vidar | 8b34e6283a4e30009a0ad792723817cfb0d5cdbbbe119948aa6e887bd59e1620

max time kernel
748s
max time network
746s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-01-2025 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66bddfcb52736_vidar.exe
Size

190KB
MD5

fedb687ed23f77925b35623027f799bb
SHA1

7f27d0290ecc2c81bf2b2d0fa1026f54fd687c81
SHA256

325396d5ffca8546730b9a56c2d0ed99238d48b5e1c3c49e7d027505ea13b8d1
SHA512

6d1fa39560f4d7ca57905bc57d615acf96b1ef69ca2a4d7c0353278e8d4466298ed87f514463c49d671cb0e3b6a269a78636a10a1e463dba5c83fe067dc5df18
SSDEEP

3072:XqsEJybpRHuJKKBardRei4UGvI96/ZO6RAkeOCeP9sZy28se:XqsMyNRHuKikUi42KZO6PffmZy2d

Score

10^/10

vidar 877956da9963e0825aa43a159a358f24 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

10.7

Botnet

877956da9963e0825aa43a159a358f24

https://steamcommunity.com/profiles/76561199751190313

https://t.me/pech0nk

Attributes

user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 6 IoCs

stealer

resource	yara_rule
behavioral2/memory/1524-4-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/1524-9-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/1524-7-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/1524-298-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/1524-299-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/files/0x0007000000023f54-1970.dat	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 1 IoCs

pid	Process
6208	400000.RegAsm.exe

Loads dropped DLL 1 IoCs

pid	Process
6168	x32dbg.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
190	camo.githubusercontent.com
264	camo.githubusercontent.com
165	camo.githubusercontent.com
166	camo.githubusercontent.com
188	camo.githubusercontent.com
192	camo.githubusercontent.com
193	camo.githubusercontent.com
265	camo.githubusercontent.com
164	camo.githubusercontent.com
189	camo.githubusercontent.com
191	camo.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\devmgmt.msc	mmc.exe

Suspicious use of SetThreadContext 22 IoCs

description	pid	Process	procid_target
PID 2968 set thread context of 1524	2968	66bddfcb52736_vidar.exe	84
PID 5752 set thread context of 3136	5752	66bddfcb52736_vidar.exe	153
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154
PID 6168 set thread context of 6208	6168	x32dbg.exe	154

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_display.PNF	mmc.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\rdcameradriver.PNF	mmc.exe
File created	C:\Windows\INF\xusb22.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	mmc.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	mmc.exe
File created	C:\Windows\INF\c_fsreplication.PNF	mmc.exe
File created	C:\Windows\INF\c_smrdisk.PNF	mmc.exe
File created	C:\Windows\INF\oposdrv.PNF	mmc.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	mmc.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	mmc.exe
File created	C:\Windows\INF\miradisp.PNF	mmc.exe
File created	C:\Windows\INF\c_holographic.PNF	mmc.exe
File created	C:\Windows\INF\c_fshsm.PNF	mmc.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	mmc.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	mmc.exe
File created	C:\Windows\INF\ts_generic.PNF	mmc.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	mmc.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	mmc.exe
File created	C:\Windows\INF\c_extension.PNF	mmc.exe
File created	C:\Windows\INF\dc1-controller.PNF	mmc.exe
File created	C:\Windows\INF\c_smrvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	mmc.exe
File created	C:\Windows\INF\c_fsencryption.PNF	mmc.exe
File created	C:\Windows\INF\c_firmware.PNF	mmc.exe
File created	C:\Windows\INF\c_monitor.PNF	mmc.exe
File created	C:\Windows\INF\c_processor.PNF	mmc.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	mmc.exe
File created	C:\Windows\INF\c_fscompression.PNF	mmc.exe
File created	C:\Windows\INF\c_scmdisk.PNF	mmc.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	mmc.exe
File created	C:\Windows\INF\c_volume.PNF	mmc.exe
File created	C:\Windows\INF\c_ucm.PNF	mmc.exe
File created	C:\Windows\INF\c_proximity.PNF	mmc.exe
File created	C:\Windows\INF\c_netdriver.PNF	mmc.exe
File created	C:\Windows\INF\c_camera.PNF	mmc.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	mmc.exe
File created	C:\Windows\INF\c_fsundelete.PNF	mmc.exe
File created	C:\Windows\INF\remoteposdrv.PNF	mmc.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	mmc.exe
File created	C:\Windows\INF\c_sslaccel.PNF	mmc.exe
File created	C:\Windows\INF\rawsilo.PNF	mmc.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	mmc.exe
File created	C:\Windows\INF\c_diskdrive.PNF	mmc.exe
File created	C:\Windows\INF\c_media.PNF	mmc.exe
File created	C:\Windows\INF\c_scmvolume.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystem.PNF	mmc.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	mmc.exe
File created	C:\Windows\INF\c_mcx.PNF	mmc.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	mmc.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	mmc.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	mmc.exe
File created	C:\Windows\INF\c_apo.PNF	mmc.exe
File created	C:\Windows\INF\wsdprint.PNF	mmc.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	mmc.exe
File created	C:\Windows\INF\c_linedisplay.PNF	mmc.exe
File created	C:\Windows\INF\c_swcomponent.PNF	mmc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x96dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mal_unpack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66bddfcb52736_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mal_unpack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66bddfcb52736_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	400000.RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x32dbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mal_unpack.exe

Checks SCSI registry key(s) 3 TTPs 20 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	mmc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	mmc.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
220	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 5c022479d218db01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 27 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1949659513"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31157300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{9FD7D23E-D827-11EF-9361-7ECF469E42CC} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{18C02742-21D1-4B48-8CE5-BCA229E8D426}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "444249992"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	x32dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x32dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	x32dbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\MRUListEx = ffffffff	x32dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	x32dbg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Generic"	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0 = 6800310000000000355ac59510005343414e5f317e310000500009000400efbe355ac595355ac5952e000000513f02000000070000000000000000000000000000006eb33c007300630061006e005f003100370033003700340038003500310036003700000018000000	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 010000000200000000000000ffffffff	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\1	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\1\0	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	x32dbg.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	x32dbg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	x32dbg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	x32dbg.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\mal_unpack32.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\snapshot_2025-01-17_12-45.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
6168	x32dbg.exe
4076	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1524	RegAsm.exe
1524	RegAsm.exe
1524	RegAsm.exe
1524	RegAsm.exe
1524	RegAsm.exe
1524	RegAsm.exe
7048	powershell.exe
7048	powershell.exe
7048	powershell.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
6804	mal_unpack.exe
1760	mal_unpack.exe
1760	mal_unpack.exe
3136	RegAsm.exe
3136	RegAsm.exe
1760	mal_unpack.exe
1760	mal_unpack.exe
1760	mal_unpack.exe
1760	mal_unpack.exe
1760	mal_unpack.exe
1760	mal_unpack.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6168	x32dbg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	6168	x32dbg.exe
Token: SeManageVolumePrivilege	6644	svchost.exe
Token: SeDebugPrivilege	7048	powershell.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	6804	mal_unpack.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	1760	mal_unpack.exe
Token: SeDebugPrivilege	1760	mal_unpack.exe
Token: SeDebugPrivilege	1760	mal_unpack.exe
Token: SeDebugPrivilege	6168	x32dbg.exe
Token: 33	6848	mmc.exe
Token: SeIncBasePriorityPrivilege	6848	mmc.exe
Token: 33	6848	mmc.exe
Token: SeIncBasePriorityPrivilege	6848	mmc.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	2244	firefox.exe
Token: SeDebugPrivilege	2244	firefox.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
7164	iexplore.exe
7164	iexplore.exe
7164	iexplore.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe

Suspicious use of SetWindowsHookEx 50 IoCs

pid	Process
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
2244	firefox.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
6708	OpenWith.exe
7164	iexplore.exe
7164	iexplore.exe
1496	IEXPLORE.EXE
1496	IEXPLORE.EXE
6168	x32dbg.exe
6168	x32dbg.exe
4076	POWERPNT.EXE
4076	POWERPNT.EXE
4076	POWERPNT.EXE
4076	POWERPNT.EXE
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6168	x32dbg.exe
6848	mmc.exe
6848	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 4776	2968	66bddfcb52736_vidar.exe	83
PID 2968 wrote to memory of 4776	2968	66bddfcb52736_vidar.exe	83
PID 2968 wrote to memory of 4776	2968	66bddfcb52736_vidar.exe	83
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 2968 wrote to memory of 1524	2968	66bddfcb52736_vidar.exe	84
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 4500 wrote to memory of 2244	4500	firefox.exe	87
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88
PID 2244 wrote to memory of 3360	2244	firefox.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\66bddfcb52736_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\66bddfcb52736_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & rd /s /q "C:\ProgramData\ECGHCBGCBFHI" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:980
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4500
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1968 -parentBuildID 20240401114208 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {294edfc3-626a-42e1-8ec9-9ec099878777} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" gpu
    3⤵
    PID:3360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2356 -prefMapHandle 2344 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34378f00-039a-44f9-93dc-d717d1db1b14} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" socket
    3⤵
    PID:2660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3152 -childID 1 -isForBrowser -prefsHandle 3220 -prefMapHandle 3248 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a384159f-b0c2-4658-af6d-e84694528eaf} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:1072
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3836 -childID 2 -isForBrowser -prefsHandle 2532 -prefMapHandle 2520 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28021488-692c-466b-9493-6b62a743fcd1} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:4584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3184 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4996 -prefMapHandle 3148 -prefsLen 32569 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a86b506e-6672-44bc-b854-471b1dc7683b} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" utility
    3⤵
    - Checks processor information in registry
    PID:3580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 3 -isForBrowser -prefsHandle 5360 -prefMapHandle 5356 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a9466d6-5dda-4616-91d3-d8510665b1af} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 4 -isForBrowser -prefsHandle 5508 -prefMapHandle 5512 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {415635a6-1b2e-4364-95d2-f2b8082e7df7} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:2420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5780 -childID 5 -isForBrowser -prefsHandle 5700 -prefMapHandle 5704 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cf5eb84-e8a7-4b82-ba4d-1ce2318cb4a6} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:4856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5928 -childID 6 -isForBrowser -prefsHandle 4952 -prefMapHandle 5532 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b13f93e-305d-45ae-83b3-37b858b06b46} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6124 -childID 7 -isForBrowser -prefsHandle 5200 -prefMapHandle 6128 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2320f1d-d454-453c-99f9-fab864ef5650} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6360 -childID 8 -isForBrowser -prefsHandle 3536 -prefMapHandle 5896 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bab30abf-42e9-4d4a-8402-2f2c020d518b} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:1424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4928 -childID 9 -isForBrowser -prefsHandle 4996 -prefMapHandle 5000 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e7a6a55a-1c60-4533-96b4-e69ce43a2cc9} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:6096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4928 -childID 10 -isForBrowser -prefsHandle 5248 -prefMapHandle 6376 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c272071-07c3-4cd7-be7d-7f77fdbd2de8} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:5212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7356 -childID 11 -isForBrowser -prefsHandle 7348 -prefMapHandle 7344 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddbcbdc8-0f4d-4487-9775-ff3e724423f8} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:5380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7420 -childID 12 -isForBrowser -prefsHandle 7504 -prefMapHandle 7500 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {df41875f-7fb2-4ffe-b4fe-eda6a5914756} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:1312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7928 -childID 13 -isForBrowser -prefsHandle 7940 -prefMapHandle 7948 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5349f7e-5412-4c61-8e5d-7a512169acee} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:5236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7980 -childID 14 -isForBrowser -prefsHandle 8064 -prefMapHandle 8060 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3390f76-c7cc-456e-9cb6-e5f2408fe68e} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:5368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8164 -childID 15 -isForBrowser -prefsHandle 8172 -prefMapHandle 8176 -prefsLen 28084 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80a30a23-da05-45ee-aae6-6a3daa929dbf} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:5408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7992 -childID 16 -isForBrowser -prefsHandle 7920 -prefMapHandle 7876 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6937697d-7483-4230-b79d-f62caa5bfd8f} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:1356
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7976 -childID 17 -isForBrowser -prefsHandle 8188 -prefMapHandle 7984 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7931ddbc-3251-4dc8-b498-488cf5c1dd2b} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:6312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8148 -childID 18 -isForBrowser -prefsHandle 8152 -prefMapHandle 7212 -prefsLen 28140 -prefMapSize 244658 -jsInitHandle 1252 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4ea9114-2ba2-406d-a1e5-5a60d4f50efd} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" tab
    3⤵
    PID:6172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6708
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:7164
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:7164 CREDAT:17410 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:1496

C:\Users\Admin\Downloads\snapshot_2025-01-17_12-45\release\x96dbg.exe
"C:\Users\Admin\Downloads\snapshot_2025-01-17_12-45\release\x96dbg.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1836
- C:\Users\Admin\Downloads\snapshot_2025-01-17_12-45\release\x96dbg.exe
  "C:\Users\Admin\Downloads\snapshot_2025-01-17_12-45\release\x96dbg.exe" ::install
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6712

C:\Users\Admin\Downloads\snapshot_2025-01-17_12-45\release\x32\x32dbg.exe
"C:\Users\Admin\Downloads\snapshot_2025-01-17_12-45\release\x32\x32dbg.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6168
- C:\Users\Admin\Downloads\mal_unpack32\66bddfcb52736_vidar.exe.out\scan_1737485167\process_3136\400000.RegAsm.exe
  "C:\Users\Admin\Downloads\mal_unpack32\66bddfcb52736_vidar.exe.out\scan_1737485167\process_3136\400000.RegAsm.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6644

C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4076

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:7048
- C:\Users\Admin\Downloads\mal_unpack32\mal_unpack.exe
  "C:\Users\Admin\Downloads\mal_unpack32\mal_unpack.exe" /exe .\mal_unpack.exe /timeout 1000
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6804
- - C:\Users\Admin\Downloads\mal_unpack32\mal_unpack.exe
    .\mal_unpack.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c pause
      4⤵
      System Location Discovery: System Language Discovery
      PID:1756
- C:\Users\Admin\Downloads\mal_unpack32\mal_unpack.exe
  "C:\Users\Admin\Downloads\mal_unpack32\mal_unpack.exe" /exe .\66bddfcb52736_vidar.exe /timeout 1000
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- - C:\Users\Admin\Downloads\mal_unpack32\66bddfcb52736_vidar.exe
    .\66bddfcb52736_vidar.exe
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:5752
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2344
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:5252
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3136

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:5400

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\66bddfcb52736_vidar.exe.log

Filesize
42B

MD5
84cfdb4b995b1dbf543b26b86c863adc

SHA1
d2f47764908bf30036cf8248b9ff5541e2711fa2

SHA256
d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

SHA512
485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DomainSuggestions\en-US.1

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0BHOTC3C\76561199751190313[1].htm

Filesize
34KB

MD5
3d9b7da51434fb4add9bba9ddf6762de

SHA1
d7d0f1728465bbd4895eb7de69b69b7110c861f3

SHA256
baa65b946f56b6d6614590e9dd3380e70586c2974d9f82aa997e60b449c3bc59

SHA512
751d256e05321a0f0b91979ddd1abb005d25b5639b5d3d7448803753a9795b436b292eb51f6779c1fe7949ea078d3441d6a1e6ee9d7aeb7143375421898a961d

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
f852375cebd592209039da421d5dfdfc

SHA1
ef5b10a1502a2672fef0d8e2aa5c8fa1884ca60b

SHA256
39e87991c8da8e4abd6ee9a532c1c4d2523b647b0d0e9220d245db0c1e70ba8b

SHA512
18f7b18812d131dc17be8cba169027fbbd5c0ac23669c44a05edd8b409377108df265c61613515eac3bad71dd4db9ca00d68a7bd63bdf8108386421e60cff21f

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\16CE97ADEC6C3A299FC5AEAC311B605D872EA9FA

Filesize
351KB

MD5
d7d75fe723d367d6880f267195902d71

SHA1
ede3c18ff7f2ab08a310ed199256de8f51a7c775

SHA256
435da742df0dc2d40b3ad92601922a46a8b0ba3c7e017dc1b90b6475b6e6fa07

SHA512
616ac0878fce76f826faaa71409ba0ccafba4b70cba8b02df1353134cbbe8020820bc29df7356c9a2bcf6ec829710fda3325f7420c2904b5b956e611fbf25735

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\27016077B9EB800681FDB7C292C427FA9025FB85

Filesize
13KB

MD5
ceceba999a926c8c058412af3ee6c52f

SHA1
76b4b25ca137ac4ac6d5c0bc704bad7b0fdba21e

SHA256
94e6204f2fcafec29587851999ce4c8624f53de65d1d44129155f5fc9775afdf

SHA512
a76c081c9428610ee5164d946ad3a8c940d607305dcd4c2b4a69c7882ecb5e012320e99fd95887125f1e3440f4f6c5e8445bc86a4278c703daec428f20c08779

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\461FE640B9229316B8F05053D681B99E48B2F4CB

Filesize
71KB

MD5
911b5ad8b2b6fe73d461618d007a6115

SHA1
f279abc6a81996be3ecfd3ee803ddda8bf6707f4

SHA256
e0cc70551a4f5e85b2a7a56b9664610f2a6ca2163ef08cd6c529ff310759e46f

SHA512
a6778372b589e1eed256d7db811154d8cf6e92c6b82934991af9967a59b38079dbbc09a83553621da7ffc741fcbe7ba84ab0a04752a788653dd8452c134b59d0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\4C18F2016606B43D054C8200B2142B749FA7F8F7

Filesize
23KB

MD5
d8f441527cffcf5644fd7c6e0aa1e57e

SHA1
d7c3a0f6bb2275875bd9c472b3ba56c0e03b1d79

SHA256
f11d7561f1d6b02c15e68142f36d12de1e4190b33988ed42862f520ef8369d00

SHA512
cd2c3d198adcd2a1f3ca29195591b5908b5668a5114eca1c615388062abaec3d174ef53e40f886b9435b77102eb32727d6260065977c8f1dba28f80294090a73

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\52C72DFAB3969C7E4755E72262DE13C4CB2E1FFE

Filesize
423KB

MD5
0370facff234624952caedd9a1637713

SHA1
f02afac1b9b1ddf619dbd80756325d9d27d8cd32

SHA256
e54be5f25ac56c20430c94f29d4066d304d9258991e6ffd9502618d3ccbe2983

SHA512
18fbe0337d77538d0b4a1dda785a613f38423412487e35e89c16f7e5047cd9ad46886fc5d32b8f39acacba7f288c86833e4bf385d05e146e22a0438551f2adf5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\578C89C9AA956A0BDFCA345E6D2E01F830BE1460

Filesize
2.3MB

MD5
3aa121025f52f2731bcd2583b5e69b03

SHA1
a33e0c4920d56f36dc1d91499eff92a45120a728

SHA256
3f131c9499cdf84d65ddb5bfd5b4310b05ec446f63bc551b1c8d2335686ae64e

SHA512
5ae6049b4f298c0afa8a77dad6cb9bcd1651cd681693e5148b78af5cde79dd6eea4821252467cdaaf39adfb25d372bb46c84a4e70a2571de181718ff50f24bac

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\6950C021D3AD256F6132868752088CBED65A6F85

Filesize
25KB

MD5
73dbad3d7ef48b89578b407af49f16c8

SHA1
49620b779e9a2bef6256a9ee85e0ca4c63e3a5a3

SHA256
e58c0a2fac4034e68516658604697a0b26ce1d50f3a95dc6ed90c703b2f09a5d

SHA512
6cf99d20b2cd129f3d593b6f0fc37a3235ca429e5115df59c9158730199b1cc9df43bedb3d221cf53920e38a290d1511f6fdc1528661ed8f4524ab0d34e42c30

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\6BA9F301678A2B2B0682F8F1A185E8391B64ED41

Filesize
23KB

MD5
90dd46f6747b01303794633eac7113b8

SHA1
3e99744d4b18c1b8a194bce739d217bd9b5c5dee

SHA256
3940b47fb08b3d8be4fbe2154d88ca5189e88291aa0e8d3167b0a8c1746c26ca

SHA512
b38c2fd2ebd043cad29efd2dd0be18ca35fd52a05764d414073bae4bb71e2f6d44fd3f53447b22ceb301f77af5ba22df86f96f6783131a0d9f6904c1f1b37ea7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\872F0AA43BF9278B969BD266ACEA982EDC8ED0F3

Filesize
421KB

MD5
6a0214e7da1228ccbfd8405c88ed7f62

SHA1
0863cc7d958f3dfb74f4c8f4aa8faeae238796d2

SHA256
7d6aa54f74b653ad93609c58c51db870292c28c88d587012417832a37b0545f1

SHA512
6ee9d1cef08eeee0a2d1038ee93576478633de1cb8fb33f87c58e7b11456891e06b2a85db725c17ca9e4187795c7a0cdcadf7c0d7b5b99bd38d65b279bf6dece

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\98E7CB868A0E2CCBB49693CA594496B2A4BD01CC

Filesize
1.3MB

MD5
82a00a466f78dcc3ad463f4025db8aa8

SHA1
d8989e57c80fc6843d2b782b244965499756aa66

SHA256
eb49c312909168de9566265fbf6abde59d96beff6f46d3a1b2fd4f868ea042ad

SHA512
c45e472ba71098b08cee7d840624904e2281a6171fa06dc9d63b3ae89bb18034d362270b2a2258c73ab46d43dcfa88c8d1709d2a8cd91fc0f3759b6b16e9548c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\AD525AE91F8D63419653596829AB9B1342CB5750

Filesize
1.1MB

MD5
591c251f17b00b067165ec1b807b7524

SHA1
15a719ad18c8c357be9f843589fbc4b35ee45615

SHA256
b5652252f83785d687cb95b58cee8df676c43493a89fc85bef3116cf93b4c15d

SHA512
06a25c8bfa8f75b9a5abd83282df74902beedf2435f9c42024da94519ed443e60bfb815b58e447a16178cd7977d32075f6e57b923c48536c6319d12a030f2f4a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\B3CAF9CC93D57C69DC87B1F85B782ABA80D2A9B6

Filesize
125KB

MD5
7ef96a4be9ed117b2beba7740e70c737

SHA1
0bc8261b67a56690a7c7c98bb17c88216169b827

SHA256
0cec37bb7dc829f2fc847edb1987dff96d45a90d00f210daf2640f24b4a293e0

SHA512
d616d9146007e69cfd7b9322945c92a3f91d5b38da7ae98cedeb531e20b9dae3038f763aee03be347d909f0c05acc9933736d8137d3d1be45a37799326682e9e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\BC3C2001DC1C6E6F7CA77AD6CD81305F0ACCDA3A

Filesize
140KB

MD5
8328606ea28b55d75f525db8d06518f6

SHA1
83dfce1faf4b5422552cb306685ff20594746b78

SHA256
7cd9832eac9f3c624c8b543b35f44e2583527e0af459119a329d9e8788f2be41

SHA512
6826713dbb8fcc1774859be878f7344d1c71c78b34e751f1fcda53125968f79b02b53714735d13ed153efb71a444eead35846e91c0cd6179f666513c23a10ec2

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\D6CA82B120BF288228505963CE0F3ADE3C347225

Filesize
122KB

MD5
b3d4b6bbd11c905e7f5e88e7f2fa680a

SHA1
3dbefad3e33f03de372ff123e47f96bfd9441010

SHA256
35457d0f3549986140c21b97f3df3b8ed8983862bd48005bb41f8ae39b66a032

SHA512
84c92ea7cb4c77970080b510357ab44d962f5a4de32ff32774fcb622e8ab775da0c0885d13eb7439eaf8db9c6fb0e4f124716b3bcdcbb0bc9fb607b84187c4cb

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\ED32ACE0123574C9FF24333D073ABEDABF41A2EA

Filesize
199KB

MD5
406263dcedc4f1e6486aae80f67815c7

SHA1
128e67f7b65964923753aca4c8beffd97d304f14

SHA256
6e19829b3cde5c322bfc0e1f24def0762008c697dc7facf7d00ccc6a39094c07

SHA512
dc53a0c4acdf3288c89b3d377f4431b6cc1e67838a46c4608986d8008f9b30c0373c7b9b966101409c09908387b2d6d7fcf20f60ac704c0c97177434b91bcf0a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\F1024191799870B12785EC8CF95ED4019EE3FD36

Filesize
480KB

MD5
bbf068270abc3302b5fe0f5b531b2593

SHA1
2c9ee13fbd1246a99fb40942d130e9e44b3dc56a

SHA256
f713486f33e62cf538a05359e93803931618e341c6c0bb247853ffe4164558b7

SHA512
b7538055ceaa43b49461cdf36ca05a5e370a59e4b33dda58a4643c4e250bae3994352e4f77cee4d31cd48ecd67429e47dca6ce7d544d5bdc8e39dbcf5da4496c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\cache2\entries\F40159B93D3975186E1E828662DF0B8C7C022C47

Filesize
99KB

MD5
0239eb9cb243f8391a16c785b91761c3

SHA1
c6c280c2e119e49c180a1a0d90621e9aee071aff

SHA256
722bbc3012ec7987ef8b77e062d44579d22e43441bfdac3f940ccc48b6f75c08

SHA512
83723cd360109704edde738f830c5974248caae0b3d8280b3e575da954e4d17c33bea6022483b9fe41aa34c93186a478c5fb78c6b50492ac3bf9dd59fbf279a3

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\y0bypz8z.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lgzchhxm.tjf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

Filesize
12KB

MD5
74edd214b07d13dde688466c1ecd2453

SHA1
d340cf694609bf2ebae698dd2adc73090f7fc4e6

SHA256
d9c2e3eca6d05ffdf67597fb478eef5576dfbdc126a347a332177604b63771c4

SHA512
b5812595e85a1291eb7d40cdafeff2e16a4094989b1c8bd301c0fb63438d9ea072910bd5640db2593014b79c5b4ff615910b9a203e540a9c4191315bd63e0efe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
20KB

MD5
a89880acfc6e15bb02cc8a2a97306cb7

SHA1
6efc283165d44cfb9a4fa255f5221b176b556473

SHA256
61578a31d230b0eae5a8b5d563bd5811c9c37d94ae88dbbf636c425cfa769993

SHA512
11749ccd1538486b526bbf793e700f8afd16e96b6dae0a4b708f1dff6a393b237a361e34c96c5a09d4bfffe9833a4c9e8c0a9e8ce32940699060d62e72765660

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RF51U5NBR5Z37FU2C4K1.temp

Filesize
20KB

MD5
c0570e04a89b3964f4df26f32e20c443

SHA1
bdb352735deaae0465ea7d04c968d14605b6061d

SHA256
b29007ccfaa6a0531518e044b968f0cafc883e56aacbc33c50440913f6f7855b

SHA512
6946a71bb88b0d2515d366d4e6b9af1ec55aba3c061e535585957acfea8a60313e555efb5845d9da45aaf6763cb229bdb9881a0fdd30c949d2ced7d652978741

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
6KB

MD5
db0dee537c2e84a579b99a7ec57c79f3

SHA1
b72121316f75b7ff71a0cb013edd526df2a88105

SHA256
03f1bb3fb4db69da896cebafb1b4419e2965562f7991070d557712299e14ca2c

SHA512
0524c289185adeb592cf27874cb3fc9d2b00bf92c454d9a66cd2329a90152ee91f0adb326bba0ba57cadae9503fefd0711deeb529decfbd932da2faa40858857

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
6KB

MD5
dc01b11d4452985afb929d91fb9ab1cb

SHA1
2441cf64a605cf5ce540f7bd70f5654d2a8f6a8d

SHA256
23fbeb0db4faf3243055beaec94db11a162aa88100d83359697698728b7740d6

SHA512
9a424904278b0b7c7d89392cd11438e8d7cb6c72641a0ab1114469116bd659266d4cf9eba29581f9ac8094ab4e055a74252529ef00180424737260fd9766526e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\AlternateServices.bin

Filesize
8KB

MD5
858ab3b4d127a5f004189b742e2b4f46

SHA1
63da339928246d1f93c758d566a1ceffdd996a86

SHA256
2e25a79d5e927ca12e3a4d618b5a6874e37b6589ba09b6c00ef21a1c46025d9d

SHA512
62d28d09424a266ba535f0e360f1f59aa2b82d4f8e8262c84b3b4601a941df714510edb84378a880d55d873b4a277a09e6a34373ea36cee38632127a07768d63

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
4dcd0cfb0ded4000f57db27356f9c9c9

SHA1
4db2ca67db966cddf14dbdb9f558eb976a138013

SHA256
f4b9a6abaa0cdd3002696bfc10d14a52c8f78abb4759ae7400f13168a6139e51

SHA512
98ad5e1efeb8a936b360ba6d72847b9516dc33c4c450335952cb54a12daa86a25d50fc599f6258be564508a7b08b80e5872499ac5f6f0aaf23cd3c37c7887d25

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
c4f3b2fbcb3913dfbdcbafb9dc735b75

SHA1
e66dfdeaef2283e9f6e32b4fd344ca242755412b

SHA256
ca1e4a8559ddc38cebfa5901b29156be79664ba80f063c9df3781e53bd24267e

SHA512
272cbfba99bfc4ff6934d7a651d64261dcbd2badd28b2d01a68093b026d25e6f98bbecca5467e279e4edc9095834ea55a6cc61eeecd9116882136ef7483b60af

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\db\data.safe.tmp

Filesize
80KB

MD5
07944efeaeaf72ccc4589629acdcfa74

SHA1
52826e25328d62e2c9c5f53e5d50695a3db1593c

SHA256
264527d4de896d390c681e9e79f5e61fd1d8b6a2194885444faf782f940ec501

SHA512
7ca836b1eed00d3f63945b5456dc0ed52113e824cbc042da3eab49f8a3bc3ad13725dcd2eb9cac6b4df4bf353f36615a2f365198c3326fcee29d823da05165e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\6809dd13-6b04-4ec6-aa8a-725fa7aa30f3

Filesize
671B

MD5
bf11fd978ccb5c11c368e5e072e0c9f7

SHA1
0f5f24bfdafed4526858a1948f2e14a74dd64875

SHA256
70c72ab368656fc7ff42b760051015091858ccaee838575d176845d90039c360

SHA512
ca6b4434519f3c4abb7814a160aa70d517b0588e295dda60b609432b5b23fc9f4a9a1efdc33db01a55b40dce58e1d521c820607fa4f69836e9fe02064d15bdc7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\99e8cff5-cc76-4af4-92dd-1f56b98d2368

Filesize
26KB

MD5
2e26fdf3d47f976150ac029ae4d8afd8

SHA1
96d90d0621566a04fd54fd993a162a36ac719682

SHA256
150bcedadb9e6af5870fcf7b210d69415d6835af86b41a7d3d8f0ff0691ce4da

SHA512
bdbb5223743c6c5cb2b2a890b1f336db0d66c5ba3c8e07a6c8db1ac12c988643e4a4a5d740e5c0eea1df2ea5812d0d5e956d93329137a79fff40128179d08a38

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\datareporting\glean\pending_pings\a6733cd7-9395-437d-8bb4-077c7f07c258

Filesize
982B

MD5
e90bb14ca9d51b771a43437892825e93

SHA1
bb372b051699c87c292c727c8ff95bb8048ecccf

SHA256
729b7cef48b10e642ff64355b5655d865441f4f04205be2d2bdb6fb764184486

SHA512
ce579aedc009dc752e901eedddd5c88e499badaac18da5da3e68b318acf737f4fa868c5658d964571c15aacba9b2c96a61c56b1b0e6004f69e723be74075ae34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
11KB

MD5
4e71cc0e908280f48dbe64c70dffaa14

SHA1
a123bb20b5f4ff3b5944502305406ee50135a760

SHA256
9084fcc1dc9fea8010081cea2d787bbd188b925d46613f6dc81c73cfefef05d2

SHA512
5d0d0ee5831b138473f27c3d0700ed62a4adebe7abd470badd6a73d49ee0d995f50c73cfca8aae94446895276269be98d613f52119db648c599d01875f5dba53

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs-1.js

Filesize
9KB

MD5
67442afa5de878dbffb360ad48d4557b

SHA1
42c82575956b2607d348208af4e9ec8e958b14e5

SHA256
6d0355d48df11f00650e7363ae49bd69375c334e573beea637e44cc0b9f793ab

SHA512
56171c7e11b3bdf79f04f1256e54c088af29243ec0b413e11dc23fc6816e043ff571b2574f8416e3180bb57969b38b3a2e72805560c7b3568c6e9b0afed0627f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
5a3f033cf0d8d17781550bbd7bd42fdc

SHA1
2aaedded64992d317e48c9f5b220d4a41d58304f

SHA256
6c105543191bff728cbe3704c571528078b5d19376c8f5dd585871d4bade090c

SHA512
b20b947ac3d3aedd74a75bb57c33f990c022fa26f4a117e88095d31978b405fba9a3df62680625c4db556c4ab06eeec59fb96c010ad08ef0f17803c7de2670a4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
10KB

MD5
912629f84b43d92ab2b50d3fedf33246

SHA1
cb75d47baa374411260cdc5a44d3250fa3948fd4

SHA256
901679dfe373595ceae481b8630230268d1fb5f8a9af40f40ffefadc51d3167a

SHA512
fd505f4bb7a42ffa76c729243bcad6e75bd07114cbdea1fb29bd1d76bacd910789d8c2c4f3f0cab887dacddd066d04199371bb0828e3db003649983b3e3c45f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\prefs.js

Filesize
9KB

MD5
f4bcf837f967acd05631e886371234cc

SHA1
c2b6467d1f8f1b1fceedd1df845b691ce02dea84

SHA256
d0883dae9c496a85acfa31bd8d9b7081884d22e4db2ca0662ab7a9fa9e0d9a06

SHA512
6abc523fdd215936564ce36adeb44eccebe4cbdbc503bf8ceffb33c17046d444181aa8cd7e973b9c6ea7e8176cda263948e52c977d4f9a86b8dad241e5950290

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
12KB

MD5
5050bcec18bdf3304a78368266900f29

SHA1
9c7b0826426ad285da7332aad2d2ac8c4f152fa5

SHA256
1a2791b1f3ffa76e13481cb6fbb191484ab2603eaecc7eea2c29467b41d88ce6

SHA512
7b7b09a8c74996cbc436493bf2fe70f2b93e7ea1378b0be322b305b8bcf7d6260c323b2b9fc49b0b969d84388fabb6498ec5cfb1d56c606b0cf131a1245bf88a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
24KB

MD5
3ba6c3ea7eb7110d703dc997871a6591

SHA1
8fbbd39ebd8f627e098ef4902ae61def895dbaa9

SHA256
a5f935b0cb02ef389ab04b5414167e1b1dc2e4e4fe23339a12dfa0616694e193

SHA512
fe20dec135bfe7589c79922fedf586489818eddec1f010499edf785a2147c41c05b51b37f643cc81ebf98a032269e05c80e937610538185fce00eeade257dd11

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
5KB

MD5
283a28075168ce2ceba20c031d7bcc22

SHA1
c5066f0385c613538f4c9928de42084ff4a26941

SHA256
471d49459fe0cbf88843036d7ecdfa71e5ec99f51cc9b02673e183eba217909b

SHA512
e2409fff0972a4c685e8d2e6a62ada4535243d0597e080e214943a3ca723e2a773a7c5d4e99ad6aaf86ac295c538e10abc23f21697a41eba7f2f67e4f84a0248

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
7KB

MD5
bc0e7bfe3b0d3999bce5a101acce170b

SHA1
a5960b35624b5661be37642fda2701332561565d

SHA256
660e0ef6e065fc354e5e98f0dcf6141115a9178ef53d24b7d8fa5ac4f25eaa37

SHA512
0e28f468c23d0346e43a98697215a2fabea79058596395ef0e450fd836e1fa760e2250e828d21db7506206cc67faa2ce5bb2e40cf856b840a63d219ef283bb6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
9KB

MD5
d656b39b5fb4f81fc8a53eb62d248692

SHA1
ae80a95b8c3ab95e9e86635634a8060b54daacbf

SHA256
5b34c23487d83e72bde49515483bd95139a8c0921a69f7e18531bda9b5a93819

SHA512
da0139143f912bf07c1d36b33bf1254b88379f06782350a3bcd3cada208d71b3c2e454369654303952fbdc8b388e3cebe522b404dca8a5d0e1c1b2b60451e661

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
bc57286aff048c3728fef99643d58653

SHA1
508387e05cc5c7db7f69cd43d3af612f9adfa563

SHA256
1c44eedcbb821f4cdb73e988ce5c3d10edc5dada3b8f4592512044fbb1493c25

SHA512
813c3ddb3dddb46ba8ce43559544918b5b9fa0934cf416fd77c7e81d7ec03971e7b826c96b56ed874cc056f79212dd876a718189ac36e5603df0c61cc28400df

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
19KB

MD5
c21432bbc583db623ad5c129189e3230

SHA1
a7edeb449ec409a3f2dde63c4084c2f5cb099269

SHA256
99fae183db3c93dc85b78bd842a1725159059727442c6d8ba4fb38e1581efd55

SHA512
11435c8f6ec21989379a2bc1c375c9fe0f4aa9978dd1fa734d5b4a467c01124103cb70cd64532a9847eb762418adb3313518214da8f9d13cd9336964dea85b69

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\sessionstore-backups\recovery.baklz4

Filesize
27KB

MD5
5829f6398c96e30f9cc3c6dc868ada5c

SHA1
ac0e570ddcca16da74654706222114051798ca99

SHA256
995a6feaa626b4372e5a60412ab45a611978dd726e77fe49550b75dafd459fa4

SHA512
182a0180dff1302b49b3b276186fe6bf9d5b6466ef83700a306977c803e5de7d5b8163f5f997816c3e89e95a4e592088549ed8ed21103be00e1de65ceb0444fb

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\y0bypz8z.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
368KB

MD5
30d5149fc2bd8a3f885dc92af509f046

SHA1
0674b231fa13f330915c50c567e018cf11a804cc

SHA256
99df754b6d415d8f0a88bc0d5db45e8a6e930d56b531d0a0f4deb5657300929d

SHA512
599726c761a424a33371b5d31e6d9a715c597bab37e145e64f89bcbd43f5245f28c2417e854568d5f01dc3af0bcfceafc5093bfebf422ed2b4f200d561545c89

Download Submit
C:\Users\Admin\Downloads\mal_unpack32.BP3TF6it.zip.part

Filesize
368KB

MD5
8cf34829dd97c7b2ea6aa5d1230b70a1

SHA1
b2d579c67e2ecc1399c4b5b0380e5c08ef477b6f

SHA256
107f7d53f74363f556a4697973e073ffac0fc43eb03fe606272163946be43b86

SHA512
645d640e26025c4e235c75ff606830a182fb7f05bc10678222321e200aa0461716aed49919dc1d3c7abb06c290b975323211b1a2b9dd6eef33a6cc00a0f4fab3

Download Submit
C:\Users\Admin\Downloads\mal_unpack32\66bddfcb52736_vidar.exe.out\scan_1737485167\process_3136\400000.RegAsm.exe

Filesize
2.3MB

MD5
0e01c398803f69d5c3f1c6630cced5e7

SHA1
6c446ae70182c966af770897991dfdec1e839970

SHA256
52304d13b8b1b5a0475d00772e75acb7c382495bb0f0e5898f7d3de299bed7ca

SHA512
a8f6eeb6a2afaab6d0075af449d4c3e9c91ae2052b9d604e2f9635cc8c79ee13d8ed45c4a225ff2fc8e96eee957cefd79032d3c870fa6ec13466d5a2b2d23953

Download Submit
C:\Users\Admin\Downloads\mal_unpack32\unpack.log

Filesize
109B

MD5
9404e3a402c156999f6fb1db725d3ee3

SHA1
f9965e403608e45bfb949dba696fbc3ccc8db91a

SHA256
b700deb5aa8ab1e4fa03244f4fefd1c053e8e599fdf4600ba0d248956ce68cff

SHA512
df3660b227739eda3dc3a8508269e231136b58f83e6ef4e40afa32ef13a8cd1c80f989511cb9c5f3ec16bf947f070dbc17e043b5bd64ea7a99cb45e81b4624ba

Download Submit
C:\Users\Admin\Downloads\snapshot_2025-01-17_12-45.xoBb7uAU.zip.part

Filesize
33.4MB

MD5
5e909dc8e49d7c133cf3e121e0265dff

SHA1
57e77f9a406647b0ad31311630e3fc44f25979b3

SHA256
82e5522263ffbe2ca3d6fdf21f8c59d8321e507a8b805f58bcec0af4c9ebe162

SHA512
3250657670d1ac8d13778e976dd8fbf7dc75cec16147f096dbe87a40eecb254d5ec3fe3e8d1b0718ead537476002856a85df846288d1099251b4c9c873c4e879

Download Submit
C:\Users\Admin\Downloads\snapshot_2025-01-17_12-45\release\x96dbg.ini

Filesize
122B

MD5
45c1e010baaeb6b086b93c73cbfa1433

SHA1
6570b66b77103aac30dc7cccfacde1e42413890a

SHA256
672875a23347e407ff4a54c6baa35090c7041fa45568437f12b86b50bc2fbebc

SHA512
6b00d4050ad80dc575b056e40b3fdae831e57d1b035fc7500c1523c70c7f03f344e8b53b070ec3c8482fcb7c300d401260502ba4c04076ee23db66c236d3ad50

Download Submit
memory/1524-299-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1524-298-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1524-4-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1524-9-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1524-7-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2968-1-0x0000000000AF0000-0x0000000000B26000-memory.dmp

Filesize
216KB

Download
memory/2968-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

Filesize
4KB

Download
memory/2968-11-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download
memory/2968-413-0x0000000074D80000-0x0000000075530000-memory.dmp

Filesize
7.7MB

Download
memory/4076-1861-0x00007FFDD87D0000-0x00007FFDD87E0000-memory.dmp

Filesize
64KB

Download
memory/6168-1773-0x0000000074590000-0x00000000745A2000-memory.dmp

Filesize
72KB

Download
memory/6644-1811-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/6644-1810-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/6644-1818-0x0000025F43170000-0x0000025F43171000-memory.dmp

Filesize
4KB

Download
memory/6644-1820-0x0000025F43180000-0x0000025F43181000-memory.dmp

Filesize
4KB

Download
memory/6644-1823-0x0000025F43170000-0x0000025F43171000-memory.dmp

Filesize
4KB

Download
memory/6644-1826-0x0000025F430B0000-0x0000025F430B1000-memory.dmp

Filesize
4KB

Download
memory/6644-1838-0x0000025F432B0000-0x0000025F432B1000-memory.dmp

Filesize
4KB

Download
memory/6644-1840-0x0000025F432C0000-0x0000025F432C1000-memory.dmp

Filesize
4KB

Download
memory/6644-1841-0x0000025F432C0000-0x0000025F432C1000-memory.dmp

Filesize
4KB

Download
memory/6644-1842-0x0000025F433D0000-0x0000025F433D1000-memory.dmp

Filesize
4KB

Download
memory/6644-1816-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/6644-1774-0x0000025F3AE40000-0x0000025F3AE50000-memory.dmp

Filesize
64KB

Download
memory/6644-1815-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/6644-1790-0x0000025F3AF40000-0x0000025F3AF50000-memory.dmp

Filesize
64KB

Download
memory/6644-1806-0x0000025F43530000-0x0000025F43531000-memory.dmp

Filesize
4KB

Download
memory/6644-1807-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/6644-1814-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/6644-1813-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/6644-1812-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/6644-1817-0x0000025F43180000-0x0000025F43181000-memory.dmp

Filesize
4KB

Download
memory/6644-1809-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/6644-1808-0x0000025F43560000-0x0000025F43561000-memory.dmp

Filesize
4KB

Download
memory/7048-1913-0x0000029B2F8B0000-0x0000029B2F8CE000-memory.dmp

Filesize
120KB

Download
memory/7048-1908-0x0000029B2F8F0000-0x0000029B2F966000-memory.dmp

Filesize
472KB

Download
memory/7048-1907-0x0000029B2F820000-0x0000029B2F864000-memory.dmp

Filesize
272KB

Download
memory/7048-1897-0x0000029B2F360000-0x0000029B2F382000-memory.dmp

Filesize
136KB

Download