vidar | 7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0

Analysis

max time kernel
97s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-11-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe
Size

1.7MB
MD5

6309329d5a036aacee830839f82c5b2a
SHA1

6862500fdd7e9741ac7b54ee2d7060e5e28d7f52
SHA256

7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0
SHA512

0f0b56e70d88418bba971d28c42b16534dd16d706d0b9bb9b372b80860ff579eed8c0a3984654933ac5b6717aa34a2bcf6c1a78f6ea45e0953b3a9fcd85737f2
SSDEEP

49152:OgPGoI4XaGI4pipxxgBEX+hlqeMUxQ0LV2D5Rw9KxKUuKyL:O34XaNoq0E+ieMuQ4VYw9Kxc

Score

10^/10

vidar credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

https://t.me/asg7rd

https://steamcommunity.com/profiles/76561199794498376

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

Detect Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral1/memory/2540-432-0x0000000000770000-0x0000000000A70000-memory.dmp	family_vidar_v7
behavioral1/memory/2540-434-0x0000000000770000-0x0000000000A70000-memory.dmp	family_vidar_v7
behavioral1/memory/2540-575-0x0000000000770000-0x0000000000A70000-memory.dmp	family_vidar_v7
behavioral1/memory/2540-594-0x0000000000770000-0x0000000000A70000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2524	chrome.exe
2384	chrome.exe
2020	chrome.exe
2500	chrome.exe

Executes dropped EXE 2 IoCs

pid	Process
3028	But.pif
2540	But.pif

Loads dropped DLL 7 IoCs

pid	Process
2256	cmd.exe
3028	But.pif
2540	But.pif
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe
1972	WerFault.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3016	tasklist.exe
1476	tasklist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 2540	3028	But.pif	44

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SavannahNovember	7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe
File opened for modification	C:\Windows\WoodsSalad	7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe
File opened for modification	C:\Windows\VariousProduces	7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe
File opened for modification	C:\Windows\SeminarsRepeated	7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1972	2540	WerFault.exe	44

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	But.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	But.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	But.pif
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	But.pif

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	But.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	But.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	But.pif

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
3028	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2540	But.pif
2020	chrome.exe
2020	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	tasklist.exe
Token: SeDebugPrivilege	1476	tasklist.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe
Token: SeShutdownPrivilege	2020	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
3028	But.pif
3028	But.pif
3028	But.pif
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe
2020	chrome.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3028	But.pif
3028	But.pif
3028	But.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 2256	796	7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe	28
PID 796 wrote to memory of 2256	796	7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe	28
PID 796 wrote to memory of 2256	796	7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe	28
PID 796 wrote to memory of 2256	796	7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe	28
PID 2256 wrote to memory of 3016	2256	cmd.exe	30
PID 2256 wrote to memory of 3016	2256	cmd.exe	30
PID 2256 wrote to memory of 3016	2256	cmd.exe	30
PID 2256 wrote to memory of 3016	2256	cmd.exe	30
PID 2256 wrote to memory of 896	2256	cmd.exe	31
PID 2256 wrote to memory of 896	2256	cmd.exe	31
PID 2256 wrote to memory of 896	2256	cmd.exe	31
PID 2256 wrote to memory of 896	2256	cmd.exe	31
PID 2256 wrote to memory of 1476	2256	cmd.exe	33
PID 2256 wrote to memory of 1476	2256	cmd.exe	33
PID 2256 wrote to memory of 1476	2256	cmd.exe	33
PID 2256 wrote to memory of 1476	2256	cmd.exe	33
PID 2256 wrote to memory of 1928	2256	cmd.exe	34
PID 2256 wrote to memory of 1928	2256	cmd.exe	34
PID 2256 wrote to memory of 1928	2256	cmd.exe	34
PID 2256 wrote to memory of 1928	2256	cmd.exe	34
PID 2256 wrote to memory of 2892	2256	cmd.exe	35
PID 2256 wrote to memory of 2892	2256	cmd.exe	35
PID 2256 wrote to memory of 2892	2256	cmd.exe	35
PID 2256 wrote to memory of 2892	2256	cmd.exe	35
PID 2256 wrote to memory of 2260	2256	cmd.exe	36
PID 2256 wrote to memory of 2260	2256	cmd.exe	36
PID 2256 wrote to memory of 2260	2256	cmd.exe	36
PID 2256 wrote to memory of 2260	2256	cmd.exe	36
PID 2256 wrote to memory of 1300	2256	cmd.exe	37
PID 2256 wrote to memory of 1300	2256	cmd.exe	37
PID 2256 wrote to memory of 1300	2256	cmd.exe	37
PID 2256 wrote to memory of 1300	2256	cmd.exe	37
PID 2256 wrote to memory of 3028	2256	cmd.exe	38
PID 2256 wrote to memory of 3028	2256	cmd.exe	38
PID 2256 wrote to memory of 3028	2256	cmd.exe	38
PID 2256 wrote to memory of 3028	2256	cmd.exe	38
PID 2256 wrote to memory of 2724	2256	cmd.exe	39
PID 2256 wrote to memory of 2724	2256	cmd.exe	39
PID 2256 wrote to memory of 2724	2256	cmd.exe	39
PID 2256 wrote to memory of 2724	2256	cmd.exe	39
PID 3028 wrote to memory of 2708	3028	But.pif	40
PID 3028 wrote to memory of 2708	3028	But.pif	40
PID 3028 wrote to memory of 2708	3028	But.pif	40
PID 3028 wrote to memory of 2708	3028	But.pif	40
PID 3028 wrote to memory of 2540	3028	But.pif	44
PID 3028 wrote to memory of 2540	3028	But.pif	44
PID 3028 wrote to memory of 2540	3028	But.pif	44
PID 3028 wrote to memory of 2540	3028	But.pif	44
PID 3028 wrote to memory of 2540	3028	But.pif	44
PID 3028 wrote to memory of 2540	3028	But.pif	44
PID 2540 wrote to memory of 2020	2540	But.pif	46
PID 2540 wrote to memory of 2020	2540	But.pif	46
PID 2540 wrote to memory of 2020	2540	But.pif	46
PID 2540 wrote to memory of 2020	2540	But.pif	46
PID 2020 wrote to memory of 1224	2020	chrome.exe	47
PID 2020 wrote to memory of 1224	2020	chrome.exe	47
PID 2020 wrote to memory of 1224	2020	chrome.exe	47
PID 2020 wrote to memory of 2916	2020	chrome.exe	48
PID 2020 wrote to memory of 2916	2020	chrome.exe	48
PID 2020 wrote to memory of 2916	2020	chrome.exe	48
PID 2020 wrote to memory of 2188	2020	chrome.exe	49
PID 2020 wrote to memory of 2188	2020	chrome.exe	49
PID 2020 wrote to memory of 2188	2020	chrome.exe	49
PID 2020 wrote to memory of 2188	2020	chrome.exe	49

C:\Users\Admin\AppData\Local\Temp\7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe
"C:\Users\Admin\AppData\Local\Temp\7305c4bb03ec5c017a4297e7e47d7749e56ca5bb56d3d5399a37cd0ae6b3bfd0.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Za Za.bat & Za.bat
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:896
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
- - C:\Windows\SysWOW64\findstr.exe
    findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 385902
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2892
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "VECOVERAGEGATESOCCURRING" Scottish
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Dirt + ..\Contacts + ..\Syria + ..\Gross + ..\Ministry + ..\Infected + ..\Trout + ..\Reforms + ..\Highlighted + ..\Mas + ..\Rotary + ..\Preston + ..\Remove + ..\Clock + ..\Liquid + ..\Isa + ..\Cape d
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\385902\But.pif
    But.pif d
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3028
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks.exe /create /tn "TradeSwan" /tr "wscript //B 'C:\Users\Admin\AppData\Local\TradeOptimize Solutions\TradeSwan.js'" /sc onlogon /F /RL HIGHEST
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\385902\But.pif
      C:\Users\Admin\AppData\Local\Temp\385902\But.pif
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2020
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6859758,0x7fef6859768,0x7fef6859778
        6⤵
        
        PID:1224
      - C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        6⤵
        
        PID:2916
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:2
        6⤵
        
        PID:2188
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1424 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:8
        6⤵
        
        PID:2712
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:8
        6⤵
        
        PID:1680
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2500
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2524
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1672 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:2
        6⤵
        
        PID:2796
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1612 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2384
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3468 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:8
        6⤵
        
        PID:2984
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3488 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:8
        6⤵
        
        PID:1292
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3488 --field-trial-handle=1500,i,16938219545064494099,10485405356819409687,131072 /prefetch:8
        6⤵
        
        PID:772
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 628
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1972
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 15
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2724

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
0fa9d1b74f34dd0cd16eebdcb7599039

SHA1
dc32db37c05090a579eab267363a19b03f275f21

SHA256
9e6099fdc3f89522f5d8105ff45c631f36a4c0d477c5f58b9534c523e92cecd5

SHA512
c029e58b659ed41b1c08897654b765b5310063f92cc68cffcb4892ad7580941c8234ae0311d75ef0457132803bef04144b6218893b38fb2de4ecd7c9fb8df509

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
20ec905e22f1e9a045b74c095a016151

SHA1
c963080a8b953f60c669e83abaec097d477b9122

SHA256
50b2a0ede1bfbe40572f4f2ed3fd41b30d834cfd38d64543234641bbc1bb7804

SHA512
45c1f4e7154832c965d623859d32a9449db036aabdf10939ce77de5e2daeff4dae3ff71e49b5be6b758ed336982f937e8c64339247a7775bccb2bf71dfd3be25

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\385902\d

Filesize
1.2MB

MD5
6ce26bc637e613fb26e36e3b7b2de741

SHA1
fc871ed51cea45e036f2f5da2560028aac6a8d52

SHA256
b9f9f94aae237bbc79016a5c6f16699e5bd3e2c4badbdc38e1cfb381c0ee0f19

SHA512
07fd8349c544c26033baa348ebd5808bff902c296a2d096af318321bb51e5a85a4cc9c590387a35e8eb5a159dd30c32036d4a9f725b66be53e6d49e28250e31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC99.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cape

Filesize
13KB

MD5
af965d3d1dace1fb30ca33675fff2b9c

SHA1
1d64d15e449fd45159c37b44c5066106280e98dc

SHA256
3ee9287e6608befe365048f434056557411daf82b5d94124b5ecd2f12893a0dc

SHA512
158ff9175f7052062ad53e620e6cdb585d4f6f696c330a50050a4a89c8e74c2bae49abed1a6b49fdb97938062e5554178d90309c621d56ff224d0ca4871086de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Clock

Filesize
79KB

MD5
6b8d55cf0157a09b1304a79882cfabf4

SHA1
359e84b9a9f23827f2113be4e798a89109a1c4ab

SHA256
ccc80113d1d33bd46957e01253217e5e233fa0158107e4a1576d5137c9351450

SHA512
8d92bed7361a6cf6986bf505054b818b6f653c6eb493a66bb17e5aef26e5868e31a1948ede87b9f1976360f3bb86767c26ec4333bba41b599c0c1dbc002b68e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Contacts

Filesize
97KB

MD5
06d5ec821bc37509d3888623e943bcbf

SHA1
e4ab272ef4feef067be2ab6672cca7b06d97e383

SHA256
f85ddce46c17d6da8061f7e84bd681d804c299fcdb51470ee17132b35eadd1a9

SHA512
1b250c226e6a54484632cd4894e3ed8deb0873db5f3a5c0ec5d5c006e266c8fb668cb83145df7c9d124b78ed21bea0086a7b7437f83f5ba3e87cfc5fa2c03e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dirt

Filesize
78KB

MD5
cde4c46ff3b0d6b46cdac32438fb47de

SHA1
170ea674921b4c3b713df5f6a61d86af9332b028

SHA256
48e24d58ec13a7c191c32588b7a1d3d36bbe93f009d0508b110071d1b83e20e7

SHA512
c1ca7075cdf1c472080d10e40ecb5cc437630b4f88e44a892be6ec6301e68237c4a2a94bf232afbde56b904af212257e45a3231577fea15b9c1d843fb66a57da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gross

Filesize
72KB

MD5
a0703a99dd4463e54652235fa8925efe

SHA1
6e4bf1852e8c9c08a33873da1fbcb405e63ea7fa

SHA256
edf34aba0958a5139d73f4c96bb45a7eae4e265483118d7e8636677facbd9431

SHA512
2015644ba3bdc8a7fa2e19a970bad8778de9a37699327a10807abdb251b8f07e71db8d03a2bf0df6cf641b6ff66df2b9899f725c1e88d688090dbdc23ae96a8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Highlighted

Filesize
75KB

MD5
76877395939bbfdfc0bc89b5cd81dc98

SHA1
856453e7c5aa1f00badb3179d4179683d151ac34

SHA256
09388133db1b51106b865257278e9ac5aae1a03471655d66dd08d84e4b7bdb34

SHA512
01b1c5bc5ce697e9b08e20af194cd3631e80b15467aa699d9afab119dc134cfc35fdb76ddff0d564f7f48c2f0c35820fde7c37bfb51778b614ad49e81eb1a4c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Infected

Filesize
60KB

MD5
62dae5d3236399e12a9b6aa7b6234e17

SHA1
bfcff7698ee522692844d1fe8d2eae1956b72177

SHA256
7bd5d3c8d61f2ffa76a0b577e26c1ceae0e3b06e862610687306255d415a0cd0

SHA512
6dff2292821e0b7326af592c64335c2bd8619339c8ad61a78c9405550adaf63538a835b45f2a8deb9df6c5235a8c8e266df55d8dfc1442a8f2282ab6973166e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Isa

Filesize
89KB

MD5
b40befe54498a6d595b364b7b525f30f

SHA1
f8881f753450e7265fcde49d405c07198c94beba

SHA256
f25f42d199259454fad606804668bdd177a5bc0d03cf56d3c2cb68e393a439d5

SHA512
716cb614a1cc28de222917d1cbcb4f73def6b523f2b9c871c7c09fd6bfbe511390a11c568133633739fea4f1795bc6b83a1baa51186d6a9654b6fb70ddf2dcbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Liquid

Filesize
70KB

MD5
bbf271eaa9d8aeaefa40cac9e19a7838

SHA1
49cbfe8c945a849c39779a60c7866b0dea329bae

SHA256
4d43fbfee58142287d8e3c0ec3005b50dd110248a7e0ec1b891dce2501b8ca5c

SHA512
e6a3c6d1facd1b90669ba52f90ed46ddd921ef0b1dd99948220eeeed5d60a84e7a126e9a01144fb95e18dc6fbe4abcade35a58fb7dca3c52e83010a1e6208a44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mas

Filesize
92KB

MD5
fa0509a52879aa4a62f19d057a88bac3

SHA1
109c5e34cdca7a5664f433ff8f1c44bda24a164b

SHA256
a0dd14e2a3b74fd5ca903446dd99bac3d7918748eeff693658d4790f00097532

SHA512
321a2b7380544ef5faf1912b4eede29f76cfa6ccd2be7aa7c6ae5efbf0a5a3503ec7da541de3e83e6db0c70a5ca38f8cd97735a1faf475917a598fc5eac36254

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ministry

Filesize
84KB

MD5
7be94726608f8c106665afa8cfdc89bb

SHA1
59e8662e8d5f0c6880a8935ae0cb81a089980eb0

SHA256
803b70d8ab4f2e9c764b9e43c26039da2b0f985f6728971fcc623289f02187aa

SHA512
21babae17d2db7aebca44d11876d53efac58652ff6b73076eef6f4b9ff9b685bc0a8541155132b399fd166a376ac4b56eed72b7a4a2f61ff6e1a808e2939feb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Preston

Filesize
59KB

MD5
3f86bb99af0bb655504dce21757c744b

SHA1
7a6279dbc69d3cb87717fbc34900cad4acdb27f3

SHA256
d97cdda1db2bbd8ffcd46144b245aa410232e7d1d075b2c576eb49206c0e18fd

SHA512
e46d4c23061f0bffacf30dffce5a7d5e893e79e699dd6de40a5493c2744ea2efda586900587fc955d699db16e96009c4f30c46f23130c92eeb04274ade71672a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Reforms

Filesize
70KB

MD5
b8d9068ad91d42e750a76d26003f9fa4

SHA1
c75eb994cf1c607de148db30cab2bae30e00898a

SHA256
d3cb08d75bcadec46233d8097f1580ac1ff763ecefbcd74172801c574ff4a93f

SHA512
ce911583ad373a45d5dae61b95a9a3742a831d245c9f8b005cc86aea92445b63b72643e1384424277f5961e0c49bc9be0171a0ef998b518a65f2cba984ebecaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Remove

Filesize
66KB

MD5
a529d544a10836bedf47c06c4d52b25b

SHA1
dd03707284f9fc7d8980d65a8ba19318df9544ee

SHA256
a3974c65e3dfea5864655fb0ed24bccfaec7539a20d7ffac41c1201a351223cf

SHA512
1fd747ff5096bc26f8e740e2f730059fc11aa1d2e7db2654fe19115e5457cf7b8da1ac0233461a4fac1d0aaad6f2c81c10160dda39fece6b09a8c241e4152dbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rotary

Filesize
95KB

MD5
6051b9eecd39a03bb32bc2bba5082095

SHA1
b2a63fd5e96493699fe067cbfa099622d8acea32

SHA256
4f12f27328c4c0a600c6850d17aa237e75f23b66a74cd1ec7e5f9cfdc299ca30

SHA512
6223aa52de9df2f999eee13dc61be08954cbacbd5ffa83831d4a11a0ed35bf36dce05c0f5b3eeb5a7a0759cebe313be9c3d8486d22e3d063eaec9a76adead8b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Scottish

Filesize
11KB

MD5
91f6672574a6fd8cbbad8d6cd414d156

SHA1
643c062c6b131258149503ed4219de12d92e3a68

SHA256
044aea42dbeeba30d10e5cf9bb40ea12840de423a13d162bdd366cd12c9c2213

SHA512
f62112c697dd33eaa3c5590f728900303eaf7c34c29e36be6a56b82161bb2fb059f37539ce3fd2b1e93c326db003d51396aadc69b8870a02e286c6912cf8fee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sequences

Filesize
861KB

MD5
2dd483c6fde0586ffa94acc2376dd7d9

SHA1
c9ef9e4d9a0185ebed8ff26a1dfbf83c954ec09b

SHA256
40c07fbaec3090d544f2d764897ae01cd7e8e8e97ac95f769c9d09bc3c660195

SHA512
314d03f8c2e3b9b67349d82362620fe72e6c9356393ff5b72d343c781a14b4b1e5ff4a9f78782753d04028b208be5f8812e60dd830f323435b013f50b30aa33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Syria

Filesize
58KB

MD5
a0e351dd432603992449c20dc0c6ea0b

SHA1
dd6a250e1400f0ed460f5989968b38fdfad642bc

SHA256
ac7ae2f73b1035ea98f04caadafc74e8919f124e417a14966af4a41fbef0229d

SHA512
d07c1e176b23fcf307df0181d1b24ea0e202206d59d87cfe0d30214de4571d88bf6edee33fab8540a12afb0527098c25ecf5a0a224d4a71d487737a48318f86f

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFCEA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trout

Filesize
88KB

MD5
1a6f03d3e9d3165a38d8b59cf0b2d4bc

SHA1
bab5dc699a736cbba1c64f2ecfc84f3a194ff51c

SHA256
755ffe7b3854437f7d1a85aa929a353bd0cb8f84d9e2899cd9ad29d7733e6496

SHA512
dd98537e73522e9d55112368de9b363622a0804d5159deeb1760b2803221f5cca9957a734db315afa0c3b907887765c3cc4c98991b65be5253c5e2bdd6081cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Za

Filesize
16KB

MD5
29a0ea7fbce305cb957d7f88a2eb1d6b

SHA1
eed117e955aad6ac880bab3c530634da6bb6315f

SHA256
229d200f4b5bf50af37b19d601448152886be2e6110a7f7de7d5b91e4ed54d26

SHA512
4a63a11cc013295a5c8677c66e6386412ff58ce53a77a92f7ba7d1004960d5b1c27922fa006c3e48d06ebb76bc491753dbe7ca23ce88c0f424110655977b0d44

Download Submit
\ProgramData\chrome.dll

Filesize
676KB

MD5
eda18948a989176f4eebb175ce806255

SHA1
ff22a3d5f5fb705137f233c36622c79eab995897

SHA256
81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

SHA512
160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

Download Submit
\Users\Admin\AppData\Local\Temp\385902\But.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
memory/2540-434-0x0000000000770000-0x0000000000A70000-memory.dmp

Filesize
3.0MB

Download
memory/2540-575-0x0000000000770000-0x0000000000A70000-memory.dmp

Filesize
3.0MB

Download
memory/2540-594-0x0000000000770000-0x0000000000A70000-memory.dmp

Filesize
3.0MB

Download
memory/2540-613-0x0000000015700000-0x000000001595F000-memory.dmp

Filesize
2.4MB

Download
memory/2540-432-0x0000000000770000-0x0000000000A70000-memory.dmp

Filesize
3.0MB

Download
memory/2540-431-0x0000000000770000-0x0000000000A70000-memory.dmp

Filesize
3.0MB

Download