vidar | a4e0fd3483e26b4c0dfda5b2c1cb89571e06a8162e88b8a47a810a4b38934b1f

Resubmissions

23/01/2025, 15:48

250123-s83ctsvkav 10

01/11/2024, 15:16

241101-snpk8ssdrj 10

Analysis

max time kernel
34s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2025, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NwIns.exe
Size

1.7MB
MD5

ebe0d35f9fcef8de203e66b161aa5f9a
SHA1

3788ce60f120e76498ab6713aa26d112f61e54f8
SHA256

a4e0fd3483e26b4c0dfda5b2c1cb89571e06a8162e88b8a47a810a4b38934b1f
SHA512

333c3e173a06f9b968c5a273511f164a9526109a9570b06539b9d407089e9ab3a93db0e1d950bf172d45c054c6fb73fe93954f3a541a4d2e38e6d321567a2ef1
SSDEEP

24576:JsK9iuA276atJZnHp336Ps2QavGGkUlN2bWbK9P64qIxvE9HC9q+iKlGr4Okc6j6:J9iuAWJNJ336bz+Gp2b96j6xG8Q6jLG

Score

10^/10

vidar fab69509a6a37c858e79db0a8c90ad37 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

11.4

Botnet

fab69509a6a37c858e79db0a8c90ad37

https://t.me/asg7rd

https://steamcommunity.com/profiles/76561199794498376

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral2/memory/3896-537-0x0000000004F80000-0x0000000005280000-memory.dmp	family_vidar_v7
behavioral2/memory/3896-539-0x0000000004F80000-0x0000000005280000-memory.dmp	family_vidar_v7
behavioral2/memory/3896-538-0x0000000004F80000-0x0000000005280000-memory.dmp	family_vidar_v7
behavioral2/memory/3896-555-0x0000000004F80000-0x0000000005280000-memory.dmp	family_vidar_v7
behavioral2/memory/3896-556-0x0000000004F80000-0x0000000005280000-memory.dmp	family_vidar_v7

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	NwIns.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	Licensing.pif

Executes dropped EXE 1 IoCs

pid	Process
3896	Licensing.pif

Loads dropped DLL 1 IoCs

pid	Process
3896	Licensing.pif

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3988	tasklist.exe
1452	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\EfficientScheduling	NwIns.exe
File opened for modification	C:\Windows\GelGave	NwIns.exe
File opened for modification	C:\Windows\SkiHaven	NwIns.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Licensing.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NwIns.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Licensing.pif
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Licensing.pif

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1236	timeout.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3896	Licensing.pif
3896	Licensing.pif
3896	Licensing.pif
3896	Licensing.pif
3896	Licensing.pif
3896	Licensing.pif
3896	Licensing.pif
3896	Licensing.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	tasklist.exe
Token: SeDebugPrivilege	1452	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3896	Licensing.pif
3896	Licensing.pif
3896	Licensing.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3896	Licensing.pif
3896	Licensing.pif
3896	Licensing.pif

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1944	msconfig.exe
1944	msconfig.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 208	2656	NwIns.exe	83
PID 2656 wrote to memory of 208	2656	NwIns.exe	83
PID 2656 wrote to memory of 208	2656	NwIns.exe	83
PID 208 wrote to memory of 3988	208	cmd.exe	85
PID 208 wrote to memory of 3988	208	cmd.exe	85
PID 208 wrote to memory of 3988	208	cmd.exe	85
PID 208 wrote to memory of 1180	208	cmd.exe	86
PID 208 wrote to memory of 1180	208	cmd.exe	86
PID 208 wrote to memory of 1180	208	cmd.exe	86
PID 208 wrote to memory of 1452	208	cmd.exe	88
PID 208 wrote to memory of 1452	208	cmd.exe	88
PID 208 wrote to memory of 1452	208	cmd.exe	88
PID 208 wrote to memory of 3108	208	cmd.exe	89
PID 208 wrote to memory of 3108	208	cmd.exe	89
PID 208 wrote to memory of 3108	208	cmd.exe	89
PID 208 wrote to memory of 2476	208	cmd.exe	90
PID 208 wrote to memory of 2476	208	cmd.exe	90
PID 208 wrote to memory of 2476	208	cmd.exe	90
PID 208 wrote to memory of 2768	208	cmd.exe	91
PID 208 wrote to memory of 2768	208	cmd.exe	91
PID 208 wrote to memory of 2768	208	cmd.exe	91
PID 208 wrote to memory of 3380	208	cmd.exe	92
PID 208 wrote to memory of 3380	208	cmd.exe	92
PID 208 wrote to memory of 3380	208	cmd.exe	92
PID 208 wrote to memory of 3896	208	cmd.exe	93
PID 208 wrote to memory of 3896	208	cmd.exe	93
PID 208 wrote to memory of 3896	208	cmd.exe	93
PID 208 wrote to memory of 3948	208	cmd.exe	94
PID 208 wrote to memory of 3948	208	cmd.exe	94
PID 208 wrote to memory of 3948	208	cmd.exe	94
PID 3896 wrote to memory of 4624	3896	Licensing.pif	116
PID 3896 wrote to memory of 4624	3896	Licensing.pif	116
PID 3896 wrote to memory of 4624	3896	Licensing.pif	116
PID 4624 wrote to memory of 1236	4624	cmd.exe	118
PID 4624 wrote to memory of 1236	4624	cmd.exe	118
PID 4624 wrote to memory of 1236	4624	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\NwIns.exe
"C:\Users\Admin\AppData\Local\Temp\NwIns.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Contact Contact.bat & Contact.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3988
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1180
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1452
- - C:\Windows\SysWOW64\findstr.exe
    findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3108
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 161897
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2476
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "sitesplayboyfundraisinginformative" Efficient
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Bloomberg + ..\Staying + ..\Accent + ..\Labor + ..\Iii + ..\Victory + ..\Plans + ..\Jewellery + ..\Gourmet + ..\Ignore + ..\Lung + ..\Dirt + ..\Youth + ..\Receipt + ..\Following + ..\Berry + ..\Discretion e
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3380
- - C:\Users\Admin\AppData\Local\Temp\161897\Licensing.pif
    Licensing.pif e
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\161897\Licensing.pif" & rd /s /q "C:\ProgramData\FHCBGIIJKEBF" & exit
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4624
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1236
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948

C:\Windows\system32\msconfig.exe
"C:\Windows\system32\msconfig.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\chrome.dll

Filesize
676KB

MD5
eda18948a989176f4eebb175ce806255

SHA1
ff22a3d5f5fb705137f233c36622c79eab995897

SHA256
81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

SHA512
160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

Download Submit
C:\Users\Admin\AppData\Local\Temp\161897\Licensing.pif

Filesize
872KB

MD5
18ce19b57f43ce0a5af149c96aecc685

SHA1
1bd5ca29fc35fc8ac346f23b155337c5b28bbc36

SHA256
d8b7c7178fbadbf169294e4f29dce582f89a5cf372e9da9215aa082330dc12fd

SHA512
a0c58f04dfb49272a2b6f1e8ce3f541a030a6c7a09bb040e660fc4cd9892ca3ac39cf3d6754c125f7cd1987d1fca01640a153519b4e2eb3e3b4b8c9dc1480558

Download Submit
C:\Users\Admin\AppData\Local\Temp\161897\e

Filesize
1.1MB

MD5
0f6baae0e2e1927f985ca9a237a6a21a

SHA1
d70470b7b1300dd020eabdc677d697baaa3a4f3a

SHA256
bd1188e067a4253c2f567d1ac4d4009fa847255194d4d5e27bebbf1fc8d6d4a0

SHA512
fceb9e80ee769c0314c6a31371232726c16b9b9d3c76017d3540d4810dd2d4198500d3d09a27181ddd70047a1846598e08c3ad4bb9360f73bd47b203325322b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Accent

Filesize
53KB

MD5
9586977b2d8814617566102c8da06ba2

SHA1
517bb75069ed69134cc358a7d59e8cef9322a71c

SHA256
d2b09b075d03cb4c4643148bafcb34974be11136d49b7b15b14fb913d4ab5f41

SHA512
2fb886838649f5236991b3b6f0d0abe6725e627821b1cf6cdb01f21a412e25ec8cc4a6850cc348e7d3f6690344b32c86b705748b0bb200fab61eb54eba4b3887

Download Submit
C:\Users\Admin\AppData\Local\Temp\Berry

Filesize
59KB

MD5
92284068f21c1b0f6213f283fa4cdfbf

SHA1
4e5ce90652573fbdaed264b9b62daaae7b89cab0

SHA256
ed04d45f1d62155fac17e7c0906bcc9de7b118557b3a1ec16dec6bb851bdcb7f

SHA512
1a017e4a3d073c0751173d644dc8b2383c45cb575eeecfffed7b35214c24224878c88e3821dfd679185461da6f605047196e887d4e86f42283d71929e2918417

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bloomberg

Filesize
80KB

MD5
d32b0431b2e65f997ca87207d1904893

SHA1
54a2e5ccbf7cb367fe728dda3e76dba7806fa448

SHA256
e22d1257d9a19a6597ea94296a852085d0da01065bce2c74fdd770f2103161fb

SHA512
9bfe95b9db712eb9a6b292ff13ef7b5832671d906886f822a510e5c5760077eeca3175e8c0748094dbe57853ab37e19560a9cfacd444053a06f751f558b0454d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Contact

Filesize
21KB

MD5
dc072e36e6d7bb91c120103413690d92

SHA1
08a06982851f11329eacb9304d118a0fe732ca6d

SHA256
c1d8512b7868ec592baa840e4da459e0e64dd68d9493bb48495eeea7456efa85

SHA512
321fc21f20f087c8721741b334cd1aea1075178d5a761c0894ec63ba37ad5d03c8639465e5f48f2af43d999d1b1b684da7cb0318b2bd754133fcda2a78c53ee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Dirt

Filesize
52KB

MD5
9e7954674da82c0cf7532bacfbd8e87e

SHA1
36ad68fd09cda27fbbb8708c2f27c92009a7b271

SHA256
fbb7c957094c97d119a9562535f1f21e39de6897a14f257548b88a589397d572

SHA512
9e6d4c8b7f5be9ac7cd07b7686f378cd4b464a004d6d4089a69d73e878908e5b3cb310e8d43c5d7a22640f91e7ddfcd0e6fc6ecb5b3cbf25bc27d47b13192db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Discretion

Filesize
10KB

MD5
8ec9927e21be4a805ccd718c469543a8

SHA1
991d2f76ccb77dfbf67e3d3abc31e7d973292142

SHA256
bd49f72818822441c869d3e9f7a9e80a2bd8d9e70b8bc33322de43e01611e905

SHA512
63e403eaf66afdbae66b020e27cf8767d5af07f2fc6553f4579a5bc97e01f0e9f587653af80373019f9b0b6d3199710642b88da5ffa28d12631960f27e90249f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Efficient

Filesize
6KB

MD5
34c9fb600449bd32ea2826397cf41f82

SHA1
b74c5543a8ebec30e2da7ba985e42f10508c0a81

SHA256
a42198be1739cf5ef112d73e64ff57626f0b44f97aebbb0553bf0807972d4296

SHA512
2aa757dad3e90328ce1fea571cf4e9f5d55337ad159cd8b52e7305fad7cd0b3c4a856a4adb8a7c7afc220278e7aa06eb19d7a62dca243a4e7f6af314b3aca4d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Following

Filesize
92KB

MD5
90b1588247d50fd40055973f8595f85e

SHA1
83615c547d73a75bdbc133952a48359751ece19e

SHA256
affdfb22752501f056eba424b979e4a2f8f5fc48d0503f17f9fa9d800e61b23b

SHA512
495a4e7433e7d943475608d53622b4bdd6496984370f94b3d3466d56b90f91c32c0df7a9f5121a9f147198138910703748175c3810e550713f5aecc1adf52cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Gourmet

Filesize
91KB

MD5
7e288942dd5635265cc217350ee0cc22

SHA1
a61d48e1ee8c6f10c4780a72f6925a7d85a83ad8

SHA256
b3e3436a61c3c73427dddea2cd7132ead53d85517485399761138d7e64ffaf02

SHA512
0f0e8b59ec6c46b3f093cab81ae7eb2930ffb88cec1e26592c6f4cf991df41d19fe0aa599cfad1e54456bcabc5ead52d7a497213fe6ba102c2914366e701de3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Habits

Filesize
866KB

MD5
9982c5260c1045fec4ff9df5cb053a10

SHA1
5b91d7de1f2cac0dea0a6b55c7e2f8f7c7397e25

SHA256
18f9dc4b921c350c0b25fbf67d3318ea0d8d64887d66cf71c2fe184b08faff74

SHA512
da81f06668282bf5ba426256b9beb0cd22399c5de92cca013cda54dc977fa300db22b8038bd5028dd80778861c9c5e7d04299db40ff83c7c13c21abcdb4cfa61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Ignore

Filesize
88KB

MD5
77fd94cf43ac2bd457fde50645b9dffc

SHA1
240c5cbd9fa04bb0e788b6e3926823b615a60061

SHA256
191442382e0569404fe150b7c7edbd159fa32b532bbf0802e182ba4f28fca773

SHA512
a1e64b6ff59d80ff2a40af8b71d2526fa4af45cd8af1709226b649ed11e5bc00300c9f2a82050a8d49fc0cca99b0d9b5dbd3de59a9d73c55b78f4d792992439a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Iii

Filesize
63KB

MD5
4c0d024a42cc231478b67fe37fd43462

SHA1
8b729c045a8c7aa9e65555d776f02909832cdbb1

SHA256
85841d6043a23d3d184b89fa1919af49624261c67e2844cb91b9d1efb50af8c9

SHA512
cc94132aedabd6355f1943585f9fa1dc3c4ff46070a9b9d7dd0739b0ea480abbfd3aa4f5daf2fb40eac501a2cb36fb90b7680edc3b8d67b75a82dc4c24420464

Download Submit
C:\Users\Admin\AppData\Local\Temp\Jewellery

Filesize
60KB

MD5
8af862043b88ab64b0a0a0dab0ee33f7

SHA1
f18c609e3dbd2d4f22e67dddacd2c12d5a57ae80

SHA256
7a3f09215a0188d7637dce287a9149459ef15306fc43ec50333c5a995acfba11

SHA512
fe4423bfd23c6b080cb5136c9b898469c05c76be55d2b174dd0480019ed6f276cf46601b3ebd2a74fd33e6d2360fad4afe80cd15e77d0168f331d1e535222b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Labor

Filesize
83KB

MD5
d72a480a2f826b6439ac99c5dbdb95c0

SHA1
31404610a72c9174da93e4f549ed77f3eabac25b

SHA256
13663ff2a95afdf31f32286234ad7d3980255665c6ed8670d43091c68f26062e

SHA512
f2071ce86e30fe3d6dce3b688e027a8454d3508a9aefa356d334d644acd2b1aca395dc3ce323c836b2e6778fac1c1c0e195a962f189b25884f10ea4e4a07d46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lung

Filesize
55KB

MD5
e2ac62717d8316156140de7c9fec5684

SHA1
22d94c75d7f443aad0fac4bc762d8b082c15d743

SHA256
a7aa95df3c7bab0d3426baaa1a221764335765a780b62c33633fe026a9a78f42

SHA512
a4312c6cb1bda49ae8cfc7dbb400c55461bf1143256f17177e7dcd1dc8423183538d9d3d0fa5c8ffbe19607f53f6badfe4c5c5be05d7043b58603b067f24eaec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plans

Filesize
55KB

MD5
70500245602874c037c1448f38cca944

SHA1
0464deb62a741212ef0fac262b5ecac55c194446

SHA256
fbae97cc27f7c86d11b469575d37e0249cfb9fe0db01c0cbc80352fab424f3b8

SHA512
a2acd2acf52c4f49f5f0b61fd5936e42778ce2e0ce836b159e64bf0451ef643da20cbc9297755c90068a87cf8d7cc83b68ab5321bafa4601ad770c64bfc791e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Receipt

Filesize
98KB

MD5
5379080808d914015ba8d8d72a1a071c

SHA1
43e418ce7d44380a0e92a76073153a3cdc438a67

SHA256
dc38cb4c3bf1d20f5bf7bbbe2e0b1c00917448dc45beaa05472a450e079cfb56

SHA512
4d9a3aa8c155a83ba42cd971a6701ddb23b9806a9adf9d82f66b53c2015e9c94bf30c6b6090e8a002790bcf22de3b5b399dd83dfcb9f85583cce1424eaed6f5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Staying

Filesize
60KB

MD5
d45ecc4516f1848294e70eed4f367ebd

SHA1
8da363e8da388c5e75b0afbc9e89681906614dbd

SHA256
5edc3c47e9e588026ba7892fd53805ff4aac084053121dbd8782710d94fcc492

SHA512
254a73d6b6e0349841f3be6a544b3da0cdace392be8d34e726fc9ac03d64c3cc563bef47004d12614b497cba266722a300a42eb6ccdf7a8fa34bb553ce45de50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Victory

Filesize
58KB

MD5
7b988be6da7644d4d9e0e86933e54da2

SHA1
f7ad251942caf715e524ef6c1b50a43a9eab3a86

SHA256
d513452c3acda65a2392928f739d8e31f600b8a6173726277e8255c1aac61498

SHA512
f00eed92cbface5d916643d3d1999383f894521a544c9ee0eb23f7f2fff3d667cb53e86a2de680a48f41b1b884a5eed613c83ab97d0f00aa7a74381545e3bc53

Download Submit
C:\Users\Admin\AppData\Local\Temp\Youth

Filesize
87KB

MD5
a396d94491be6ce59feaa97ebfb1f612

SHA1
aad5ee91a0a108ad1e3a18c08dd874de67ff5e83

SHA256
f9713c5dacb56f321966719ce247c422a486a520a3fabe2528147bb5c49d9cf7

SHA512
5c204a6f848ee191d1f733bd9af4fc665495382d257d649592fe29f5eaea12295de18e6b7411079f8483b1165a0c95405259afa10eb0c7ee7f3ba5d6f478c988

Download Submit
memory/3896-536-0x0000000004F80000-0x0000000005280000-memory.dmp

Filesize
3.0MB

Download
memory/3896-535-0x0000000004F80000-0x0000000005280000-memory.dmp

Filesize
3.0MB

Download
memory/3896-537-0x0000000004F80000-0x0000000005280000-memory.dmp

Filesize
3.0MB

Download
memory/3896-539-0x0000000004F80000-0x0000000005280000-memory.dmp

Filesize
3.0MB

Download
memory/3896-538-0x0000000004F80000-0x0000000005280000-memory.dmp

Filesize
3.0MB

Download
memory/3896-555-0x0000000004F80000-0x0000000005280000-memory.dmp

Filesize
3.0MB

Download
memory/3896-556-0x0000000004F80000-0x0000000005280000-memory.dmp

Filesize
3.0MB

Download
memory/3896-534-0x0000000004F80000-0x0000000005280000-memory.dmp

Filesize
3.0MB

Download