vidar | 1912d659af4fedbc9e143eff5e666ce460a710fd84c83f7a4c4d8170356e578a

Analysis

max time kernel
150s
max time network
141s
platform
windows10_x64
resource
win10v200722
submitted
31-07-2020 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b0f78e83f4027c6b6bd15af68b68af2.exe
Size

595KB
MD5

7b0f78e83f4027c6b6bd15af68b68af2
SHA1

cf8fdfb81265fa4ec264f787dedcc2d52c782a36
SHA256

1912d659af4fedbc9e143eff5e666ce460a710fd84c83f7a4c4d8170356e578a
SHA512

37faf89c2735d629c682048fca73b6200c9b313a26307b426f4d60028c4f1d658417629af85ef1633d560fcba0851ad6a5a16615fc7a65945343949e1610de53

Score

10^/10

spyware discovery stealer vidar

Malware Config

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Executes dropped EXE 4 IoCs

Processes:

wotsuper.exewotsuper1.exedd09bc8c..exedd09bc8c..exe

pid process

2652 wotsuper.exe
3052 wotsuper1.exe
3904 dd09bc8c..exe
4204 dd09bc8c..exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7b0f78e83f4027c6b6bd15af68b68af2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\International\Geo\Nation	7b0f78e83f4027c6b6bd15af68b68af2.exe

Loads dropped DLL 3 IoCs

Processes:

wotsuper.exedd09bc8c..exe

pid process

2652 wotsuper.exe
2652 wotsuper.exe
4204 dd09bc8c..exe
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
JavaScript code in executable 1 IoCs

Processes:

resource yara_rule

\ProgramData\nss3.dll js
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

dd09bc8c..exe

description pid process target process

PID 3904 set thread context of 4204 3904 dd09bc8c..exe dd09bc8c..exe

resource	yara_rule
\ProgramData\nss3.dll	js

flow	ioc
23	ip-api.com

description	pid	process	target process
PID 3904 set thread context of 4204	3904	dd09bc8c..exe	dd09bc8c..exe

Drops file in Program Files directory 4 IoCs

Processes:

7b0f78e83f4027c6b6bd15af68b68af2.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	7b0f78e83f4027c6b6bd15af68b68af2.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe	7b0f78e83f4027c6b6bd15af68b68af2.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	7b0f78e83f4027c6b6bd15af68b68af2.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	7b0f78e83f4027c6b6bd15af68b68af2.exe

Drops file in Windows directory 2 IoCs

Processes:

7b0f78e83f4027c6b6bd15af68b68af2.exeMicrosoftEdge.exe

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	7b0f78e83f4027c6b6bd15af68b68af2.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wotsuper.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wotsuper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wotsuper.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

3752 taskkill.exe
Modifies Control Panel 1 IoCs
evasion

Processes:

MicrosoftEdge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Colors MicrosoftEdge.exe

pid	process
3752	taskkill.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Control Panel\Colors	MicrosoftEdge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 273 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = f84f865c2260d601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "lizu8db"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000fba34fd7d35eb78d554aa628dc33d7902b73fb1237c159eb20b30d596449f5b1a342e4edd82216a0251eb46948358ac73556daedfb7ed6ccb11a8df8	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\NextUpdateDate = "302999612"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionI = "{00ACE929-4A18-4FA6-9F05-8523D4AADC8D}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = f84f865c2260d601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d0cc54d63a67d601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658B	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000007932e245592b53dba37cb80792d44f6009e963919d570991ee0724cff202a33ce0ede89f22993ec96d537710ab91372d91d6e1ea83d84c482417	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 901c123a6d67d601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 01000000a36c6271dba4c316b19933a224ea98965370f998bc6916c888d933d96676eec630dc0565d4f5dab32ec51beb290384b94c443112028db719c68ecb80ddf5cc83c47c6d778cb33c6e44ab4985f2f173c28a9991e2ff2d5a9d68cd46f5fada527ed9ee1477b7fed0bdace97553fcd4f722cf0fc862566b633bc13487b48044ee9f43d13783faf6d9bdd521fc5c44cd601ff7465a48de65b64e40659c2f2f53a902eac421ec4cbcd082c6f29a1dbafae5e72cdf9752233d76a8a2fe94cb54277d00a469ee26276e554492fc685eb27c0d0606785905a811f45cd4a0d86ce9dfce7b0a5f05cf502db155cfdf8bf65974321a2eb230717603f46661eca796a09d268ce3456dba1a1993ed753b881e1000c4e5e72d2e10c431df17e680e01b1f80876da5bdca194b5248be3ab0c4e9cf4139aad289b6aff5bd485750fef45953a8c1c90c6617ac17f8ca6036de1c0c9557e0d48466c0695ac652b3eb0428098b342647fddf48037d2b538a60650f33476384f86a6535b1f36b434273348d9cb2467b73f0ca02d14f0b431576e559e9f98388203524086c10ce51520b491258ceaf3dba7ef3457471dc	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5f5650db3a67d601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\5FF1348C80820F2A98 = 0300000001000000140000005ff1348c80820f2a988d0c0c7abea0ea394b5e6c040000000100000010000000fd42404f68fae3f0d490e8d19d08ab1d0f00000001000000200000005546bb2210de2560292e6f4610af4ffbdb453f9bf9983e62942c35959e16038d140000000100000014000000b3b30880146b0eb235e8e136e7d15c9c4847f5f3190000000100000010000000e142e209d34bfb2eac257eb76a2b61e15c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000e5050000308205e1308203c9a0030201020213330000016fd585f24b93e88a0700000000016f300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3139313231323030303333315a170d3231303331323030303333315a3081a3310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3121301f06092a864886f70d010901161271666265406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfb24782c35c66c63688c01ed857df9a4330b81628c86831de4d577f8cb2155b880ee41953a18ac28de644bacfa97558ec6f522490f103b7fa0092430f8e0ba55c36dd91f6f1f91baec6eb3581d89133141e1580e02ec2445e5380b178f92f81e97193be8be1223d36e5f2be070a3db6ac17987ea3b42d15994c73a10e64794da4660a5d875e179c567bb06ecfd7cbf4c1ee4fe453284e72877d746a3e178788a1bd540ba9250a931a11105bb98f1b2b757fa6c5ade16e7cc1d1628fedb716018526f5b56630b54cd5f75f938e9b4a956609cc441aac84a10a101f6429b6fceb9434a41b24f0ca9781bf72b010f14bd13dc5d996b6ed6c4d53156969dd04f7390203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414b3b30880146b0eb235e8e136e7d15c9c4847f5f3301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038202010064d81278e224099c122690412271d5f2d92ae1c00f7135d64f63663ccc0588826bf24cc6cffa0d6666b7e3f989825dd1021fd1bdc6a9d4a492c0f46198534382204d8668b0f3c8d85f9f614f7fff47e391a4fdc89dba1b423f1d2a8d4986ff42bac032a21224b246b03ffef26e7da49d3ef381ff9d669cda0234445bff395be1b70627f013ccde692280d75d690b4f4c5e3a123b379bd30bdc6cf1af0c69d97eb0aa4f580eb4e876465b2c62514a612a3971f6bc6ace33f569e0cbcbd5498caf2af949952c310221a382d0a7fbc4594b0bfe96a1c81d26639b249beea28179ead8377bf70e9a09596997af2b405c5425a1e5e6e46b065016901b7cd120e2389d47924b1f834955135461f7592c9487e3910bf0de382ad5906dd8c46b321b176698caaec19d1ee10aa6679981d8f2f5c40d69240a7075ce4341305d2bbd082e03c81c41baeb557b41904482ae88d0566f339ab517ae2f84223d567f9ec734c1c5a2be39aa24c49930b6428bbe2fa300f2369e1c8cc554c14010f1ee518afa32e4bf0a15cb251d37791338f5ade8ced4b67ca5fc56320c2c2973f9b13e250dabe4a373580becf787afd552c6b293dfc7bfb1f67739c64df74ae3d373e2db9c27090fe15e58591824e4f150602af628917a6d1353919cd0a8489596f97070833a98b34c2d3a0ebafda2f81096533b773c5914d7f05e66cb17af2bcd11ad517440b5	MicrosoftEdge.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

3872 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2692 PING.EXE

pid	process
3872	regedit.exe

pid	process
2692	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

wotsuper.exewotsuper1.exe

pid	process
2652	wotsuper.exe
2652	wotsuper.exe
2652	wotsuper.exe
2652	wotsuper.exe
2652	wotsuper.exe
2652	wotsuper.exe
3052	wotsuper1.exe
3052	wotsuper1.exe
2652	wotsuper.exe
2652	wotsuper.exe
3052	wotsuper1.exe
3052	wotsuper1.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

2408 MicrosoftEdgeCP.exe

pid	process
2408	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exewotsuper1.exetaskkill.exeMicrosoftEdgeCP.exe

description	pid	process
Token: SeDebugPrivilege	996	MicrosoftEdge.exe
Token: SeDebugPrivilege	996	MicrosoftEdge.exe
Token: SeDebugPrivilege	996	MicrosoftEdge.exe
Token: SeDebugPrivilege	996	MicrosoftEdge.exe
Token: SeDebugPrivilege	3976	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3976	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3976	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3976	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3052	wotsuper1.exe
Token: SeDebugPrivilege	3752	taskkill.exe
Token: SeDebugPrivilege	3344	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3344	MicrosoftEdgeCP.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

996 MicrosoftEdge.exe
2408 MicrosoftEdgeCP.exe
2408 MicrosoftEdgeCP.exe

pid	process
996	MicrosoftEdge.exe
2408	MicrosoftEdgeCP.exe
2408	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

7b0f78e83f4027c6b6bd15af68b68af2.exeMicrosoftEdgeCP.exewotsuper1.exewotsuper.execmd.execmd.exedd09bc8c..exe

description	pid	process	target process
PID 3900 wrote to memory of 2652	3900	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper.exe
PID 3900 wrote to memory of 2652	3900	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper.exe
PID 3900 wrote to memory of 2652	3900	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper.exe
PID 3900 wrote to memory of 3052	3900	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper1.exe
PID 3900 wrote to memory of 3052	3900	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper1.exe
PID 3900 wrote to memory of 3052	3900	7b0f78e83f4027c6b6bd15af68b68af2.exe	wotsuper1.exe
PID 3900 wrote to memory of 3872	3900	7b0f78e83f4027c6b6bd15af68b68af2.exe	regedit.exe
PID 3900 wrote to memory of 3872	3900	7b0f78e83f4027c6b6bd15af68b68af2.exe	regedit.exe
PID 3900 wrote to memory of 3872	3900	7b0f78e83f4027c6b6bd15af68b68af2.exe	regedit.exe
PID 2408 wrote to memory of 3976	2408	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2408 wrote to memory of 3976	2408	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2408 wrote to memory of 3976	2408	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 2408 wrote to memory of 3976	2408	MicrosoftEdgeCP.exe	MicrosoftEdgeCP.exe
PID 3052 wrote to memory of 3904	3052	wotsuper1.exe	dd09bc8c..exe
PID 3052 wrote to memory of 3904	3052	wotsuper1.exe	dd09bc8c..exe
PID 3052 wrote to memory of 3904	3052	wotsuper1.exe	dd09bc8c..exe
PID 2652 wrote to memory of 3596	2652	wotsuper.exe	cmd.exe
PID 2652 wrote to memory of 3596	2652	wotsuper.exe	cmd.exe
PID 2652 wrote to memory of 3596	2652	wotsuper.exe	cmd.exe
PID 3596 wrote to memory of 3752	3596	cmd.exe	taskkill.exe
PID 3596 wrote to memory of 3752	3596	cmd.exe	taskkill.exe
PID 3596 wrote to memory of 3752	3596	cmd.exe	taskkill.exe
PID 3052 wrote to memory of 3552	3052	wotsuper1.exe	cmd.exe
PID 3052 wrote to memory of 3552	3052	wotsuper1.exe	cmd.exe
PID 3052 wrote to memory of 3552	3052	wotsuper1.exe	cmd.exe
PID 3552 wrote to memory of 2692	3552	cmd.exe	PING.EXE
PID 3552 wrote to memory of 2692	3552	cmd.exe	PING.EXE
PID 3552 wrote to memory of 2692	3552	cmd.exe	PING.EXE
PID 3904 wrote to memory of 4204	3904	dd09bc8c..exe	dd09bc8c..exe
PID 3904 wrote to memory of 4204	3904	dd09bc8c..exe	dd09bc8c..exe
PID 3904 wrote to memory of 4204	3904	dd09bc8c..exe	dd09bc8c..exe
PID 3904 wrote to memory of 4204	3904	dd09bc8c..exe	dd09bc8c..exe
PID 3904 wrote to memory of 4204	3904	dd09bc8c..exe	dd09bc8c..exe
PID 3904 wrote to memory of 4204	3904	dd09bc8c..exe	dd09bc8c..exe

C:\Users\Admin\AppData\Local\Temp\7b0f78e83f4027c6b6bd15af68b68af2.exe
"C:\Users\Admin\AppData\Local\Temp\7b0f78e83f4027c6b6bd15af68b68af2.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3900

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2652

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im wotsuper.exe /f & erase C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:3596

C:\Windows\SysWOW64\taskkill.exe
taskkill /im wotsuper.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3752

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052

C:\Users\Admin\AppData\Local\Temp\dd09bc8c..exe
"C:\Users\Admin\AppData\Local\Temp\dd09bc8c..exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3904

C:\Users\Admin\AppData\Local\Temp\dd09bc8c..exe
"C:\Users\Admin\AppData\Local\Temp\dd09bc8c..exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
4⤵
- Runs ping.exe
PID:2692

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Runs .reg file with regedit
PID:3872

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:996

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:1096

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3976

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4636

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4724

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
MD5
befcd9935633f7417e28f2660d676365

SHA1
c293d06c991fde8c562b898472a318b0afa067e9

SHA256
de6bbc1648a408ff79f5c7e48c25e0095251ecb0fde4ad88fd94adb6d03710b7

SHA512
03d34c622fdcc100832831d24eec3e1f8bc65ed22ab160bf032895fc18aebe0e66d403e380705207b7ed001215d7801f0d95af464f72108333e304a5837b828d

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
e824c09b483093d4825c5ccf76539123

SHA1
66399a2d4abdf4f29a35a350ef94946527c7b4d2

SHA256
a59e157f814cc47b7f49905796ff81659ecd3e90cf6a96ab2aa5328ea8fbf65e

SHA512
883ad2fbd85a32bb39791b4be52d798c59bfab84bd68fbb6a292afcdacd61e3d7b1e7981748821679e411a51e7dd02b736b42f2a1f7ef0a35e1758cb94e10433

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
MD5
e824c09b483093d4825c5ccf76539123

SHA1
66399a2d4abdf4f29a35a350ef94946527c7b4d2

SHA256
a59e157f814cc47b7f49905796ff81659ecd3e90cf6a96ab2aa5328ea8fbf65e

SHA512
883ad2fbd85a32bb39791b4be52d798c59bfab84bd68fbb6a292afcdacd61e3d7b1e7981748821679e411a51e7dd02b736b42f2a1f7ef0a35e1758cb94e10433

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd09bc8c..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd09bc8c..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd09bc8c..exe
MD5
d9a97096753da9101e89efe264834629

SHA1
bef5989964ecc57613554049b76086d99d4207f0

SHA256
2afb9e882933b951a803e82694e39249e51e0ec987212edc46f261240dad76b6

SHA512
4d29505235883ec980acdd62a5de049f6ae1209102c0658a70a06c0ffa7da59b312f619c9db3739da412a515b04813a09b0737d7bf64df1c8483083b01b413e5

Download Submit
\ProgramData\mozglue.dll
MD5
8f73c08a9660691143661bf7332c3c27

SHA1
37fa65dd737c50fda710fdbde89e51374d0c204a

SHA256
3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

SHA512
0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

Download Submit
\ProgramData\nss3.dll
MD5
bfac4e3c5908856ba17d41edcd455a51

SHA1
8eec7e888767aa9e4cca8ff246eb2aacb9170428

SHA256
e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

SHA512
2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

Download Submit
\Users\Admin\AppData\Local\Temp\D47F.tmp
MD5
50741b3f2d7debf5d2bed63d88404029

SHA1
56210388a627b926162b36967045be06ffb1aad3

SHA256
f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

SHA512
fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

Download Submit
memory/2652-0-0x0000000000000000-mapping.dmp

Download
memory/2692-96-0x0000000000000000-mapping.dmp

Download
memory/3052-7-0x0000000000A40000-0x0000000000A57000-memory.dmp

Filesize
92KB

Download
memory/3052-9-0x0000000000AA0000-0x0000000000ABE000-memory.dmp

Filesize
120KB

Download
memory/3052-3-0x0000000000000000-mapping.dmp

Download
memory/3552-95-0x0000000000000000-mapping.dmp

Download
memory/3596-93-0x0000000000000000-mapping.dmp

Download
memory/3752-94-0x0000000000000000-mapping.dmp

Download
memory/3872-6-0x0000000000000000-mapping.dmp

Download
memory/3904-98-0x00000000050D0000-0x00000000050D1000-memory.dmp

Filesize
4KB

Download
memory/3904-97-0x0000000003511000-0x0000000003512000-memory.dmp

Filesize
4KB

Download
memory/3904-90-0x0000000000000000-mapping.dmp

Download
memory/4204-101-0x0000000000402C70-mapping.dmp

Download
memory/4204-100-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download