Malware Analysis Report

2024-09-11 16:18

Sample ID 240618-x451dayhmk
Target ^@l@tEst_SetUp_2025__P@ssCodE@^.zip
SHA256 83c0c6ee5015ea0fef17e099e4b8f4ab923009349b6a0571a7fa1cc2502cc8f5
Tags
stealc vidar stealer discovery spyware amadey xmrig ffb1b9 miner trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

83c0c6ee5015ea0fef17e099e4b8f4ab923009349b6a0571a7fa1cc2502cc8f5

Threat Level: Known bad

The file ^@l@tEst_SetUp_2025__P@ssCodE@^.zip was found to be: Known bad.

Malicious Activity Summary

stealc vidar stealer discovery spyware amadey xmrig ffb1b9 miner trojan upx

Amadey

Vidar

Stealc

Detect Vidar Stealer

xmrig

XMRig Miner payload

UPX packed file

Loads dropped DLL

Checks computer location settings

Reads data files stored by FTP clients

Executes dropped EXE

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Drops file in Windows directory

Program crash

Enumerates physical storage devices

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Delays execution with timeout.exe

Checks processor information in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-18 19:25

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 19:25

Reported

2024-06-18 19:27

Platform

win7-20240508-en

Max time kernel

118s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2060 set thread context of 2896 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\CUF.au3

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 2060 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 2060 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 2060 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 2060 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 2896 wrote to memory of 2652 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2896 wrote to memory of 2652 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2896 wrote to memory of 2652 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2896 wrote to memory of 2652 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2896 wrote to memory of 2652 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2896 wrote to memory of 2652 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2652 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2652 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2652 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2652 wrote to memory of 2620 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe"

C:\Windows\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2652 -s 148

Network

N/A

Files

memory/2060-0-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2060-1-0x0000000077AF0000-0x0000000077C99000-memory.dmp

memory/2060-5-0x0000000074DD2000-0x0000000074DD4000-memory.dmp

memory/2060-6-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2060-7-0x0000000074DC0000-0x0000000074F34000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\be47b731

MD5 ee28f2d945331184b6a4b6695d7f6de7
SHA1 bf4fd2bdc28673d6b8ef1381cb76f403e316f97c
SHA256 a3104fb9b689eb90db0e9e6ab067ddee577150670ea042d733d40b23aaab410e
SHA512 d49281f2c387d7fb7847ff7ab780787ebb053340d4d44ec8533fc2379edbf655a751decbcd4420691d58b7382434cac23b823ca00281fcbf895ed5eca6e48525

memory/2896-10-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2896-11-0x0000000077AF0000-0x0000000077C99000-memory.dmp

memory/2896-13-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2896-14-0x0000000074DC0000-0x0000000074F34000-memory.dmp

\Users\Admin\AppData\Local\Temp\CUF.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2652-20-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2652-19-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2896-21-0x0000000074DC0000-0x0000000074F34000-memory.dmp

memory/2652-23-0x0000000000750000-0x0000000000E9C000-memory.dmp

memory/2652-30-0x0000000000750000-0x0000000000E9C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 19:25

Reported

2024-06-18 19:27

Platform

win10v2004-20240508-en

Max time kernel

51s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1988 set thread context of 512 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 1988 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 1988 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 1988 wrote to memory of 512 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 512 wrote to memory of 3040 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 512 wrote to memory of 3040 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 512 wrote to memory of 3040 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 512 wrote to memory of 3040 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 512 wrote to memory of 3040 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 3040 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 3040 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 2408 wrote to memory of 4932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2408 wrote to memory of 4932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2408 wrote to memory of 4932 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe

Processes

C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe"

C:\Windows\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\CUF.au3" & rd /s /q "C:\ProgramData\CBAKFCBFHJDH" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 poocoin.online udp
US 8.8.8.8:53 t.me udp
US 8.8.8.8:53 steamcommunity.com udp

Files

memory/1988-0-0x0000000074A00000-0x0000000074B7B000-memory.dmp

memory/1988-1-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/1988-5-0x0000000074A12000-0x0000000074A14000-memory.dmp

memory/1988-6-0x0000000074A00000-0x0000000074B7B000-memory.dmp

memory/1988-7-0x0000000074A00000-0x0000000074B7B000-memory.dmp

memory/512-9-0x0000000074A00000-0x0000000074B7B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9ab7d63f

MD5 9f943d9026079c8de2f1e76ea3c7f3bf
SHA1 a5dc5df177e382e2590c830c4f3ddf59a603aec2
SHA256 56217a3109d08038c2e31f366c194e2a4f66c43f92995bcc1e6f38a2a7b0120c
SHA512 602b8b122969dd3b3a1610e631cce120409e02e27e74d20b0459bd6731b36d62cdf059bcdc2940f93914580143af186d6fc49a90daec3ef6538ff0577b72b7f9

memory/512-11-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/512-13-0x0000000074A00000-0x0000000074B7B000-memory.dmp

memory/512-15-0x0000000074A00000-0x0000000074B7B000-memory.dmp

memory/512-19-0x0000000074A00000-0x0000000074B7B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CUF.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/3040-21-0x00000000014C0000-0x0000000001C0C000-memory.dmp

memory/3040-23-0x00007FFE4F5B0000-0x00007FFE4F7A5000-memory.dmp

memory/3040-24-0x00000000014C0000-0x0000000001C0C000-memory.dmp

memory/3040-26-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/3040-44-0x00000000014C0000-0x0000000001C0C000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-18 19:25

Reported

2024-06-18 19:27

Platform

win11-20240611-en

Max time kernel

118s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe"

Signatures

Amadey

trojan amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\IJDGIIEBFC.exe N/A
N/A N/A C:\ProgramData\DBKKFHIEGD.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2800 set thread context of 4960 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 2956 set thread context of 1044 N/A C:\ProgramData\IJDGIIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 2224 set thread context of 1964 N/A C:\ProgramData\DBKKFHIEGD.exe C:\Windows\SysWOW64\ftp.exe
PID 1964 set thread context of 3600 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3600 set thread context of 2168 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\TWI Cloud Host.job C:\Windows\SysWOW64\ftp.exe N/A
File created C:\Windows\Tasks\Watcher Com SH.job C:\Windows\SysWOW64\ftp.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\ProgramData\IJDGIIEBFC.exe N/A
N/A N/A C:\ProgramData\DBKKFHIEGD.exe N/A
N/A N/A C:\ProgramData\IJDGIIEBFC.exe N/A
N/A N/A C:\ProgramData\DBKKFHIEGD.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\ProgramData\IJDGIIEBFC.exe N/A
N/A N/A C:\ProgramData\DBKKFHIEGD.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2800 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 2800 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 2800 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 2800 wrote to memory of 4960 N/A C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe C:\Windows\SysWOW64\more.com
PID 4960 wrote to memory of 4608 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 4960 wrote to memory of 4608 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 4960 wrote to memory of 4608 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 4960 wrote to memory of 4608 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 4960 wrote to memory of 4608 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 4608 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\IJDGIIEBFC.exe
PID 4608 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\IJDGIIEBFC.exe
PID 4608 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\IJDGIIEBFC.exe
PID 4608 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\DBKKFHIEGD.exe
PID 4608 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\DBKKFHIEGD.exe
PID 4608 wrote to memory of 2224 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\DBKKFHIEGD.exe
PID 2956 wrote to memory of 1044 N/A C:\ProgramData\IJDGIIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 2956 wrote to memory of 1044 N/A C:\ProgramData\IJDGIIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 2956 wrote to memory of 1044 N/A C:\ProgramData\IJDGIIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 2224 wrote to memory of 1964 N/A C:\ProgramData\DBKKFHIEGD.exe C:\Windows\SysWOW64\ftp.exe
PID 2224 wrote to memory of 1964 N/A C:\ProgramData\DBKKFHIEGD.exe C:\Windows\SysWOW64\ftp.exe
PID 2224 wrote to memory of 1964 N/A C:\ProgramData\DBKKFHIEGD.exe C:\Windows\SysWOW64\ftp.exe
PID 4608 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 4608 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 4608 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 1300 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1300 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1300 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 2956 wrote to memory of 1044 N/A C:\ProgramData\IJDGIIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 2224 wrote to memory of 1964 N/A C:\ProgramData\DBKKFHIEGD.exe C:\Windows\SysWOW64\ftp.exe
PID 1964 wrote to memory of 3600 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1964 wrote to memory of 3600 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1044 wrote to memory of 3540 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 1044 wrote to memory of 3540 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 1044 wrote to memory of 3540 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 1964 wrote to memory of 3600 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1964 wrote to memory of 3600 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1044 wrote to memory of 3540 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3600 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3600 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3600 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3600 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3600 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3600 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3600 wrote to memory of 2168 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Processes

C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\^@l@tEst_SetUp_2025__P@ssCodE@^\Setup.exe"

C:\Windows\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\ProgramData\IJDGIIEBFC.exe

"C:\ProgramData\IJDGIIEBFC.exe"

C:\ProgramData\DBKKFHIEGD.exe

"C:\ProgramData\DBKKFHIEGD.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FIIEGDBAEBFI" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

Network

Country Destination Domain Proto
US 8.8.8.8:53 poocoin.online udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.249.124.192.in-addr.arpa udp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 172.67.212.123:443 businessdownloads.ltd tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 199.232.196.193:443 i.imgur.com tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
IE 52.111.236.22:443 tcp
FI 135.181.22.88:80 135.181.22.88 tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp

Files

memory/2800-0-0x0000000073FC0000-0x000000007413D000-memory.dmp

memory/2800-1-0x00007FFF38340000-0x00007FFF38549000-memory.dmp

memory/2800-5-0x0000000073FD2000-0x0000000073FD4000-memory.dmp

memory/2800-6-0x0000000073FC0000-0x000000007413D000-memory.dmp

memory/2800-7-0x0000000073FC0000-0x000000007413D000-memory.dmp

memory/4960-9-0x0000000073FC0000-0x000000007413D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\80127846

MD5 fccb792a4456eb60e76f3f37277fa8a0
SHA1 47c47c57f3a6f96ca90f358aa9ca26184081f4bc
SHA256 5ee4a394d2a002443b8cb275da1a190ec5bb0e515ae1a93f6bb9818594ecf179
SHA512 5fde71ce9af80b6e2f1a86e7f9609154031bbee82a5f81045369df5577c84250689c5446eb99b969a0beabaea994045fe3b4805490c1ea793407388008a1d106

memory/4960-11-0x00007FFF38340000-0x00007FFF38549000-memory.dmp

memory/4960-14-0x0000000073FC0000-0x000000007413D000-memory.dmp

memory/4960-13-0x0000000073FC0000-0x000000007413D000-memory.dmp

memory/4960-19-0x0000000073FC0000-0x000000007413D000-memory.dmp

memory/4608-21-0x0000000001260000-0x00000000019AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CUF.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/4608-23-0x00007FFF38340000-0x00007FFF38549000-memory.dmp

memory/4608-35-0x0000000061E00000-0x0000000061EF3000-memory.dmp

memory/4608-54-0x0000000001260000-0x00000000019AC000-memory.dmp

C:\ProgramData\FIIEGDBAEBFI\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\FIIEGDBAEBFI\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

C:\ProgramData\IJDGIIEBFC.exe

MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/2956-123-0x0000000000640000-0x0000000000B53000-memory.dmp

C:\ProgramData\DBKKFHIEGD.exe

MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/2224-138-0x00000000007D0000-0x0000000000A18000-memory.dmp

memory/2956-144-0x00000000721D0000-0x000000007234D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4f0338c9

MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/2956-145-0x00007FFF38340000-0x00007FFF38549000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\50143596

MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/2224-147-0x00000000721D0000-0x000000007234D000-memory.dmp

memory/2224-148-0x00007FFF38340000-0x00007FFF38549000-memory.dmp

memory/4608-170-0x0000000001260000-0x00000000019AC000-memory.dmp

C:\ProgramData\FIIEGDBAEBFI\FIIEGD

MD5 59071590099d21dd439896592338bf95
SHA1 6a521e1d2a632c26e53b83d2cc4b0edecfc1e68c
SHA256 07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541
SHA512 eedb6cadbceb2c991fc6f68dccb80463b3f660c5358acd7d705398ae2e3df2b4327f0f6c6746486848bd2992b379776483a98063ae96edb45877bb0314874668

memory/4608-183-0x0000000001260000-0x00000000019AC000-memory.dmp

C:\ProgramData\FIIEGDBAEBFI\CGCFBF

MD5 66e318fc11ba739995fcafa51122310e
SHA1 64316c44931b1ad011e9ae3479f3423a879416eb
SHA256 4dea47e2a0c0540ff04b47725864e5ce990c0af2bdb1f243dded4287cee0eec8
SHA512 24b0cd4889df58d77dc9b28c9c6fdf3bbf80b5ee0c4925e3455dac05179b1e0e675e3c22abcb2eb7e11fc81cee65e4d633253dee1d8632ca5d3357d2f17f8794

C:\ProgramData\FIIEGDBAEBFI\ECBGCG

MD5 04ee85098c13ccbb0dfaaf910e3f79f5
SHA1 7011925629e9e301d7e428486c9c3e81237157c3
SHA256 f4726ca1f84b909bc9675a62fe09426532f9040cebdd8711640e1e952e55f2db
SHA512 dc774020727cdb90f751035169aa87513e21395f3a146143d0ea513801900cc8f54bbebfd752bbf16f6f0275612ffae4a53f4a5e20668dd4f33d4d02b1e213f8

memory/4608-203-0x0000000001260000-0x00000000019AC000-memory.dmp

memory/2956-204-0x00000000721D0000-0x000000007234D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\51a7d026

MD5 0e3ef8958f4264b404fd063f2f9b9b90
SHA1 a985b402b0bb12e1f2beb4bbde7b5d750f186169
SHA256 cd321700da0ef0b96597403df282fbf32279163d46eaec7bdfeeccfc9ba84d6c
SHA512 845a2b69d45d08abd83a45d2a44b2105efc960d0e1a469f77774a7afeb674bc7f36560bce235e17e3eb64f17be961c0835b462fe7552693a27aea38616610c8e

memory/2224-207-0x00000000721D0000-0x000000007234D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\537f0a82

MD5 36fd5c8c0e787fd9e50892a2d08fe625
SHA1 f8fdc6b56b7d024f435bdf62433857232083ae8b
SHA256 c95f6f2fe01e2badf48e12ce039a3681af9229b1dc4f4100f9d508709ad27e5b
SHA512 9fa3d2b7273883d4963df1cf8d91f3a6597ca914d73e6e5811212c9a0e9a2ba976331fe6b04fe266879c15e03c32cfd887de5a76e9596c4dafb565bbf456d625

memory/1044-210-0x00007FFF38340000-0x00007FFF38549000-memory.dmp

memory/1964-211-0x00007FFF38340000-0x00007FFF38549000-memory.dmp

C:\ProgramData\FIIEGDBAEBFI\VCRUNT~1.DLL

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\FIIEGDBAEBFI\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\FIIEGDBAEBFI\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/1964-217-0x00000000721D0000-0x000000007234D000-memory.dmp

memory/1964-227-0x00000000721D0000-0x000000007234D000-memory.dmp

memory/3600-230-0x00007FFF16130000-0x00007FFF177D0000-memory.dmp

memory/3600-234-0x0000000000400000-0x000000000040A000-memory.dmp

memory/3540-235-0x00007FFF38340000-0x00007FFF38549000-memory.dmp

memory/3540-239-0x0000000000F40000-0x0000000000FB1000-memory.dmp

memory/2168-240-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2168-242-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2168-244-0x00000271BFE10000-0x00000271BFE30000-memory.dmp

memory/2168-243-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2168-246-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2168-248-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2168-247-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2168-245-0x0000000140000000-0x00000001407DC000-memory.dmp