raccoon | 361411e6321c45c845669ac89e32feec0bdd97916b5d73f508c43576b8a15a20

Analysis

max time kernel
34s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2025, 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample2.exe
Size

871KB
MD5

dd1b734796b4aa40af46b4d69e1e2da2
SHA1

d5273be84dfa0c54fc9cefff7bcc24fed3e20e1c
SHA256

361411e6321c45c845669ac89e32feec0bdd97916b5d73f508c43576b8a15a20
SHA512

2de21b09091caaa2cfca919fb8e5777afb80ff1eba12b81b2f9a6fde3c94aea52f3bba22ad801bae37fb8816fc7e738c54fc2639d8f6cf47e04d4bc0dbd2af56
SSDEEP

12288:iANwRo+mv8QD4+0V165iTr/erjzuQhyACzHDxx/PI11TUeJpIPxSG6zKzxSg564k:iAT8QE+kms0LrSPY/TUeJ4jVzCW1qQa

Score

10^/10

raccoon vidar discovery spyware stealer

Malware Config

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V1 payload 1 IoCs

resource	yara_rule
behavioral1/memory/4636-202-0x0000000000400000-0x00000000032DB000-memory.dmp	family_raccoon_v1

Raccoon family
raccoon
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral1/files/0x00070000000242aa-30.dat	family_vidar

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	sample2.exe

Executes dropped EXE 2 IoCs

pid	Process
4636	wotsuper.exe
4712	wotsuper1.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
3	iplogger.org
4	iplogger.org
23	iplogger.org
24	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	ip-api.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	sample2.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	sample2.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe	sample2.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	sample2.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wotsuper.reg	sample2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wotsuper1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sample2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wotsuper.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wotsuper1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wotsuper1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133866237505116203"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1279544337-3716153908-718418795-1000\{975A0C0C-BDA4-4F22-A341-8541999B1C1A}	msedge.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4816	regedit.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4712	wotsuper1.exe
4712	wotsuper1.exe
4712	wotsuper1.exe
4712	wotsuper1.exe
4712	wotsuper1.exe
4712	wotsuper1.exe
4712	wotsuper1.exe
4712	wotsuper1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 1552	2620	sample2.exe	89
PID 2620 wrote to memory of 1552	2620	sample2.exe	89
PID 2620 wrote to memory of 4636	2620	sample2.exe	90
PID 2620 wrote to memory of 4636	2620	sample2.exe	90
PID 2620 wrote to memory of 4636	2620	sample2.exe	90
PID 1552 wrote to memory of 4676	1552	msedge.exe	91
PID 1552 wrote to memory of 4676	1552	msedge.exe	91
PID 2620 wrote to memory of 4712	2620	sample2.exe	92
PID 2620 wrote to memory of 4712	2620	sample2.exe	92
PID 2620 wrote to memory of 4712	2620	sample2.exe	92
PID 2620 wrote to memory of 4816	2620	sample2.exe	93
PID 2620 wrote to memory of 4816	2620	sample2.exe	93
PID 2620 wrote to memory of 4816	2620	sample2.exe	93
PID 2620 wrote to memory of 5436	2620	sample2.exe	94
PID 2620 wrote to memory of 5436	2620	sample2.exe	94
PID 1552 wrote to memory of 4896	1552	msedge.exe	95
PID 1552 wrote to memory of 4896	1552	msedge.exe	95
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 5280	1552	msedge.exe	96
PID 1552 wrote to memory of 5280	1552	msedge.exe	96
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97
PID 1552 wrote to memory of 4936	1552	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\sample2.exe
"C:\Users\Admin\AppData\Local\Temp\sample2.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1Ldta7.html
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ff9a4b4f208,0x7ff9a4b4f214,0x7ff9a4b4f220
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1792,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:3
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2632,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:2
    3⤵
    PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2216,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3504,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3524,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4360,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:1252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4980,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4976,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:5360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5732,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
    3⤵
    PID:244
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5804,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
    3⤵
    PID:1700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5812,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=704 /prefetch:8
    3⤵
    PID:2720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5972,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6216,i,4796841722640543668,4467090444739251356,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
    3⤵
    PID:5652
- C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
  "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4636
- C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
  "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1smEq7.html
  2⤵
  PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe

Filesize
449KB

MD5
7b20f5c61780fe383f45ca6e18ed5a6a

SHA1
bc9bfd59f0cde312cd9a0d20784887fed9b8c836

SHA256
26ccbcb079b3f0cc183293351c40da3146d2ddec9b4d6cd314090cfab94834df

SHA512
8a63f6ad20fe18bd49d055ae05bc81fe30d0ebfb25a37428b17b43569b53bf2560f0de8f993f62a2f5d458db78e6d24ad71fca8d7fd1133d3cb499dff356e68b

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe

Filesize
544KB

MD5
b8181cb72764c24e73c7b6204b16bed6

SHA1
c430cc4776ff5e21d08bca9a0d73cfaf29108fa4

SHA256
fdb5a0d4e97ee36d2b23605b0d8a2785d08d046058f07a8714e4908e8a2485a2

SHA512
bd63970b846bfdc6990b803e12028c692bc3f3125df03c3b9ec4626e1ce56dc43313d37c71337868ade0e4da31a5eca971b453242829b7312eb7efd2a407de1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
998db8a9f40f71e2f3d9e19aac4db4a9

SHA1
dade0e68faef54a59d68ae8cb3b8314b6947b6d7

SHA256
1b28744565eb600485d9800703f2fb635ecf4187036c12d47f86bbd1e078e06b

SHA512
0e66fd26a11507f78fb1b173fd50555dbd95b0d330e095cdd93206757c6af2780ece914a11a23cd4c840636a59470f44c6db35fa392303fb583806264e652016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
0a628a11826de8b04d43df7227404119

SHA1
e94271a6ee2ab5ee59bd96c80651feefd84aa565

SHA256
3f58631cc0bd6dd6a1f147f5f96c47538b199cd65d3ebb02aac53e916e049053

SHA512
4aea74778ca206cab87acffaefd2d5f0e9ecad679d4d4d911c0db4051942b0dee71845b55922bd3dfd91784760495e6c27370630396e90ed508145e7a724715a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
e78ea371067ce0c912eef91d3e3878e0

SHA1
7c30bf825c042edd1239608ae053dc6ff3129dd0

SHA256
4883e721652765de5d8f3978c03c2c95ebc1d67ed28a7236104d8893e368db82

SHA512
e19116099e95ef2380504d2551f06a163621df2b1c91b9f15087ee06520cb3e0c16622a1f37b16312b05ded250b881be485a0dba97e058774feba490f4dc526b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
c2115f1d19e877eaf04ea8e6b7d4b32b

SHA1
57133e6dd3f52b52378336a3541c2e21f0f45af4

SHA256
c8a37e8b1446c304bb3d1dd258eab00cde69437c3385fc5096c50d02994c39aa

SHA512
9dd491238811490bf40fb8b9619dd9d7c4d22cae3a0ec89d7950e28294c9d3eb70589dfa5eeefc73da30ae7413eb0ae6b19c1a574c304fe3dedcebc141a33673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
126347caa6465a4f3023d1b816832c91

SHA1
c30eedd33eefbb24c8ff5096ab43c9e100d1f800

SHA256
f3e49b7247e348190840a679554462972c4c834f58a28de979f01e18aee061af

SHA512
e8ed8facd8c17d8e714d3c63580533ded6636a501d060862c986aab0acc7848d2e85b7f8ccf842d3d0651bec3c632e900974acae7fdf7e15c8146d5c3d11b7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
5688feed38748b21f92f3c5b8649ad3f

SHA1
81e77673b66a5a1dd582f5413878acfe40efb9a9

SHA256
03941c742ae35f2b242593fe54659ef84e3fc21abb2f5b5d663eba15cf61bcb0

SHA512
ad53cbbf11b929f79df9d292af268c1d5d4133a8991ad32f3fec04addedc646d0b4c6e762ee3fd5e4d10abea915f0f4aaa3ef3a4bdd7141339e5310a3a700a26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
cd88f4fc2bc2c91eaee86febdc2ee763

SHA1
1a28b6ea6c628d5b52082856ab777e10b5891181

SHA256
2b47959342a5face857544c3ed2f75be2a99062ef320e9233974ab240b0612cb

SHA512
e2afb3d5ef1cc6b2c0ba5127fe2112652cd8108861da55dbda946449816804a3df7265070b7edf629d29470f4a5aae4067b8d09784abf1c1be20258d43035795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
147d036c3b7c57ba35ad37bad0b5c43a

SHA1
228b4f466aee94f94f8363d44aab2cdabd469a4e

SHA256
79596dd5ea87c6bc4cfe87878177925f09061f227fc2b79012bca0d1cfc0964b

SHA512
f5f8b2beb08b3b59a76cc2e982929812fcc6b9207caf7013098dca297310ee48d9d553827c42c6ad4265e6430137913448d85845dad2f923b7aa1f26fd453290

Download Submit
memory/2620-42-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4636-202-0x0000000000400000-0x00000000032DB000-memory.dmp

Filesize
46.9MB

Download