vidar | ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe
Size

1.1MB
MD5

774c8215da3cb73644d36ca3f60e676b
SHA1

375f9c6d12374f17cd8f483c565015171b988e49
SHA256

ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d
SHA512

ceff4e53bdd23ce784be45b6ffa5598f01edaf16a800ba5fe1367b2fcc29de943d5cab9d40123ac9fc61677749b9c8b2efecb3624f05d285097bd6dc0e901207
SSDEEP

24576:s9y5ZBrOwXMFjy47F710L+O0WK2h4xsPxdUn6d9dZiffX6j76oy4cXW:skjrOaM97F71tbWK2h1Px06fdqCja4mW

Score

10^/10

vidar 57a8c39f1ac1987167a282329835ec7a credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

57a8c39f1ac1987167a282329835ec7a

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/3052-34-0x0000000003690000-0x0000000003906000-memory.dmp	family_vidar_v7
behavioral1/memory/3052-35-0x0000000003690000-0x0000000003906000-memory.dmp	family_vidar_v7
behavioral1/memory/3052-36-0x0000000003690000-0x0000000003906000-memory.dmp	family_vidar_v7
behavioral1/memory/3052-87-0x0000000003690000-0x0000000003906000-memory.dmp	family_vidar_v7
behavioral1/memory/3052-88-0x0000000003690000-0x0000000003906000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar
Executes dropped EXE 1 IoCs

Processes:

Batch.pif

pid process

3052 Batch.pif
Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

2008 cmd.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates processes with tasklist 1 TTPs 2 IoCs
discovery

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2820 tasklist.exe
3028 tasklist.exe

pid	process
3052	Batch.pif

pid	process
2008	cmd.exe

pid	process
2820	tasklist.exe
3028	tasklist.exe

Drops file in Windows directory 5 IoCs

Processes:

ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe

description	ioc	process
File opened for modification	C:\Windows\CautionKnife	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe
File opened for modification	C:\Windows\PrefersTracks	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe
File opened for modification	C:\Windows\ConsideringAttached	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe
File opened for modification	C:\Windows\HoneyAmounts	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe
File opened for modification	C:\Windows\DevelopedSimulation	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exefindstr.exetasklist.exefindstr.exetasklist.exefindstr.execmd.exeBatch.pifchoice.exead123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.execmd.execmd.exetimeout.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Batch.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Batch.pif

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Batch.pif
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Batch.pif

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1776 timeout.exe

pid	process
1776	timeout.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

Batch.pif

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Batch.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Batch.pif
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Batch.pif

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Batch.pif

pid process

3052 Batch.pif
3052 Batch.pif
3052 Batch.pif
3052 Batch.pif
3052 Batch.pif
3052 Batch.pif
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

tasklist.exetasklist.exe

description pid process

Token: SeDebugPrivilege 2820 tasklist.exe
Token: SeDebugPrivilege 3028 tasklist.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

Batch.pif

pid process

3052 Batch.pif
3052 Batch.pif
3052 Batch.pif
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

Batch.pif

pid process

3052 Batch.pif
3052 Batch.pif
3052 Batch.pif

pid	process
3052	Batch.pif
3052	Batch.pif
3052	Batch.pif
3052	Batch.pif
3052	Batch.pif
3052	Batch.pif

description	pid	process
Token: SeDebugPrivilege	2820	tasklist.exe
Token: SeDebugPrivilege	3028	tasklist.exe

pid	process
3052	Batch.pif
3052	Batch.pif
3052	Batch.pif

pid	process
3052	Batch.pif
3052	Batch.pif
3052	Batch.pif

Suspicious use of WriteProcessMemory 48 IoCs

Processes:

ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.execmd.exeBatch.pifcmd.exe

description	pid	process	target process
PID 2204 wrote to memory of 2008	2204	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe	cmd.exe
PID 2204 wrote to memory of 2008	2204	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe	cmd.exe
PID 2204 wrote to memory of 2008	2204	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe	cmd.exe
PID 2204 wrote to memory of 2008	2204	ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe	cmd.exe
PID 2008 wrote to memory of 2820	2008	cmd.exe	tasklist.exe
PID 2008 wrote to memory of 2820	2008	cmd.exe	tasklist.exe
PID 2008 wrote to memory of 2820	2008	cmd.exe	tasklist.exe
PID 2008 wrote to memory of 2820	2008	cmd.exe	tasklist.exe
PID 2008 wrote to memory of 2936	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 2936	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 2936	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 2936	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 3028	2008	cmd.exe	tasklist.exe
PID 2008 wrote to memory of 3028	2008	cmd.exe	tasklist.exe
PID 2008 wrote to memory of 3028	2008	cmd.exe	tasklist.exe
PID 2008 wrote to memory of 3028	2008	cmd.exe	tasklist.exe
PID 2008 wrote to memory of 2428	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 2428	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 2428	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 2428	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 2416	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 2416	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 2416	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 2416	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 1732	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 1732	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 1732	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 1732	2008	cmd.exe	findstr.exe
PID 2008 wrote to memory of 2888	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 2888	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 2888	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 2888	2008	cmd.exe	cmd.exe
PID 2008 wrote to memory of 3052	2008	cmd.exe	Batch.pif
PID 2008 wrote to memory of 3052	2008	cmd.exe	Batch.pif
PID 2008 wrote to memory of 3052	2008	cmd.exe	Batch.pif
PID 2008 wrote to memory of 3052	2008	cmd.exe	Batch.pif
PID 2008 wrote to memory of 2640	2008	cmd.exe	choice.exe
PID 2008 wrote to memory of 2640	2008	cmd.exe	choice.exe
PID 2008 wrote to memory of 2640	2008	cmd.exe	choice.exe
PID 2008 wrote to memory of 2640	2008	cmd.exe	choice.exe
PID 3052 wrote to memory of 1576	3052	Batch.pif	cmd.exe
PID 3052 wrote to memory of 1576	3052	Batch.pif	cmd.exe
PID 3052 wrote to memory of 1576	3052	Batch.pif	cmd.exe
PID 3052 wrote to memory of 1576	3052	Batch.pif	cmd.exe
PID 1576 wrote to memory of 1776	1576	cmd.exe	timeout.exe
PID 1576 wrote to memory of 1776	1576	cmd.exe	timeout.exe
PID 1576 wrote to memory of 1776	1576	cmd.exe	timeout.exe
PID 1576 wrote to memory of 1776	1576	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe
"C:\Users\Admin\AppData\Local\Temp\ad123b1589cb2c726de8da9af56ec2dacc22518cda285dc3c014c65c4d405a1d.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move Tits Tits.bat & Tits.bat
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 400445
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2416
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "navyfurthermoreacceptableinvestigator" Profession
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Atmospheric + ..\Commons + ..\Represent + ..\Humans + ..\Href + ..\Router + ..\Connection + ..\Sol O
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2888
- - C:\Users\Admin\AppData\Local\Temp\400445\Batch.pif
    Batch.pif O
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\400445\Batch.pif" & rd /s /q "C:\ProgramData\BGIJEGCGDGHD" & exit
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1576
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1776
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\400445\O

Filesize
549KB

MD5
06217e9f55ff1dc889a0aa9aa2999b3c

SHA1
fad711a89fe670deca51f31fab7249d3f4232b3d

SHA256
bd7d098fba2a343099199ba99efd5191d62c341ad8883c7d4049e529f2355ffe

SHA512
fff6a95db81a48e6df4493c0aa8b373a97b592388b39c1ec5fd598892a43c4cc3d985d0e1405ac4ab7afc1919169fbff923a1b5bccb42083234a7c972c94317d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Antonio

Filesize
865KB

MD5
f893c06408989444917becc2c67e9720

SHA1
734160892a99b544f052fd92382010b80d054020

SHA256
02631bb82ed0d34347ba2980f9d5eb2ba2cd26e942c3f922b9215dd19ddf267e

SHA512
f49127c364acc89e5af14a901acba96ae2d39adb259ac20aebc20d3d9d55441d0c3c4199d886ea11ada02d4f27a3dd36f8d884e627c00d6cfb55fe18cd35fcf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Atmospheric

Filesize
64KB

MD5
155702daaed607a3b9ae37027494655e

SHA1
b641842104fe4d99fcb4daae6435c5c3a9836d4a

SHA256
45173dcbe34d1963927f6f5f1a30be883807b9cfa55c27857115a43fa14c9e15

SHA512
69c436f8f7918422a7d61260dd242a9b737340f0b6c69e23a04e28b310d8b9f6c2b5534761d57a840e6b68765196ac81172cc43f37d30c6c4d4ec2cafbb02f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD367.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Commons

Filesize
72KB

MD5
01d316f7f74b486c817c69726cefc328

SHA1
26c56b95c7aa7dc4fce2ddaadd9ec344bcc9f2e2

SHA256
dc10cd792e2859702c384da65c0c1bdaac764563c7311fb3c58495ed96791534

SHA512
373f403b537e833fe052640cbf75d4c819352027029dcc552fa3dc1d2fddd0fa36ac9084bfc912186b78951c3390414d123eb50b01c4be64101b5b4d2e96c720

Download Submit
C:\Users\Admin\AppData\Local\Temp\Connection

Filesize
51KB

MD5
b6b68a11d199c97c897a262d3314a9ed

SHA1
07b63697ebdfdcd1910390b43477562dbc150355

SHA256
4a1c8403f1325713242c06529510ea73e88590760d20d836d7ba987586e99613

SHA512
70b79ce0e9ef278974576136bebf706646f6d7412b5c1eeb6ab9131ecd7b33621f2382009dc59758ea257f865b425e83c10e1fe2db52173d48d3923ee3821415

Download Submit
C:\Users\Admin\AppData\Local\Temp\Href

Filesize
97KB

MD5
39904f7826116996701e702069a0ca0d

SHA1
5b0133ca89160ac7f4805f4b054337a985086f69

SHA256
5ba66a80e757c3a7cf2e16e709090fcbe8f8019e70c4266fd957ce4878b8719a

SHA512
c67407d641b9cda3ee41778ddae04566853c1e9d99d89c3e8beb54c27b68bfbe39da7d632acfc5ace72941c7c0b94c57cd08f732c5dcb4a4a845f8da5a94e569

Download Submit
C:\Users\Admin\AppData\Local\Temp\Humans

Filesize
91KB

MD5
82b096504036d6c23531db83a3dbc2bb

SHA1
6747cc73044ada91759edfcc19206038dd5af327

SHA256
53744685d58b788ec091eb57fa850ed1a78c17b80ee1ba21796d6533e4c07cd0

SHA512
f5f1819fddcf159b5e60972741a3e270c9a26b41ee4220739aa381a09264ed4d7f9e5d4fe18df4d066850c241a20baf638f163ef8992bc917b9b86b043ba31f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Profession

Filesize
6KB

MD5
6095cc0e5110bfbf129b695533148cf3

SHA1
4dfd2f248e726dc1357f15b16b80a1ab71f3a46e

SHA256
a354428e5be2519aa3db2abed313d510ae754ddf052c38f405235bdc73c2c630

SHA512
ae6307fa1b327d34a56e80e40412e6557746fc6ec3ee7a7e7040b8be8826016b78e77c77b5041888c92ad1ee0b760b3ccd7d2f6d3bf66c0d577aa936d98170f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Represent

Filesize
66KB

MD5
09cafc2cd2586f5bfab33937d069b114

SHA1
c7303feb233867e8deedec7003347dfe90701f0b

SHA256
5b31062934d1afe4e887b181cc0f2add523465a63f710333824102749ae2a768

SHA512
5ab63bfca3aace35117dd4013b44ff9ec8edf8c9dfa79481ed3f8b2b5790aec3b01b512286a52eff7c8c210de7bf3093274289c10a3be0ef74d51f2e399d80f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Router

Filesize
78KB

MD5
44d0f8f9c4b06736e9063432c40ad468

SHA1
79396180851fba1d3b611603455d61798574891d

SHA256
df754244594bab7d25764ca6df24dc7e19d3d6eb8ab29a575b665c8559f6ef78

SHA512
dfcfa10fb7017638889593cb7c2c7bc9d43564978f4eb05c68d49e1dbba820335b0c115a91b88011a83eee1adee0c9e4cf7900f575dcf696a079941bb7e96eb2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Sol

Filesize
30KB

MD5
caefb3c36d5bd6c6923ea3c264f76de7

SHA1
4554acb578278bbb2c4db326960e49736c968459

SHA256
38206815f4ea33415c17f1c5e6ec111cbcff8f31b4ebf1f16b2caf3e0e9f3ee3

SHA512
97f7f9de8ecbd47c576745fcee926c70b72610c4ae535452c2b22c595de9b9b401d6ed74d5a13a9e4e9fd09291c3512401b9b3e2c638716bb37ef4030e5d4f4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD399.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tits

Filesize
20KB

MD5
1a43009615b399c7da8fc4748bd7149d

SHA1
4a118c8b399b92d7812d715b588f049b37efd6d2

SHA256
afcd2cdc62a903f0cb91c678bc8f9e6a0022a06ae6ce4bb25edf3d6886ff7165

SHA512
01313dcbcd37fc4f7c492ceedaf4c57c58cb2478e4c3d7510435b8ca8e3b3b55d879b216f0a2bd15e8a487d6aecc0cd2f805cba993eaa0f278dfa6cab90599ed

Download Submit
\Users\Admin\AppData\Local\Temp\400445\Batch.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
memory/3052-31-0x0000000003690000-0x0000000003906000-memory.dmp

Filesize
2.5MB

Download
memory/3052-32-0x0000000003690000-0x0000000003906000-memory.dmp

Filesize
2.5MB

Download
memory/3052-33-0x0000000003690000-0x0000000003906000-memory.dmp

Filesize
2.5MB

Download
memory/3052-34-0x0000000003690000-0x0000000003906000-memory.dmp

Filesize
2.5MB

Download
memory/3052-35-0x0000000003690000-0x0000000003906000-memory.dmp

Filesize
2.5MB

Download
memory/3052-36-0x0000000003690000-0x0000000003906000-memory.dmp

Filesize
2.5MB

Download
memory/3052-87-0x0000000003690000-0x0000000003906000-memory.dmp

Filesize
2.5MB

Download
memory/3052-88-0x0000000003690000-0x0000000003906000-memory.dmp

Filesize
2.5MB

Download