stealc | caa233e0b9760b73f53c810cc3b3195138f284b8e666e1a68f36e1b04c692594

Analysis

max time kernel
152s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
!!SetUp_!PaS$K?y$!_22409/Setup.exe
Size 673.6MB
Sample240627-v4yvysthmn
SHA256 69c15bbfb3616e18750a3571954788c356a55e1538e4db74cc23597f065f176b
MD5 569655a54514205d2bda86d23dea3649
SHA1 49ce139a7105a287bcdf421f7657d379bb31568d
SHA512 79a1306aa46bb5f66c629f077c3dc14ae7344c6ccf3c5f5c3d1ff3608a2ead7c550e08f265c90a0f27cf2fc8bc289f5298620aa5fe6aa57faa070385337e3796
SSDEEP 393216:pg/gZJV++Wb4K6vCzWy+Y8aYNbi7pMl2XbKuz+7fEqebX:e/a64X6+YwMe2X+fFebX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

stealc vidar discovery spyware stealer

Malware Config

Extracted

Family

vidar

https://aliszon.xyz
https://t.me/g067n
https://steamcommunity.com/profiles/76561199707802586

Attributes

user_agent
Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) AppleWebKit/534.6 (KHTML, like Gecko) Chrome/8.0.500.0 Safari/534.6

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/4340-167-0x0000000000B00000-0x000000000124A000-memory.dmp	family_vidar_v7
behavioral2/memory/4340-177-0x0000000000B00000-0x000000000124A000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Launcher32.exe

Executes dropped EXE 4 IoCs

pid	Process
4684	ImApp.exe
4368	ImApp.exe
3224	Setup.exe
924	DGHCBAAEHC.exe

Loads dropped DLL 33 IoCs

pid	Process
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4684	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
4340	Launcher32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4368 set thread context of 2956	4368	ImApp.exe	97
PID 924 set thread context of 3056	924	DGHCBAAEHC.exe	105

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Synapse Service.job	more.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1048	3224	WerFault.exe	91

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher32.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2472	timeout.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
5004	Setup.exe
5004	Setup.exe
4684	ImApp.exe
4368	ImApp.exe
4368	ImApp.exe
2956	more.com
2956	more.com
4340	Launcher32.exe
4340	Launcher32.exe
4340	Launcher32.exe
4340	Launcher32.exe
924	DGHCBAAEHC.exe
924	DGHCBAAEHC.exe
3056	more.com
3056	more.com
4340	Launcher32.exe
4340	Launcher32.exe
4340	Launcher32.exe
4340	Launcher32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4368	ImApp.exe
2956	more.com
924	DGHCBAAEHC.exe
3056	more.com

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
924	DGHCBAAEHC.exe
924	DGHCBAAEHC.exe
4340	Launcher32.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 4684	5004	Setup.exe	89
PID 5004 wrote to memory of 4684	5004	Setup.exe	89
PID 5004 wrote to memory of 4684	5004	Setup.exe	89
PID 4684 wrote to memory of 4368	4684	ImApp.exe	90
PID 4684 wrote to memory of 4368	4684	ImApp.exe	90
PID 4684 wrote to memory of 4368	4684	ImApp.exe	90
PID 4368 wrote to memory of 3224	4368	ImApp.exe	91
PID 4368 wrote to memory of 3224	4368	ImApp.exe	91
PID 4368 wrote to memory of 3224	4368	ImApp.exe	91
PID 4368 wrote to memory of 2956	4368	ImApp.exe	97
PID 4368 wrote to memory of 2956	4368	ImApp.exe	97
PID 4368 wrote to memory of 2956	4368	ImApp.exe	97
PID 4368 wrote to memory of 2956	4368	ImApp.exe	97
PID 2956 wrote to memory of 4340	2956	more.com	100
PID 2956 wrote to memory of 4340	2956	more.com	100
PID 2956 wrote to memory of 4340	2956	more.com	100
PID 2956 wrote to memory of 4340	2956	more.com	100
PID 4340 wrote to memory of 924	4340	Launcher32.exe	103
PID 4340 wrote to memory of 924	4340	Launcher32.exe	103
PID 4340 wrote to memory of 924	4340	Launcher32.exe	103
PID 924 wrote to memory of 3056	924	DGHCBAAEHC.exe	105
PID 924 wrote to memory of 3056	924	DGHCBAAEHC.exe	105
PID 924 wrote to memory of 3056	924	DGHCBAAEHC.exe	105
PID 924 wrote to memory of 3056	924	DGHCBAAEHC.exe	105
PID 3056 wrote to memory of 1680	3056	more.com	117
PID 3056 wrote to memory of 1680	3056	more.com	117
PID 3056 wrote to memory of 1680	3056	more.com	117
PID 3056 wrote to memory of 1680	3056	more.com	117
PID 4340 wrote to memory of 2268	4340	Launcher32.exe	118
PID 4340 wrote to memory of 2268	4340	Launcher32.exe	118
PID 4340 wrote to memory of 2268	4340	Launcher32.exe	118
PID 2268 wrote to memory of 2472	2268	cmd.exe	120
PID 2268 wrote to memory of 2472	2268	cmd.exe	120
PID 2268 wrote to memory of 2472	2268	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\!!SetUp_!PaS$K_y$!_22409\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\!!SetUp_!PaS$K_y$!_22409\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\Hq_Control\ImApp.exe
  C:\Users\Admin\AppData\Local\Temp\Hq_Control\ImApp.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Users\Admin\AppData\Roaming\Hq_Control\ImApp.exe
    C:\Users\Admin\AppData\Roaming\Hq_Control\ImApp.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Users\Admin\AppData\Roaming\Hq_Control\BUAWNFFIWXWNVUBESS\Setup.exe
      C:\Users\Admin\AppData\Roaming\Hq_Control\BUAWNFFIWXWNVUBESS\Setup.exe
      4⤵
      Executes dropped EXE
      PID:3224
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 836
        5⤵
        Program crash
        
        PID:1048
  - - C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Launcher32.exe
        
        C:\Users\Admin\AppData\Local\Temp\Launcher32.exe
        5⤵
        Checks computer location settings
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4340
      - C:\ProgramData\DGHCBAAEHC.exe
        
        "C:\ProgramData\DGHCBAAEHC.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\SysWOW64\more.com
        
        C:\Windows\SysWOW64\more.com
        7⤵
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\explorer.exe
        
        C:\Windows\SysWOW64\explorer.exe
        8⤵
        
        PID:1680
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CBFIIEHJDBKJ" & exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2268
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:2472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3224 -ip 3224
1⤵
PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DGHCBAAEHC.exe

Path C:\ProgramData\DGHCBAAEHC.exe
Size 4.4MB
SHA256 cfe865ff674950f8d2bde9161d0b0a34b26b9f742022754f212077d9068a3ea4
MD5 8b93302d2a4bf836ce4e6f6dbdad0ed4
SHA1 89d185e9754f77c16d816a9f27db26640d752c38
SHA512 39474f3b012bf539d52f9c865005577663b0bac7b926e679f0e5b9dd15c17d23f2df2ba391b9ba9b7450e6d2fe0d2f76ec28fcef10ed3ab570d549efc7fb977a
SSDEEP 98304:16z8A7kkKDWYfUzsh75LkDeStk/QrGnGt0LgZkwRnCplOQz:gz8wS546Mt0LgZRAlH
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImApp.exe

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\ImApp.exe
Size 258KB
SHA256 9b398917c796083a6005ab3f9d78243dbc0fad12be1e196be2b01041d4c951a7
MD5 312707a513f86ed20642f43f8ef4dd14
SHA1 eab360e8a8e8e5b6bf139394ca1409888586d02f
SHA512 cd11b6cc2d058f5825bd90f342df22fc22fe19f5e3e1cbb197fbbe83a64367bbeaac748ce9d9685403f3c32a36b329e061fabbf54badc5486c442d5df7168f30
SSDEEP 6144:Vb8R0q4y8fIfAHIJsAI3HsmF3HDONwz8XUJOo:x82PpoAMg3i+j
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImUtilsU.dll

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\ImUtilsU.dll
Size 1.4MB
SHA256 914b1e53451b8be2c362d62514f28bdef46a133535d959b13f3f4bf3bc63df3a
MD5 a7eaba8bc12b2b7ec2a41a4d9e45008a
SHA1 6a96a18bb4f1cd6196517713ed634f37f6b0362b
SHA512 0ae7fbdb2677d92c62337aa17b60a4887240a4a426ba638c7633587f4582adbcda2bde5ec824aab1a3f69acf2b391118763842acfab856d3d9764850961a2ac8
SSDEEP 24576:2EQirQajY+S5eqyL9dj7GP4a6xKlnNYndIA1HVtFyC0Glqb6WUOQZljMFbDG0:fQj+S5epJl7+eenN5+HVDD0bUOQPUbDP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImWrappU.dll

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\ImWrappU.dll
Size 158KB
SHA256 7187903a9e4078f4d31f4b709a59d24eb6b417ea289f4f28eabce1ea2e713dce
MD5 cbf4827a5920a5f02c50f78ed46d0319
SHA1 b035770e9d9283c61f8f8bbc041e3add0197de7b
SHA512 d1a285fb630f55df700a74e5222546656de7d2da7e1419e2936078340767d0bab343b603ba0d07140c790eb5d79a8a34b7818b90316ea06cb9f53cad86b6d3f5
SSDEEP 1536:+Vcm093l7KjJdwXjCsZ+WymDAZZxgbgROgldJ+VEcn75A:+Vcm03ggjCsZDym6Og5+Vpm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VC80.CRT.manifest

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\Microsoft.VC80.CRT.manifest
Size 1KB
SHA256 17ad1a64ba1c382abf89341b40950f9b31f95015c6b0d3e25925bfebc1b53eb5
MD5 541423a06efdcd4e4554c719061f82cf
SHA1 2e12c6df7352c3ed3c61a45baf68eace1cc9546e
SHA512 11cf735dcddba72babb9de8f59e0c180a9fec8268cbfca09d17d8535f1b92c17bf32acda86499e420cbe7763a96d6067feb67fa1ed745067ab326fd5b84188c6
MD5 SHA1 SHA512

Submit Download

Microsoft.VC80.MFC.manifest

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\Microsoft.VC80.MFC.manifest
Size 2KB
SHA256 4ed3ba814de7fd08b4e4c6143d144e603536c343602e1071803b86e58391be36
MD5 97b859f11538bbe20f17dfb9c0979a1c
SHA1 2593ad721d7be3821fd0b40611a467db97be8547
SHA512 905c7879df47559ad271dc052ef8ae38555eac49e8ac516bc011624bf9a622eb10ee5c6a06fbd3e5c0fa956a0d38f03f6808c1c58ee57813818fe8b8319a3541
MD5 SHA1 SHA512

Submit Download

SftTree_IX86_U_60.DLL

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\SftTree_IX86_U_60.DLL
Size 570KB
SHA256 9f7b9b366a675b5647f8878586f1883791969cacf51117a63294f24135cc64c3
MD5 92b7e397f5b367371aa4d328584e0352
SHA1 8a4e452b5879569728cd39b42c49b8820b7199ba
SHA512 9681eadf34d078139739e910a3e83436dd2210cc7a2e606311ebc36bb1f9a49d7b72f681c84d46cece15bc3ad53cd538ce5d86f3b6e2e0db8016548c62893fb8
SSDEEP 6144:0F1oxaK7hWLMxQqTxNEaPe/cq0sJBJYzlRtcChgWP5njLkV33j9DvA9inEVz:io0K7hhNN1m/cq0sJ/YzNcCjdoVg8u
MD5 SHA1 SHA512 SSDEEP

Submit Download

finial.csv

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\finial.csv
Size 6.2MB
SHA256 16b8cea15232bc88fd54013b74b2722e677ab948b2e49bfb9bb6fdcbef7c0e2e
MD5 bc37c260ac70ee14c82ed2ceb7d0aed3
SHA1 e81a7f9ba3e3f88e2297c7ebe1d76d749d071003
SHA512 444a387de2eac8b4406ae2b26514e02d3dce851c8c4b4f599ea2356c53ed12138a40f582f48cc97eed9f2d02aa95b33687cebd5134762a9ccae2841b480aecca
SSDEEP 196608:Yr8P/yt3hKRYEpXwzcmCJ0I1mctMtoJX4wH/tntBwGAqZY:YgHyt3hK2eXz0smcKutEGAqZY
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp80.dll

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\msvcp80.dll
Size 536KB
SHA256 2026f3c4f830dff6883b88e2647272a52a132f25eb42c0d423e36b3f65a94d08
MD5 4c8a880eabc0b4d462cc4b2472116ea1
SHA1 d0a27f553c0fe0e507c7df079485b601d5b592e6
SHA512 6a6cce8c232f46dab9b02d29be5e0675cc1e968e9c2d64d0abc008d20c0a7baeb103a5b1d9b348fa1c4b3af9797dbcb6e168b14b545fb15c2ccd926c3098c31c
SSDEEP 12288:Q1HyurvZ0JPjuTtSu86th1n/hUgiW6QR7t5j3Ooc8NHkC2eo:Q1HyurvZ0liTwuhtjnj3Ooc8NHkC2eo
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr80.dll

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\msvcr80.dll
Size 612KB
SHA256 02bdde38e4c6bd795a092d496b8d6060cdbe71e22ef4d7a204e3050c1be44fa9
MD5 e4fece18310e23b1d8fee993e35e7a6f
SHA1 9fd3a7f0522d36c2bf0e64fc510c6eea3603b564
SHA512 2fb5f8d63a39ba5e93505df3a643d14e286fe34b11984cbed4b88e8a07517c03efb3a7bf9d61cf1ec73b0a20d83f9e6068e61950a61d649b8d36082bb034ddfc
SSDEEP 12288:6Fqi2VC1J7Zs7a5zchr46CIfsyZmGyYCqeC:6Ui2C1JdoiEdmGyYu
MD5 SHA1 SHA512 SSDEEP

Submit Download

slub.yml

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\slub.yml
Size 15KB
SHA256 4628be205894281f1b65a1e5af6c19af2f85455ff90c04f72b8ea7af12c0e574
MD5 02d1879520f22f292a251335a2274035
SHA1 ac7043e5855195f4e311db9e06c708d0abb46898
SHA512 02776ea36a4dfd6a3ae16b424ff04a340160b85d45d0c831f9de942bae8efa2994aae3741b0431a380ec267cd77ad5ada6a0aacb5fa8329ba36e27bc973f8ab8
SSDEEP 384:UUbe930StQqgB3+3cSINR/oTtUFOLjk8kzRGtKj:5q9kSjgy2RoKujNyh
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\Hq_Control\sqlite3.dll
Size 465KB
SHA256 8567b0e23fd4178270ca674810755c9dfdae1f4028e01c0c74a4eeb7774a1688
MD5 b7fb7eb3cb04e0a086a8d945ff45615e
SHA1 cefaba225deae05b56451f18f11581631147a081
SHA512 54238bb4d3ffb3135703627e53f59bcec25f1d4f73412bb30283c65ba627c42e279be2c3299497b191fe4dec1d1b0d4e4998091a645337c75aa13f1d5f46eee3
SSDEEP 6144:OcX3wRPtfRkJExpFpyNQYDIJ6LuBaPZqKRFk5MO/IRA20hewTCifeaVbvwyiuY:O2CtpAIJ6Lu4qKRFk5J2gTteB
MD5 SHA1 SHA512 SSDEEP

Submit Download

b7770fa2

Path C:\Users\Admin\AppData\Local\Temp\b7770fa2
Size 12.9MB
SHA256 8b87112b346415280ef43eb91706f62fff09ada0e2128a92f86ffc587d5e85ab
MD5 ef55529b523ff21a75bfd60551f24134
SHA1 3d4452b18218cc9154a5fa8227518bd12f926a6d
SHA512 c637850405d6850daae2da8be6f614f975d6db2e3a78735dac17a4bd0748712f46fa796e0862d377d7f5b60e4f70f56217e28a3afe716a723156e6f3701b7f86
SSDEEP 196608:PepvCz9MrY949zwku8aYZwEbi764UPDT12XbswBPZT76P2z+Hbf2fQnOtW8K:P6vCzWy+Y8aYNbi7pMl2XbKuz+7fEqV
MD5 SHA1 SHA512 SSDEEP

Submit Download

bde1a8

Path C:\Users\Admin\AppData\Local\Temp\bde1a8
Size 1.3MB
SHA256 13147df98f9460cad39ccb1ba6305c2773c9183eeb67f6caa22eb725b113c631
MD5 470247c1e7e216800f656be7ae39571c
SHA1 53565deeb9d546a943018d40447e64192348e567
SHA512 5d073a44b2853ce2c85a31ca72252472597dd6d4e99780a0a374599f391435470ccc077ac99b15f6f26b992d19533fc9378bab5bd867b55d181e6f4eee6debdf
SSDEEP 24576:6KvBCXs2mgdKb9W25CfQitqxsCJPEKIuS3duRaTeR8cH0TsaDwbaoUr6jgkKQc1V:6KvBCc/ZW20IsCJPEKIuS3duYHctaDwi
MD5 SHA1 SHA512 SSDEEP

Submit Download

IMHttpComm.dll

Path C:\Users\Admin\AppData\Roaming\Hq_Control\IMHttpComm.dll
Size 32KB
SHA256 96d6264b26decf6595ca6f0584a1b60589ec5dacdf03ddf5fbb6104a6afc9e7a
MD5 a70d91a9fd7b65baa0355ee559098bd8
SHA1 546127579c06ae0ae4f63f216da422065a859e2f
SHA512 f13b735a47090c7c6cc6c2bf9148408ee6db179c96ee6428270541f27e50ad12cff7486f3a6ffac2ba83fd2e6e8e49661e6258f5aee97eb0f48771cbbd22aefa
SSDEEP 384:UYacYCuDAIKaDEsdpRPcWzXKNfdZ1uTslWfXLhxyM8OjrsVIObsU25hoe1nYPLMt:Scr9/i1AscZ1wf7h4bOjKRsIe1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImABU.dll

Path C:\Users\Admin\AppData\Roaming\Hq_Control\ImABU.dll
Size 310KB
SHA256 c56d37f20069e48eade31236b4d3aa5afda2621bd77760e85964f1e6834be9a6
MD5 2102382908725f195ce2c3703caa0c5f
SHA1 1b2817c66c9e98e3286498382a7136f1232fc67a
SHA512 80986592a58856b2e741c88f3d0d89512fa05fe77d2a2ddd2c411593875568e842eba2e8ae2ccf1de52bdf21b6a7227156bf69e40ae1fd20c5d592a8c814974f
SSDEEP 6144:8nZnLK6dcH+GoXPk5XYlmqPyrcXKFOgCYr:8n1LRjGoMJcX2r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImDbU.dll

Path C:\Users\Admin\AppData\Roaming\Hq_Control\ImDbU.dll
Size 86KB
SHA256 db890bb2555e0bf3f82b38dc12ecd581348e40e53f9a51dd512149075c7df0a4
MD5 8ae8bb143301934a023bc5c9bb160b56
SHA1 228c965619b188cc3c68563bd33691158699416c
SHA512 827729a19f68c732f9ab9e4de90dd5c8cdce9993487c9016ac646c3c4ab966431c51b999e45571efc0ad0380e5d280aa32bcf8b07a73cc52e70a11935ae5356b
SSDEEP 1536:zlwQkY/WTi9rvhhpMV52QTXiy2Ael9tUzODb3UdCCHoXH:SeWTCrvhhYnvel9tUzODb3Ud3IX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImLookExU.dll

Path C:\Users\Admin\AppData\Roaming\Hq_Control\ImLookExU.dll
Size 262KB
SHA256 908ab22cb8fa1b9125cf5746e5591fd84e4853326a812b9431ca1c0b9e997e1f
MD5 6527be4d6a3333dc5a49218c4f80530d
SHA1 97c8965b01d2644fb17a0f818af59bc0471e38a7
SHA512 69a57cc28583861b97a02968106f007d56c2b5826fc5aa843978f0bf3a3f155ad9f2b7dfbe8260e38c2a7b1ed759f6f6fadbeef32cec9d7c4ab8f541f645dc5b
SSDEEP 6144:2X6ytmY4o8xnZSYDI73lFlNogVFl4OgqxLwSrIs:2X6ytmY4pZSYkTlNTfw2Is
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImLookU.dll

Path C:\Users\Admin\AppData\Roaming\Hq_Control\ImLookU.dll
Size 606KB
SHA256 a6766c524497144d585efa4fe384b516b563203427003508f7c8f6bffa7c928d
MD5 3ea6d805a18715f7368363dea3cd3f4c
SHA1 30ffafc1dd447172fa91404f07038d759c412464
SHA512 a102f23741de4ca2184485d9aa4ddd1a36b9ea52cb0859cfd264d69a9996293b7e29b325625f1f6f9330d6c80ff415e09e85e1ae838c58acef585ae8dffe3070
SSDEEP 6144:5hvkhcT5e0HWJ5/10UfCrXCL12gQhYwtHWDEyF0nb6rFBvJ+sbJeDH+8uGh7xgLX:5hvkhcTd2JxXCrS85h0Dh0nMKbz45
MD5 SHA1 SHA512 SSDEEP

Submit Download

ImNtUtilU.dll

Path C:\Users\Admin\AppData\Roaming\Hq_Control\ImNtUtilU.dll
Size 94KB
SHA256 a8e1b0e676dce9556037d29fd96521ec814858404ba4cfdd0db0edbe22c87bc7
MD5 bb326fe795e2c1c19cd79f320e169fd3
SHA1 1c1f2b8d98f01870455712e6eba26d77753adcac
SHA512 a1ec894151baa14e4ac1ee9471e8606bf74edd39f7833d9a1a44eee74d403f6b52780c135e9718ff9564fa27d7128c22b8410b21f77e6d804f698cfb4eda65a1
SSDEEP 1536:q01U2obLeNvXXZ6Wb/2LamjMkUYCTSZaKAxvSJKRDOAG921:NobLeNvXp6Ou+mjMkUYC2ZVAxxFOAG9s
MD5 SHA1 SHA512 SSDEEP

Submit Download

mfc80u.dll

Path C:\Users\Admin\AppData\Roaming\Hq_Control\mfc80u.dll
Size 1.0MB
SHA256 18be5d3c656236b7e3cd6d619d62496fe3e7f66bf2859e460f8ac3d1a6bdaa9a
MD5 ccc2e312486ae6b80970211da472268b
SHA1 025b52ff11627760f7006510e9a521b554230fee
SHA512 d6892abb1a85b9cf0fc6abe1c3aca6c46fc47541dffc2b75f311e8d2c9c1d367f265599456bd77be0e2b6d20c6c22ff5f0c46e7d9ba22c847ad1cbedc8ca3eff
SSDEEP 12288:o5lk6KUYmYRP6vAt9+J51r64f22JhPeEiz8F+p/xoOTa+S9XqNNw2ohW3:UyUaP64t9+JfrRJiz8F+p/N2/cmW
MD5 SHA1 SHA512 SSDEEP

Submit Download

wlessfp1.dll

Path C:\Users\Admin\AppData\Roaming\Hq_Control\wlessfp1.dll
Size 70KB
SHA256 fbd4b6011d3d1c2af22827ca548ba19669eef31173d496e75f064ef7a884431c
MD5 5120c44f241a12a3d5a3e87856477c13
SHA1 cd8a6ef728c48e17d570c8dc582ec49e17104f6d
SHA512 67c0e718368e950d42f007d6a21c6f903b084d6514f777b86aab3111ffe3be995949674276081c0281139a0b39119b84630a0ac341d4ae78677ac8346f371ae1
SSDEEP 1536:nEqYKdOEuqRKXd9ZWbIOinToIfYeyOgtPko:EqnB89ZouTBf5yOgtPko
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2956-161-0x00007FF958DB0000-0x00007FF958FA5000-memory.dmp

Download

memory/2956-163-0x0000000073DD0000-0x0000000073F4B000-memory.dmp

Download

memory/4340-166-0x00007FF958DB0000-0x00007FF958FA5000-memory.dmp

Download

memory/4340-167-0x0000000000B00000-0x000000000124A000-memory.dmp

Download

memory/4340-177-0x0000000000B00000-0x000000000124A000-memory.dmp

Download

memory/4340-178-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/4368-149-0x0000000073DD0000-0x0000000073F4B000-memory.dmp

Download

memory/4368-157-0x0000000073DD0000-0x0000000073F4B000-memory.dmp

Download

memory/4368-138-0x00000000005F0000-0x000000000063D000-memory.dmp

Download

memory/4368-141-0x0000000002150000-0x00000000021DE000-memory.dmp

Download

memory/4368-144-0x0000000000650000-0x0000000000660000-memory.dmp

Download

memory/4368-152-0x0000000073DD0000-0x0000000073F4B000-memory.dmp

Download

memory/4368-150-0x00007FF958DB0000-0x00007FF958FA5000-memory.dmp

Download

memory/4684-78-0x0000000000730000-0x0000000000740000-memory.dmp

Download

memory/4684-89-0x00007FF958DB0000-0x00007FF958FA5000-memory.dmp

Download

memory/4684-81-0x00000000022D0000-0x000000000235E000-memory.dmp

Download

memory/4684-74-0x0000000002100000-0x000000000214D000-memory.dmp

Download

memory/4684-128-0x0000000060900000-0x0000000060979000-memory.dmp

Download

memory/5004-155-0x0000000073DD0000-0x0000000073F4B000-memory.dmp

Download

memory/5004-0-0x0000000001F90000-0x0000000001F91000-memory.dmp

Download

memory/5004-7-0x0000000073DD0000-0x0000000073F4B000-memory.dmp

Download

memory/5004-8-0x00007FF958DB0000-0x00007FF958FA5000-memory.dmp

Download

memory/5004-28-0x0000000073DD0000-0x0000000073F4B000-memory.dmp

Download

memory/5004-27-0x0000000073DE2000-0x0000000073DE4000-memory.dmp

Download

memory/5004-50-0x0000000073DD0000-0x0000000073F4B000-memory.dmp

Download

memory/5004-1-0x0000000000400000-0x0000000001C28000-memory.dmp

Download

memory/5004-10-0x0000000073DD0000-0x0000000073F4B000-memory.dmp

Download