000A00000-0x0000000000B00000-memory.dmp

Filesize
1024KB

Download
memory/5084-103-0x0000000000A00000-0x0000000000B00000-memory.dmp

Filesize
1024KB

Download