vidar | e84f3f36aa22f8b7f7399ce57c68014ea23140e88755516db02b5e056d18dad6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2024, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
down.exe
Size 1.3MB
Sample241007-q4nmrssbqg
SHA256 e84f3f36aa22f8b7f7399ce57c68014ea23140e88755516db02b5e056d18dad6
MD5 13476835b5465cf91e4dd7e60e110e56
SHA1 38af4e6440237a3f0f7eb8378a9f82ea473fc9a4
SHA512 90635bef1cfd86608c757270f45658b9aacf582afa249a58b046f533c00925851dc9e6cbd04cf54b7ae55965cc25dd94eac90a7b78b7a4a6da32ad5bbc74f74b
SSDEEP 24576:CMF7WKYDIOMJRvFadXXUfTwrlWB4Zsasxb3+PcRmJDh/:evDIOMJG9kil7bsxZIJDh/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

vidar 744fd163d6d4e0ac37e4032bcbfbb6af credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

744fd163d6d4e0ac37e4032bcbfbb6af

https://steamcommunity.com/profiles/76561199780418869
https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 15 IoCs

stealer

resource	yara_rule
behavioral2/memory/4912-38-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-39-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-40-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-51-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-52-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-60-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-61-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-69-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-70-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-86-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-87-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-109-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-110-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-120-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7
behavioral2/memory/4912-121-0x00000000075C0000-0x0000000007836000-memory.dmp	family_vidar_v7

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 4912 created 3560	4912	Kim.pif	56
PID 4912 created 3560	4912	Kim.pif	56

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	down.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Kim.pif

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncWave.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncWave.url	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
4912	Kim.pif

Loads dropped DLL 2 IoCs

pid	Process
4912	Kim.pif
4912	Kim.pif

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
1212	tasklist.exe
100	tasklist.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\OrchestraOut	down.exe
File opened for modification	C:\Windows\SureRow	down.exe
File opened for modification	C:\Windows\CountedSexo	down.exe
File opened for modification	C:\Windows\FortDesigns	down.exe
File opened for modification	C:\Windows\BiteBoulevard	down.exe
File opened for modification	C:\Windows\PicturesFuck	down.exe
File opened for modification	C:\Windows\VitaminUw	down.exe
File opened for modification	C:\Windows\MotherboardWash	down.exe
File opened for modification	C:\Windows\GoodsReturned	down.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kim.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	down.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Kim.pif
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Kim.pif

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4044	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2928	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	tasklist.exe
Token: SeDebugPrivilege	100	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4912	Kim.pif
4912	Kim.pif
4912	Kim.pif

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1172	2524	down.exe	84
PID 2524 wrote to memory of 1172	2524	down.exe	84
PID 2524 wrote to memory of 1172	2524	down.exe	84
PID 1172 wrote to memory of 1212	1172	cmd.exe	86
PID 1172 wrote to memory of 1212	1172	cmd.exe	86
PID 1172 wrote to memory of 1212	1172	cmd.exe	86
PID 1172 wrote to memory of 2024	1172	cmd.exe	87
PID 1172 wrote to memory of 2024	1172	cmd.exe	87
PID 1172 wrote to memory of 2024	1172	cmd.exe	87
PID 1172 wrote to memory of 100	1172	cmd.exe	89
PID 1172 wrote to memory of 100	1172	cmd.exe	89
PID 1172 wrote to memory of 100	1172	cmd.exe	89
PID 1172 wrote to memory of 2020	1172	cmd.exe	90
PID 1172 wrote to memory of 2020	1172	cmd.exe	90
PID 1172 wrote to memory of 2020	1172	cmd.exe	90
PID 1172 wrote to memory of 4856	1172	cmd.exe	91
PID 1172 wrote to memory of 4856	1172	cmd.exe	91
PID 1172 wrote to memory of 4856	1172	cmd.exe	91
PID 1172 wrote to memory of 732	1172	cmd.exe	92
PID 1172 wrote to memory of 732	1172	cmd.exe	92
PID 1172 wrote to memory of 732	1172	cmd.exe	92
PID 1172 wrote to memory of 1732	1172	cmd.exe	93
PID 1172 wrote to memory of 1732	1172	cmd.exe	93
PID 1172 wrote to memory of 1732	1172	cmd.exe	93
PID 1172 wrote to memory of 4912	1172	cmd.exe	94
PID 1172 wrote to memory of 4912	1172	cmd.exe	94
PID 1172 wrote to memory of 4912	1172	cmd.exe	94
PID 1172 wrote to memory of 2436	1172	cmd.exe	95
PID 1172 wrote to memory of 2436	1172	cmd.exe	95
PID 1172 wrote to memory of 2436	1172	cmd.exe	95
PID 4912 wrote to memory of 4760	4912	Kim.pif	96
PID 4912 wrote to memory of 4760	4912	Kim.pif	96
PID 4912 wrote to memory of 4760	4912	Kim.pif	96
PID 4760 wrote to memory of 2928	4760	cmd.exe	98
PID 4760 wrote to memory of 2928	4760	cmd.exe	98
PID 4760 wrote to memory of 2928	4760	cmd.exe	98
PID 4912 wrote to memory of 2588	4912	Kim.pif	99
PID 4912 wrote to memory of 2588	4912	Kim.pif	99
PID 4912 wrote to memory of 2588	4912	Kim.pif	99
PID 4912 wrote to memory of 1144	4912	Kim.pif	103
PID 4912 wrote to memory of 1144	4912	Kim.pif	103
PID 4912 wrote to memory of 1144	4912	Kim.pif	103
PID 1144 wrote to memory of 4044	1144	cmd.exe	105
PID 1144 wrote to memory of 4044	1144	cmd.exe	105
PID 1144 wrote to memory of 4044	1144	cmd.exe	105

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3560
- C:\Users\Admin\AppData\Local\Temp\down.exe
  "C:\Users\Admin\AppData\Local\Temp\down.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c move Devil Devil.bat & Devil.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1212
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "wrsa opssvc"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2024
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:100
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c md 285204
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /V "AugQualificationDepthWidth" Course
      4⤵
      System Location Discovery: System Language Discovery
      PID:732
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c copy /b ..\Hb + ..\Rapid + ..\London + ..\Royal + ..\Charter + ..\Deck + ..\Pichunter + ..\Killing N
      4⤵
      System Location Discovery: System Language Discovery
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\285204\Kim.pif
      Kim.pif N
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\HIDGCFBFBFBK" & exit
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1144
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:4044
  - - C:\Windows\SysWOW64\choice.exe
      choice /d y /t 5
      4⤵
      System Location Discovery: System Language Discovery
      PID:2436
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Practices" /tr "wscript //B 'C:\Users\Admin\AppData\Local\DataWave Sphere Co\SyncWave.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Practices" /tr "wscript //B 'C:\Users\Admin\AppData\Local\DataWave Sphere Co\SyncWave.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2928
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncWave.url" & echo URL="C:\Users\Admin\AppData\Local\DataWave Sphere Co\SyncWave.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyncWave.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kim.pif

Path C:\Users\Admin\AppData\Local\Temp\285204\Kim.pif
Size 872KB
SHA256 d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd
MD5 18ce19b57f43ce0a5af149c96aecc685
SHA1 1bd5ca29fc35fc8ac346f23b155337c5b28bbc36
SHA512 a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558
SSDEEP 12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\285204\N
Size 570KB
SHA256 62834a6dad4f88b12d055896e14ed6638acdc2399a35b96a5df66c6f7ed72fef
MD5 2fa0ad6b54cc96a82097293820a6c8f8
SHA1 cc691ac7cb82d6ef144c59b6ad0944bd57813c38
SHA512 c1d6dedfc71aba9d84832f2b4235d5ce2ddb4b79cce6991c1416ba0b6ebf4227010ea71cc9e846a6d3a8d445a1ff1b03af0f8b7143fa767fe73f4b9074c38539
SSDEEP 12288:J+c0aqFQCR6vEaajwasRZA78a3NUQoPVmEnCDxtDFybw3UFDxkMD4H2:JkabCi7aj7j96sEnlw3udT4H2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Charter

Path C:\Users\Admin\AppData\Local\Temp\Charter
Size 89KB
SHA256 4781b721205bcc4a912534f0f006acc8f49f220909b45c82e5d70ca718e80b84
MD5 ec287f03de31d75d7b65333ad856d57d
SHA1 65b43b521b8afba6d9d3c325f71ef104ba1212f8
SHA512 7e560fd33df0f4d8a1c9f954447dd29a8311a9dad6ef3ca3984c102b9a01952028ba146729e080f0de8bf3287f05d510af684000d3f6bfdfe921ee9b6b2629d0
SSDEEP 1536:lQ296HDQqGSDKEr5Ysl+m6YbwebFnDE6xrnuXUusGn7XmYaCr4zWPXb54:lsrjDK0ysl+4bJb9DEenAUGXs9WPl4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Course

Path C:\Users\Admin\AppData\Local\Temp\Course
Size 6KB
SHA256 71ac8f4534eb924876822260553e2c5fdfee7fc9a50790ffd3842339d8a33e35
MD5 6da24f141475e1c94d0baa534671730e
SHA1 699de571854c9eab964ddde0c12f07818259017e
SHA512 49cd5899f209632ac7ef1fd89b5190afa7cccbd78bf87036de2fa8c384d33e9296e9a66476c14c18f9a4ed4cf14cbba8942ddc5c4af90396a494c581195df95f
SSDEEP 192:yHAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMlE:yHAHhww+/2nlP3r1WAE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Deck

Path C:\Users\Admin\AppData\Local\Temp\Deck
Size 95KB
SHA256 75f00c8c8a5841c48d383384ed01d0d9fea056fc8bb6b7e275e3a29edf37fa7b
MD5 5bdef9e70fa8aac0118e96d47f1e1dbc
SHA1 0989482c6280bf460219d35a1824d760cd9ed3e0
SHA512 83c8fb674878a41fb47ceaa999672910e02e1be6c1c0cdfbd89cb0252a7758b3f7c9620d85e749b57ff7589b5d4d5a8fb4a7f9830add8d4406f65aa4ea0cbd17
SSDEEP 1536:m7fbiJJHwRyoQxEEEHt1yDrScGPz9oXbaIfzwTmmlnieHdKXhVLhQoKqsKlL5JU:m7fS5NSDeuzEhammljKXh1hQoPl1JU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Devil

Path C:\Users\Admin\AppData\Local\Temp\Devil
Size 24KB
SHA256 d97e4faaa2b3f23b147a2a626634794e9e853a3e661472502d6d786edb1c6c7a
MD5 97d7d087cf461ff97c4a4438102c1016
SHA1 8b06c86ad5643e7f2a7300a0823711e9ba436963
SHA512 16c2ae7de0fbba2b2b6f0e5073d4bccd998cc972052f85fbfa70f448aa43634d51b50bffcfdd155bfad0111035067385414b7f94722eb3ae0c5939f934e864f0
SSDEEP 768:HMi5D4zCGuEI4R9/rz1ViWKnw4B8lsMZwLELR:HVqOGuEdRdrz1ViWkwnlst2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\Hb
Size 69KB
SHA256 3c4f40140a71ecfde55326f84ca878e5c1a101d457107da13017f5670c6a5bb4
MD5 ef5519b0e3d69ac10317974081e12222
SHA1 49ed090bb19c951090b1633e2fd843c949951f07
SHA512 0cb1cde599e6a93fe2ff68309086fd82c5ccd6cac966504ade451026a8da2f0442ee80fd873fbffdaecf18d8ab729317bdc017dd3744fbd744fa5b892b70951c
SSDEEP 1536:n6+soL5ZD2wbfiKZ3vDx8K8X8MfnaqwZqnakDVGP:ndtDt+cfDx8K8b/RAqnakm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Herself

Path C:\Users\Admin\AppData\Local\Temp\Herself
Size 866KB
SHA256 f9d2fe0dff05d8485cc1104e64940673055bd2ee3ff90297dad183fb6356eae3
MD5 352d59010c3a1ad07c6cc631429c3898
SHA1 d84012a103d428bda710012a40b5acd5aa2e8f05
SHA512 cfa507f35ab27e942e756c1d60599926706730bf207b5ebeb46702e52ce67428f16a22c4e7565d66992b69b26f76f651dda2bf17b6ef36592aff57e0587e343d
SSDEEP 12288:JV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:zxz1JMyyzlohMf1tN70aw8501
MD5 SHA1 SHA512 SSDEEP

Submit Download

Killing

Path C:\Users\Admin\AppData\Local\Temp\Killing
Size 13KB
SHA256 f63d2eb292cab30f8e1ab7d9e2ed7b3b19b2be588da4fed455265ea9a6264a11
MD5 a3dbd9ae326c770abcc54b0fdd7a22eb
SHA1 97d0e17dc71226a7816e1cbb3e070fa8a4872ff6
SHA512 5adda01b4500af1f5c09f0a78db320cf7611e6b595d2d9ebc907b5f70dcd4277d11d0056e4ac66fc72f3347088f14650635ba6a7ab8c8438772a52e3966fca71
SSDEEP 384:g8TL/Ygzgt+BhpjMZ+Th/ISJwf36l73gKidtvElpQRX:lk+BhpjMZM/IQuO3VidtvEzk
MD5 SHA1 SHA512 SSDEEP

Submit Download

London

Path C:\Users\Admin\AppData\Local\Temp\London
Size 75KB
SHA256 af8444e8ee47f86fb80bcca4b65c0e2db813240a6479a44ed7c0d4ad310d43e2
MD5 463606075e8bc9b04f96c6f893469f91
SHA1 4fe270343a5a65b1357a0ff96f1d474cfd97bbea
SHA512 0a440cc3052460b32ff289a897eb641568811572376d466cbdba786c02c585e25c2699aef7860ffcb460933f62d120255bbdfe6926135a5c5fe56b3a910e550d
SSDEEP 1536:0PfJg+cBXg/tHU4pmgOUlRixa03o64nBREl6oW+9zY1NkR+T:kfz4XgNU4p6CixajSR/B4+Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Pichunter

Path C:\Users\Admin\AppData\Local\Temp\Pichunter
Size 91KB
SHA256 02f813b83cd0126e876f387ac82b51289a9888e7b142fe41a543aaf57e91d225
MD5 9b7919ea2318bec3ef9666c982b77119
SHA1 55e2940fc3dc8f377b16ee06c58ee066e7e766f0
SHA512 e5619ba41d1380d853fcb519dd7acaea1d9946a5f336241a0f396c75c20499a8da72487b6fb0713edf923ba79580425211d0f00e1ff650486d43f16c2e18c2af
SSDEEP 1536:vRyZnjSkaJqCzPrxTZRLRHtvFz352GMg5Y+CnZNXlMX1ZUhrDVKSYpfHMi+ASNPo:vEeGCzzxTZRLXvFDDMg5YbBGFZUFDEfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rapid

Path C:\Users\Admin\AppData\Local\Temp\Rapid
Size 68KB
SHA256 3739a2c7bf513612f2d616bb10b0221512fa4cce0222441d7ba96ffdfb553387
MD5 78a2388d3143b203f0d68eda1962fd9c
SHA1 743bc34a72ed75189c491f5c14dcfe3ce3f4f434
SHA512 e9dc06b5bdef912d33b129fad85561083ee8e56052929e5fe4dde9ed02d65fa6d2c3218ff045abbe7770a662959af00dff6a56b84f684cc0f00451b77e764255
SSDEEP 1536:DxgPJZhK6L8YpfBRPnrzIhSh7khcQTqD22qjDoQT0FuTngZ7rpG:ybQCRDs0AheqjUQIKn+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Royal

Path C:\Users\Admin\AppData\Local\Temp\Royal
Size 70KB
SHA256 207eb1026caac4ee644f3b7e1be0d455ac93298b07e329371e1bbd81cc6dc50e
MD5 f81ed71b4707976f2074491adb2e4f3c
SHA1 3bc06f946916884ddc04bf534deb823ac94e34e8
SHA512 28eb57f3a5bbb52a865744c999a11345360a2332d1e5a52b70db58b410944f387c4ba3d5a0bcded792909848d7693f898cb66900d0e94c74994bf1a1d71648e2
SSDEEP 1536:aWLCNmECA0irmrbv+YsieH8wmpOVKX9EIN6ro3d:ROHd+6Z8hp9Vt3d
MD5 SHA1 SHA512 SSDEEP

Submit Download

delays.tmp

Path C:\Users\Admin\AppData\Local\Temp\delays.tmp
Size 1023KB
SHA256 8b215bed267f27b72618d7b16aa37c074818b3bdc0050236df6bc8a0fd4f3a42
MD5 a0e79c5fd0c77e82df1f6ffdc96e5c93
SHA1 6dd0894badf7992982f385f11e2896f1a1d6fd85
SHA512 70acb14156871ee3f631da18c96911eeb110eae979838f590bb810f7ba014ae6cdb1314ab371247f79025332f8dea09416f10df27210de6fe9065a148137cbf1
SSDEEP 3:1E:e
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4912-38-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-69-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-40-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-37-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-51-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-52-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-53-0x0000000004BC0000-0x0000000004E1F000-memory.dmp

Download

memory/4912-60-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-61-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-39-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-70-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-86-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-87-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-36-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-35-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-109-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-110-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-120-0x00000000075C0000-0x0000000007836000-memory.dmp

Download

memory/4912-121-0x00000000075C0000-0x0000000007836000-memory.dmp

Download