vidar | 08e1f0430dadbe60e17f9065ffbe408e7a7de00b477d9279b81cd005ab047521

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe
Size

499KB
MD5

f235860236bd3dd0dfee2fe5b5b38305
SHA1

0c3c10edf0d83ba9e6c451883f053c56470b75b4
SHA256

08e1f0430dadbe60e17f9065ffbe408e7a7de00b477d9279b81cd005ab047521
SHA512

7601d3520097dbedd52127aec81c8f8e6ecc68672f850ed771e8abcec0f722cc93a2d03a017497781b7bd96ae7883dea8a023d4436a77fe21fde4af1088a6ac5
SSDEEP

12288:pANwRo+mv8QD4+0V16o844Kk3E+8ZV6vHecgGftQsATyCUXBc:pAT8QE+k3X+8T8HeIfsj

Score

10^/10

vidar 560 credential_access discovery persistence spyware stealer

Malware Config

Extracted

Family

vidar

Version

23.1

Botnet

560

http://archessee.com/

Attributes

profile_id
560

Signatures

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x0007000000017487-19.dat	family_vidar

Executes dropped EXE 1 IoCs

pid	Process
1716	wotsuper2.exe

Loads dropped DLL 2 IoCs

pid	Process
2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe
2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\wotsuper	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Advanced SystemCare = "\"C:\\Program Files (x86)\\IObit\\Advanced SystemCare\\ASCTray.exe\" /Auto"	regedit.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
3	iplogger.org
8	iplogger.org
9	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
25	ip-api.com

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wotsuper.reg	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wotsuper2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wotsuper2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wotsuper2.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433177678"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000f664107eff8b9a2d3b805e1f561541338de2e9ced63f5cd802d53116393d6297000000000e800000000200002000000070b396b6758d11cef1aa44250f7b5fe593242b496e5a54bdccc460e500d7641920000000375fd7c524bc080fe8db1799071d459ecdacb9c3fa761e08bd761589ad4271e940000000e1458d4d405909c95fd994135ac7ce68798433ef035cb7662da7c999124dbbc00854218b6130cc5e71d6451587f10d8de0872ed94e232c3d06ad5dd6350adc5a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A9BEFF1-78F0-11EF-8CD3-5EE01BAFE073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50f749f1fc0cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000df3e9925d93ea3e69838ea6226758b9371ed8276ca9298da4966438625a6b14e000000000e8000000002000020000000eefd077314e4773ce11c6b28c38fac26ab85e1b9aadabece1e5d36dd69aa88e0900000005817e4f960f32d602f3219bd3ae4b298a0654e8a6a5ca20b5153bf80d8401737d5232ef0146c0fac3c4c3db3bc382f1d7c59ebfa50cb80071d64a1d047cc5eb3d8f3254be83e9b4fb3502936455d4d21417d1ca169593174400226d2128272799919824b2bbcbcc7c83300f48b7a69986c97a34aaeeff3f7e136679eaad4866c54a9273dfaba09321f3757041c9bf12e400000004d0bf7767b90ab150f84f31f22de57ba4dfeaccfa8b6ae1dcab8034dda1fca1ac028373141aab219ee90c78e88b6c583cf6b9653c1085d0271a3bad639477746	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Runs .reg file with regedit 1 IoCs

pid	Process
344	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1716	wotsuper2.exe
1716	wotsuper2.exe
1716	wotsuper2.exe
1716	wotsuper2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1028	iexplore.exe
1028	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1716	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1716	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1716	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	30
PID 2532 wrote to memory of 1716	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	30
PID 2532 wrote to memory of 344	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	31
PID 2532 wrote to memory of 344	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	31
PID 2532 wrote to memory of 344	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	31
PID 2532 wrote to memory of 344	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	31
PID 2532 wrote to memory of 1028	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	32
PID 2532 wrote to memory of 1028	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	32
PID 2532 wrote to memory of 1028	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	32
PID 2532 wrote to memory of 1028	2532	f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe	32
PID 1028 wrote to memory of 2832	1028	iexplore.exe	33
PID 1028 wrote to memory of 2832	1028	iexplore.exe	33
PID 1028 wrote to memory of 2832	1028	iexplore.exe	33
PID 1028 wrote to memory of 2832	1028	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f235860236bd3dd0dfee2fe5b5b38305_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe
  "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:344
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1lBhp.html
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1028 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40e8d523c73ec5ff6b2ca668ccb7c482

SHA1
c813f5b31d45cb859a0c68eee8cafd15801d813d

SHA256
a18167fd896db43640ce4782d6ae060f27d05f647e00ccbff62528e1c313dd3f

SHA512
a070460b2d0e591f3fa92bd03094c4913b2dd135b80e32ec548874bbe4769d23e7dc5ee9e42cc1e42ae3907c8981b58d2c6ebae8590f536dec153e0293f24643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bcc160735c4d01454df6f44c1b51326

SHA1
c9566fddbe65aac105bf8e4a54af73b7cade69d9

SHA256
a79f18dfa315ea046e80571d45bcda63df7cd48c71c865b6023c2e29f26aa211

SHA512
abfbf30f9bb30a5a458b8cb1fdfdab719319cdd3789184daef6fd5b0be99da8be0a45361288e117087d0f4b8564ee63aac4ad559420199f6ff394577514ec5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d37188010bdd60182a7b5783526dfea5

SHA1
f51d66d7258ba489d8d028f684fd28c821a9c9ea

SHA256
242b6f43abc2f78b7cddc9bdd33a60205078d1bfa16914160d848397065013df

SHA512
a03eb94566e4d4e88aab50575a8caa0ae2a5173b08370c4f3ea4d0d8c154eea4e358574f7f8aad2aaddb82175c89b82bd3312bdf7630eef421cd3e8dda5969f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d22d47c27e72f2bf6976dde9be40dda5

SHA1
61349fa0803c2c050e18c844a0aad943e2f5480a

SHA256
546904851ebb8f2750d47a2aee52621378fe1b59d5598a5c8ddce83b85ba1c0c

SHA512
3801356b1c0a88a610bd6cbaac21da692af974e6526367f374873e728d1330c6796e6cfc1a7538578f33fb1d686b960356fdd06dfb990853d6e3110d0cd618c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
365b4f57f53082da66a1f3431fe98ae3

SHA1
f61ed8f6564dd6481ce13d4884c4578fb0696d50

SHA256
6d038ed54fc7560d51930f7855bf102658b369331ccc310262b9d8f0d863f08d

SHA512
1bf9a53b8e183aacbcad54cb17a1ecbe5d0f9cf9dc30c4814c6efd5f997c4cab0dc950e9d4b483f4df42399c676611ad7344e10c5a9174164ceb8d8da4aac939

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cb933863008fbd7b503c5a1340fadbc

SHA1
633ad3d804966f699d3b57aa68aa8acecb16f0ba

SHA256
f0f241398fa40b57b06beb66b9b9650ad881cab2b8dcd1480b9844b68eb5bf2e

SHA512
2dc56cb4c69c89726e4672e4b4221e6d5e6d3edf245b28422194db074eaf87d8d0e820387b893c997fc4b9d8c90eb7cb35bd4aac7abbc2c82caebe48353e5166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19ce667c72670eb6faa61b3b1bc0760e

SHA1
fe008b4504b95fd74e12add65df2479531fe15b3

SHA256
71d5516bd54060b584ae43bc374644698863784aac3bab623b3338cc78ffb4f5

SHA512
5cdaffbdee27f96eeccbfa13d53eb43017fec1f6d8d901b59bc0dee0981abe5f43cdf378e71dd0adc868e39a332eb1d9e826e0bf4f446827193253b38d6c8d2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68b90d31eec78d1f75db9c9898b1b298

SHA1
c2aa9097925b68d806ce7dceb5141b8c67a14627

SHA256
f300b4d5cce50754d99c509b57c3e96095ce9b84e6931ffcfeb293a0f08b5c68

SHA512
e45cab2a488e97c4876a384ec04f795f6581dca6f5a8be66e67b0520a9c1a827841ac26ec2626b5eb6e3ae00a7e5d1eb2c01327498f052ff06b6de83f523212f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a522011126de0334c2e445bd32747b0

SHA1
01dd312bad13e45e511ac782b4028e7ca1dd55b5

SHA256
6cb8699118ef6a18ad34cb2125becc3e43c211b72a07ea52015acaf333e6aad6

SHA512
bfec21ff9bbeb4520ffcea3063116c2ed94cc5e42ea157bcbacc8b00a06d907ae5cc5d2457cd7155cf709033e9582b1171dd21c87d3cbad2ffc939899d8f674e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b71577b5442e01eb107b1d793c9fcb6

SHA1
d94d9af3bf680c0072e717327890ade9e4a8583d

SHA256
5b7e154f2e7be2978e447a8f64d1dac15c351f92a14855779e8e3362a2faed8e

SHA512
862e53e6200a04c5ab93ba06a9208b0260811f065e9ac08b1b3c5ce57da96be1aba63194499c615ec1b85abaaf24687a398d6ed2df241bb03ff3754aa5adf630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f746d8a31cc970bc9492a6b92476147

SHA1
9a4c969b74476a76a07b220f686ce0fae077b389

SHA256
3b76c3d871f34e320a1a11033bd56f71d3c2df3e73925eec5846760bc949a460

SHA512
21280efe39dcd20834955f1409e3e5bfcb7b1d910ce2e7cb2943bfe474ee55e00512b3382fc59f0d0832e37919a2f191b39340690c4f90a00702f11ac9c30826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f8d159a528a5138018fc257be976997

SHA1
043dd6c59de7fc1513693bf3bf762af0dd01b18f

SHA256
c17fc0c65d8b5b09b33cb958288fda7bb8746732e8d9eeddcc0b05d9ef089027

SHA512
6f6885d4124fa185c5761757e04566624ef242b2dad4761976b8f29aaf87d2b0fb20069363baeb55077fa147d7a7997bbe580c4064882a4395238a8883416d70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
759130f77ba11e928cc84125a82f6522

SHA1
566d22eabbc6802122bef8888fefd2d043efaa70

SHA256
36ef73d74260c9a282e22ea0d4c90f4954ba6e915dfb586b78ef20eb568f0723

SHA512
7f39059e248a65c575b994a7ce8604d09305edd7250766631521fd60927fabd0de3e0a6161ddcbfa7a25ade5299cf6e207848b6992d38540df61539f894b62ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8d1aac360c34c47460addf41c956d89

SHA1
2e677b3da8413f37c9576df762e683f6308ebab1

SHA256
ba60e60160239bcdfde26e482250d94ab0f8ba028ad92bb7006e485700bfcd83

SHA512
6da717b7dcc960aef0803095d42306b6342f7fe9c8be3498dcda5d08a0c429e6504d581877d6a0b6d26e9a96590adae9041ad31e1a32b569c779f23fdb7c6a05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4605f21bdf0f6a7a5d9418db9df76449

SHA1
d11f02a1100b96da096470fb179fa097ae24646e

SHA256
6f85bb49afb04b2f796b6b907a795454f073cba0edfff820aa127cbcb4d4cc3f

SHA512
4789e0280cb7e9d01b35048c3fca1dd1da12f821799cdba6af1328636ae271a4ecc0077c2e0e0979158d9c9762364b3c03dfffcc428327e7527de331a3c3c337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
925c213572f8265d0db7582028efd328

SHA1
77fe9d19c63123515d1d3a9af6dddea170f74cf7

SHA256
4bd35c0c336d1abf6c6251726c667c2fdbd5a91f655826acf8395a6f46129e78

SHA512
45566f48ca344cf5f393998337c48bba8fc7899e070980e65cdae6e74101910c33248cf9b86cd60813ecb3760745c54b73d8253180de6955237f7e83d8074292

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f05fc4e6556b556c78ab8aa69e5fde1b

SHA1
160ddc59b7bafa078c3771d84a330aa650b2aefb

SHA256
71a599e599dc520e93674fba807fe84b5487681840b22858b9c56e337579849a

SHA512
1165c4c0c625685b5dbfca68d87e205e9fcf862adb704729c10800a18048fb0fd8a284e0ddf1bef19452a992db5f95d37ac63a6ea42c053d202fe10b7c888c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6587fa5504ab1e8b41c0a7b7722c7f7

SHA1
1f28da26c1e4c8cbba66e5991242764896806d0e

SHA256
75b378063894f50d1ad0e94b3ada6dd07c3d198487385ac4c5c249dd652bddb3

SHA512
7148cd6f5bf574494258c107b4e98369d675be693d3be739bd7f59394892f46d6401c844afa1a7ae9874cbf6f3cb75f997659e85c4034a7e552b66eaf3e6e29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9e260d0cffbecee5a4105c12585f3c3

SHA1
c516df0b553b154f18405ff6877d69811ca2f5b7

SHA256
1c2343a493215bf75be1dd7e5c0fa943691a42059e2cd9eef76782e69f3d693b

SHA512
3e638600f631c6d5167dc01e5ede0d51232447f8f9423fde0189ae62482bbfe5c52d0cb3f6ed50bea740ac16b4445b7d863de6273e85c0c3ec366b61f86d596c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65af4e6774c82f900525dc43c4c74860

SHA1
2f00613ec0a6c6c2c482653f22d51295c095fa4a

SHA256
75bf375ffa052a6e675f4801622dcc1a704bfdea0e9e9f493deafe4a70cf68c8

SHA512
f0fc1a8b82469a634f34a5739a648b113447efa09db6308c66ffe61eff7b7fc04ff4bd7b674dcc2a1ad1f1f561528138eded8eb96d98aedc4e6ef19d2baab863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9fajjbh\imagestore.dat

Filesize
2KB

MD5
27dcd343fc8c32f3662389c2b714e67f

SHA1
b4d8a99ff19d87647c3d22680a9f763a20fb57ec

SHA256
40c9ee52a026c2ffcd639c369fbf181487bbe5be92bf44c893a9bc92b8550f03

SHA512
eb1da024c407b344627d0e92809fb58fc8d672ab513ffbf1f49c98501e5db89bd782ed15c64f6cc4147021f13fc5a72c5126aeced6e1db3f77413542a0796b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\favicon[1].png

Filesize
2KB

MD5
18c023bc439b446f91bf942270882422

SHA1
768d59e3085976dba252232a65a4af562675f782

SHA256
e0e71acef1efbfab69a1a60cd8fadded948d0e47a0a27c59a0be7033f6a84482

SHA512
a95ad7b48596bc0af23d05d1e58681e5d65e707247f96c5bc088880f4525312a1834a89615a0e33aea6b066793088a193ec29b5c96ea216f531c443487ae0735

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC68.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC67.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\wotsuper.reg

Filesize
450B

MD5
42f073434559fb6b9c67aba86de89d1b

SHA1
9b969de41fc717353619068e46f21ec1db093ab5

SHA256
03ac69047bce954fdce3d00af881161a073f921d73ff79369e9ee96a109f9eed

SHA512
b1ae4fb02d7e629f824e084c5cd81e17be3bb37937eed7a1bfcd6aec0fd1cfe9a7299ecfc35958a5d98d11941fc6478e653b69140de02cbec28c4bf0647bd547

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper2.exe

Filesize
541KB

MD5
6db162b91023b85b2e832fab78c5047d

SHA1
26f4009be7c0b57e43240811d1128a077f2156d2

SHA256
033b331f9cdf220df42bea9a802b4f0479cbf7a0dabf6b3dcb9e5459b0489612

SHA512
3f891ad3f7f1813e84f462d5d9660a1d4c7fae75871c6a780c81d52dafb7142436716a4341fc878a10683cdcd3f89e5d314a53cd5470828d6e7471d1d259ce4a

Download Submit
memory/344-419-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/344-28-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download
memory/2532-27-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download