Malware Analysis Report

2024-09-11 16:19

Sample ID 240618-xpe6eavcjc
Target files.zip
SHA256 6a136a7426b8770d8664cc9e508c093bf597231738e853f21e597dac99534bf3
Tags
stealc vidar stealer amadey xmrig ffb1b9 discovery miner spyware trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6a136a7426b8770d8664cc9e508c093bf597231738e853f21e597dac99534bf3

Threat Level: Known bad

The file files.zip was found to be: Known bad.

Malicious Activity Summary

stealc vidar stealer amadey xmrig ffb1b9 discovery miner spyware trojan upx

Vidar

Stealc

Amadey

Detect Vidar Stealer

xmrig

XMRig Miner payload

Downloads MZ/PE file

UPX packed file

Reads user/profile data of web browsers

Checks computer location settings

Reads data files stored by FTP clients

Loads dropped DLL

Executes dropped EXE

Reads user/profile data of local email clients

Checks installed software on the system

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Delays execution with timeout.exe

Modifies system certificate store

Suspicious use of WriteProcessMemory

Checks processor information in registry

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Subvert Trust Controls
T1553
Install Root Certificate
T1553.004
Modify Registry
T1112
Credential Access
TA0006
Unsecured Credentials
T1552
Credentials In Files
T1552.001
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-18 19:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 19:01

Reported

2024-06-18 19:07

Platform

win7-20231129-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

Signatures

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2212 set thread context of 2808 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\CUF.au3

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2212 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 2212 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 2212 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 2212 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 2212 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 2808 wrote to memory of 2616 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2808 wrote to memory of 2616 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2808 wrote to memory of 2616 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2808 wrote to memory of 2616 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2808 wrote to memory of 2616 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2808 wrote to memory of 2616 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 2616 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2616 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2616 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\WerFault.exe
PID 2616 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\files\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

C:\Windows\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 148

Network

N/A

Files

memory/2212-0-0x00000000745D0000-0x0000000074744000-memory.dmp

memory/2212-1-0x0000000077240000-0x00000000773E9000-memory.dmp

memory/2212-5-0x00000000745E2000-0x00000000745E4000-memory.dmp

memory/2212-6-0x00000000745D0000-0x0000000074744000-memory.dmp

memory/2212-7-0x00000000745D0000-0x0000000074744000-memory.dmp

memory/2808-9-0x00000000745D0000-0x0000000074744000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\861b29a8

MD5 2e5b1c586d28f9065c6e1d585090d134
SHA1 0e07e2d4b14f93fc41a1cd495aed2e7724df072e
SHA256 deace6c00f1c349044df8f0c7af8d2331d6e2b06f731025957835b011a60ff48
SHA512 35bea01ccf704842e4ee30d180747132e10e78524f7bf3a46e7235f5a0fc79a972d81432e2a68142ec9b83a96e285c0fae3bf10345cfa5ceb15cd714f06d8d2d

memory/2808-11-0x0000000077240000-0x00000000773E9000-memory.dmp

memory/2808-13-0x00000000745D0000-0x0000000074744000-memory.dmp

memory/2808-14-0x00000000745D0000-0x0000000074744000-memory.dmp

\Users\Admin\AppData\Local\Temp\CUF.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/2616-20-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2616-19-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

memory/2808-21-0x00000000745D0000-0x0000000074744000-memory.dmp

memory/2616-23-0x00000000006D0000-0x0000000000E1C000-memory.dmp

memory/2616-30-0x00000000006D0000-0x0000000000E1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 19:01

Reported

2024-06-18 19:07

Platform

win10v2004-20240611-en

Max time kernel

117s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

Signatures

Amadey

trojan amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Downloads MZ/PE file

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\FIDAFIEBFC.exe N/A
N/A N/A C:\ProgramData\DAAECAFHDB.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2564 set thread context of 220 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 4492 set thread context of 812 N/A C:\ProgramData\FIDAFIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 3300 set thread context of 1988 N/A C:\ProgramData\DAAECAFHDB.exe C:\Windows\SysWOW64\ftp.exe
PID 1988 set thread context of 3448 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3448 set thread context of 2920 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\TWI Cloud Host.job C:\Windows\SysWOW64\ftp.exe N/A
File created C:\Windows\Tasks\Watcher Com SH.job C:\Windows\SysWOW64\ftp.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\ProgramData\FIDAFIEBFC.exe N/A
N/A N/A C:\ProgramData\FIDAFIEBFC.exe N/A
N/A N/A C:\ProgramData\DAAECAFHDB.exe N/A
N/A N/A C:\ProgramData\DAAECAFHDB.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\ProgramData\FIDAFIEBFC.exe N/A
N/A N/A C:\ProgramData\DAAECAFHDB.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2564 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 2564 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 2564 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 2564 wrote to memory of 220 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 220 wrote to memory of 4580 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 220 wrote to memory of 4580 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 220 wrote to memory of 4580 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 220 wrote to memory of 4580 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 220 wrote to memory of 4580 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 4580 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\FIDAFIEBFC.exe
PID 4580 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\FIDAFIEBFC.exe
PID 4580 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\FIDAFIEBFC.exe
PID 4492 wrote to memory of 812 N/A C:\ProgramData\FIDAFIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 4492 wrote to memory of 812 N/A C:\ProgramData\FIDAFIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 4492 wrote to memory of 812 N/A C:\ProgramData\FIDAFIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 4580 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\DAAECAFHDB.exe
PID 4580 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\DAAECAFHDB.exe
PID 4580 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\DAAECAFHDB.exe
PID 3300 wrote to memory of 1988 N/A C:\ProgramData\DAAECAFHDB.exe C:\Windows\SysWOW64\ftp.exe
PID 3300 wrote to memory of 1988 N/A C:\ProgramData\DAAECAFHDB.exe C:\Windows\SysWOW64\ftp.exe
PID 3300 wrote to memory of 1988 N/A C:\ProgramData\DAAECAFHDB.exe C:\Windows\SysWOW64\ftp.exe
PID 4492 wrote to memory of 812 N/A C:\ProgramData\FIDAFIEBFC.exe C:\Windows\SysWOW64\ftp.exe
PID 3300 wrote to memory of 1988 N/A C:\ProgramData\DAAECAFHDB.exe C:\Windows\SysWOW64\ftp.exe
PID 4580 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 4580 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 4924 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4924 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4924 wrote to memory of 2400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 1988 wrote to memory of 3448 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1988 wrote to memory of 3448 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 812 wrote to memory of 1932 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 812 wrote to memory of 1932 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 812 wrote to memory of 1932 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 1988 wrote to memory of 3448 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 1988 wrote to memory of 3448 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 812 wrote to memory of 1932 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3448 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3448 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3448 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3448 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3448 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3448 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3448 wrote to memory of 2920 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Processes

C:\Users\Admin\AppData\Local\Temp\files\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

C:\Windows\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\ProgramData\FIDAFIEBFC.exe

"C:\ProgramData\FIDAFIEBFC.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\ProgramData\DAAECAFHDB.exe

"C:\ProgramData\DAAECAFHDB.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KFHJJJKKFHID" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 poocoin.online udp
US 8.8.8.8:53 t.me udp
NL 149.154.167.99:443 t.me tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 8.8.8.8:53 18.53.55.162.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 8.8.8.8:53 24.121.18.2.in-addr.arpa udp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 8.8.8.8:53 businessdownloads.ltd udp
US 172.67.212.123:443 businessdownloads.ltd tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 123.212.67.172.in-addr.arpa udp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 8.8.8.8:53 i.imgur.com udp
US 199.232.192.193:443 i.imgur.com tcp
US 8.8.8.8:53 193.192.232.199.in-addr.arpa udp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
FI 135.181.22.88:80 135.181.22.88 tcp
US 8.8.8.8:53 88.22.181.135.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 proresupdate.com udp
US 45.152.112.146:80 proresupdate.com tcp
US 8.8.8.8:53 146.112.152.45.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
FI 65.109.127.181:3333 tcp

Files

memory/2564-0-0x0000000074E10000-0x0000000074F8B000-memory.dmp

memory/2564-1-0x00007FFB5ACB0000-0x00007FFB5AEA5000-memory.dmp

memory/2564-5-0x0000000074E22000-0x0000000074E24000-memory.dmp

memory/2564-6-0x0000000074E10000-0x0000000074F8B000-memory.dmp

memory/2564-7-0x0000000074E10000-0x0000000074F8B000-memory.dmp

memory/220-9-0x0000000074E10000-0x0000000074F8B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8871223c

MD5 563b542b50a180c8bd18f4db3b028f9c
SHA1 1266afc80559228f510b45231b74bc5dc2ee9cfa
SHA256 f526a0e42d6e3236b7661ab25747b67aeb145b903119a6131be914b438417a2f
SHA512 9656aecbca2ba5461c6aa767271dc6045308cf786bade1819adec61e8697a1340eed158f5b16a050d69b58bc6996059bf1c14239d0604075d5dd0880db581543

memory/220-11-0x00007FFB5ACB0000-0x00007FFB5AEA5000-memory.dmp

memory/220-13-0x0000000074E10000-0x0000000074F8B000-memory.dmp

memory/220-14-0x0000000074E10000-0x0000000074F8B000-memory.dmp

memory/220-19-0x0000000074E10000-0x0000000074F8B000-memory.dmp

memory/4580-21-0x0000000001200000-0x000000000194C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CUF.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/4580-23-0x00007FFB5ACB0000-0x00007FFB5AEA5000-memory.dmp

memory/4580-24-0x0000000001200000-0x000000000194C000-memory.dmp

memory/4580-25-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\KFHJJJKKFHID\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\KFHJJJKKFHID\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/4580-96-0x0000000001200000-0x000000000194C000-memory.dmp

C:\ProgramData\FIDAFIEBFC.exe

MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/4492-113-0x0000000000580000-0x0000000000A93000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\883e95b5

MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/4492-119-0x0000000072D70000-0x0000000072EEB000-memory.dmp

memory/4492-120-0x00007FFB5ACB0000-0x00007FFB5AEA5000-memory.dmp

C:\ProgramData\DAAECAFHDB.exe

MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/3300-131-0x00000000009F0000-0x0000000000C38000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8c62cda9

MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/3300-137-0x0000000072D70000-0x0000000072EEB000-memory.dmp

memory/3300-138-0x00007FFB5ACB0000-0x00007FFB5AEA5000-memory.dmp

memory/4580-142-0x0000000001200000-0x000000000194C000-memory.dmp

memory/4580-143-0x0000000001200000-0x000000000194C000-memory.dmp

memory/4492-144-0x0000000072D70000-0x0000000072EEB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8a25845c

MD5 6aed97643dadba7d15a2084a917cbf83
SHA1 efea9a6488a7320b28e89719374d0e8d737716c9
SHA256 9842d1f2f4421f4154b2bea6876e12274cd95ef964043d15cd23b917376ebe39
SHA512 d1f482c0144b676b6eecb13f47e526da18ab4cc4d528b974cdd67d3b7d3383b21a299f524a599d9815e4f6f36c938cf99721ba2c0074b4d1e09a1e021029044c

memory/3300-147-0x0000000072D70000-0x0000000072EEB000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8ea1baa5

MD5 ce7ca7a09acee45af4ab0fa3b78ce40d
SHA1 f28152f519a43998b59b3278003363e3f4d65f6c
SHA256 5820ed1eb49335f13245289079036369363bb91f85b8d6a514c4ee1c7b033a5b
SHA512 48164d34453c2770b3d981cfa9fe7b453810c95fc49995c5e148d34fe69d41d50bc5f81b45a50568df7846d1e951059dd79d9aaa03bae6bb568dcd521567520d

memory/4580-158-0x0000000001200000-0x000000000194C000-memory.dmp

memory/812-159-0x00007FFB5ACB0000-0x00007FFB5AEA5000-memory.dmp

memory/1988-160-0x00007FFB5ACB0000-0x00007FFB5AEA5000-memory.dmp

memory/1988-161-0x0000000072D70000-0x0000000072EEB000-memory.dmp

C:\ProgramData\KFHJJJKKFHID\VCRUNT~1.DLL

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\KFHJJJKKFHID\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\KFHJJJKKFHID\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/1988-176-0x0000000072D70000-0x0000000072EEB000-memory.dmp

memory/3448-179-0x00007FFB3B2E0000-0x00007FFB3C957000-memory.dmp

memory/3448-183-0x0000000000400000-0x000000000040A000-memory.dmp

memory/1932-184-0x00007FFB5ACB0000-0x00007FFB5AEA5000-memory.dmp

memory/1932-185-0x0000000000310000-0x0000000000381000-memory.dmp

memory/2920-189-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2920-191-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2920-192-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2920-193-0x000001D1365F0000-0x000001D136610000-memory.dmp

memory/2920-195-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/2920-194-0x0000000140000000-0x00000001407DC000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-18 19:01

Reported

2024-06-18 19:07

Platform

win11-20240611-en

Max time kernel

118s

Max time network

116s

Command Line

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

Signatures

Amadey

trojan amadey

Detect Vidar Stealer

stealer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Stealc

stealer stealc

Vidar

stealer vidar

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\KKJKFBKKEC.exe N/A
N/A N/A C:\ProgramData\EHCGIJDHDG.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4160 set thread context of 1176 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 2368 set thread context of 4748 N/A C:\ProgramData\KKJKFBKKEC.exe C:\Windows\SysWOW64\ftp.exe
PID 4324 set thread context of 3084 N/A C:\ProgramData\EHCGIJDHDG.exe C:\Windows\SysWOW64\ftp.exe
PID 3084 set thread context of 3516 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3516 set thread context of 936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\Watcher Com SH.job C:\Windows\SysWOW64\ftp.exe N/A
File created C:\Windows\Tasks\TWI Cloud Host.job C:\Windows\SysWOW64\ftp.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Delays execution with timeout.exe

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\timeout.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\ProgramData\KKJKFBKKEC.exe N/A
N/A N/A C:\ProgramData\KKJKFBKKEC.exe N/A
N/A N/A C:\ProgramData\EHCGIJDHDG.exe N/A
N/A N/A C:\ProgramData\EHCGIJDHDG.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\more.com N/A
N/A N/A C:\ProgramData\KKJKFBKKEC.exe N/A
N/A N/A C:\ProgramData\EHCGIJDHDG.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A
N/A N/A C:\Windows\SysWOW64\ftp.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4160 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 4160 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 4160 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 4160 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\files\Setup.exe C:\Windows\SysWOW64\more.com
PID 1176 wrote to memory of 3024 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 1176 wrote to memory of 3024 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 1176 wrote to memory of 3024 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 1176 wrote to memory of 3024 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 1176 wrote to memory of 3024 N/A C:\Windows\SysWOW64\more.com C:\Users\Admin\AppData\Local\Temp\CUF.au3
PID 3024 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\KKJKFBKKEC.exe
PID 3024 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\KKJKFBKKEC.exe
PID 3024 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\KKJKFBKKEC.exe
PID 2368 wrote to memory of 4748 N/A C:\ProgramData\KKJKFBKKEC.exe C:\Windows\SysWOW64\ftp.exe
PID 2368 wrote to memory of 4748 N/A C:\ProgramData\KKJKFBKKEC.exe C:\Windows\SysWOW64\ftp.exe
PID 2368 wrote to memory of 4748 N/A C:\ProgramData\KKJKFBKKEC.exe C:\Windows\SysWOW64\ftp.exe
PID 3024 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\EHCGIJDHDG.exe
PID 3024 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\EHCGIJDHDG.exe
PID 3024 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\ProgramData\EHCGIJDHDG.exe
PID 4324 wrote to memory of 3084 N/A C:\ProgramData\EHCGIJDHDG.exe C:\Windows\SysWOW64\ftp.exe
PID 4324 wrote to memory of 3084 N/A C:\ProgramData\EHCGIJDHDG.exe C:\Windows\SysWOW64\ftp.exe
PID 4324 wrote to memory of 3084 N/A C:\ProgramData\EHCGIJDHDG.exe C:\Windows\SysWOW64\ftp.exe
PID 2368 wrote to memory of 4748 N/A C:\ProgramData\KKJKFBKKEC.exe C:\Windows\SysWOW64\ftp.exe
PID 4324 wrote to memory of 3084 N/A C:\ProgramData\EHCGIJDHDG.exe C:\Windows\SysWOW64\ftp.exe
PID 3024 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\CUF.au3 C:\Windows\SysWOW64\cmd.exe
PID 4316 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4316 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4316 wrote to memory of 4200 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\timeout.exe
PID 4748 wrote to memory of 2996 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 4748 wrote to memory of 2996 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 4748 wrote to memory of 2996 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3084 wrote to memory of 3516 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 3516 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 4748 wrote to memory of 2996 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\SysWOW64\explorer.exe
PID 3084 wrote to memory of 3516 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3084 wrote to memory of 3516 N/A C:\Windows\SysWOW64\ftp.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
PID 3516 wrote to memory of 936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3516 wrote to memory of 936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3516 wrote to memory of 936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3516 wrote to memory of 936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3516 wrote to memory of 936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3516 wrote to memory of 936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
PID 3516 wrote to memory of 936 N/A C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

Processes

C:\Users\Admin\AppData\Local\Temp\files\Setup.exe

"C:\Users\Admin\AppData\Local\Temp\files\Setup.exe"

C:\Windows\SysWOW64\more.com

C:\Windows\SysWOW64\more.com

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\Users\Admin\AppData\Local\Temp\CUF.au3

C:\ProgramData\KKJKFBKKEC.exe

"C:\ProgramData\KKJKFBKKEC.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\ProgramData\EHCGIJDHDG.exe

"C:\ProgramData\EHCGIJDHDG.exe"

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\ftp.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GIIEGHIDBGHI" & exit

C:\Windows\SysWOW64\timeout.exe

timeout /t 10

C:\Windows\SysWOW64\explorer.exe

C:\Windows\SysWOW64\explorer.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe -a rx/0 --url=65.109.127.181:3333 -u PLAYA -p PLAYA -R --variant=-1 --max-cpu-usage=70 --donate-level=1 -opencl

Network

Country Destination Domain Proto
US 8.8.8.8:53 poocoin.online udp
NL 149.154.167.99:443 t.me tcp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 104.21.16.123:443 businessdownloads.ltd tcp
US 8.8.8.8:53 123.16.21.104.in-addr.arpa udp
US 20.42.73.27:443 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
US 199.232.196.193:443 i.imgur.com tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
DE 162.55.53.18:9000 162.55.53.18 tcp
FI 135.181.22.88:80 135.181.22.88 tcp
US 8.8.8.8:53 88.22.181.135.in-addr.arpa udp
FI 65.109.127.181:3333 tcp
US 8.8.8.8:53 proresupdate.com udp
US 45.152.112.146:80 proresupdate.com tcp
FI 65.109.127.181:3333 tcp

Files

memory/4160-0-0x00000000744D0000-0x000000007464D000-memory.dmp

memory/4160-1-0x00007FFF72700000-0x00007FFF72909000-memory.dmp

memory/4160-5-0x00000000744E2000-0x00000000744E4000-memory.dmp

memory/4160-6-0x00000000744D0000-0x000000007464D000-memory.dmp

memory/4160-7-0x00000000744D0000-0x000000007464D000-memory.dmp

memory/1176-9-0x00000000744D0000-0x000000007464D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\830d6517

MD5 76fd782cdf14bcda810370eb5e4487cc
SHA1 6eadbfd56ad578dc0d423e85218207edacf1d32b
SHA256 61543438b16e28e432d2cbb45bf0b949052cf8f6409cc5615e3ca44eb98e4d4a
SHA512 2d80f4f17d698a3e9e3cd275cd20771da0d2ce14fb32a180f0e30a888623957e1cba4672756f2f3b78d9f1d796f20ca2fabeba3fee4edf6210125252c4e831e3

memory/1176-11-0x00007FFF72700000-0x00007FFF72909000-memory.dmp

memory/1176-13-0x00000000744D0000-0x000000007464D000-memory.dmp

memory/1176-14-0x00000000744D0000-0x000000007464D000-memory.dmp

memory/1176-19-0x00000000744D0000-0x000000007464D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CUF.au3

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/3024-21-0x0000000001400000-0x0000000001B4C000-memory.dmp

memory/3024-23-0x00007FFF72700000-0x00007FFF72909000-memory.dmp

memory/3024-24-0x0000000001400000-0x0000000001B4C000-memory.dmp

memory/3024-36-0x0000000061E00000-0x0000000061EF3000-memory.dmp

C:\ProgramData\GIIEGHIDBGHI\nss3.dll

MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

C:\ProgramData\GIIEGHIDBGHI\mozglue.dll

MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

memory/3024-104-0x0000000001400000-0x0000000001B4C000-memory.dmp

C:\ProgramData\KKJKFBKKEC.exe

MD5 6cfddd5ce9ca4bb209bd5d8c2cd80025
SHA1 424da82e9edbb6b39a979ab97d84239a1d67c48b
SHA256 376e1802b979514ba0e9c73933a8c6a09dd3f1d2a289f420c2202e64503d08a7
SHA512 d861130d87bfedc38a97019cba17724067f397e6ffe7e1384175db48c0a177a2e7e256c3c933d0f42766e8077f767d6d4dc8758200852e8ec135736daee7c0f8

memory/2368-124-0x0000000000960000-0x0000000000E73000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9b4fcf2e

MD5 8d443e7cb87cacf0f589ce55599e008f
SHA1 c7ff0475a3978271e0a8417ac4a826089c083772
SHA256 e2aaaa1a0431aab1616e2b612e9b68448107e6ce71333f9c0ec1763023b72b2a
SHA512 c7d0ced6eb9e203d481d1dbdd5965278620c10cdc81c02da9c4f7f99f3f8c61dfe975cf48d4b93ccde9857edb881a77ebe9cd13ae7ef029285d770d767aa74a5

memory/2368-130-0x00000000721B0000-0x000000007232D000-memory.dmp

memory/2368-131-0x00007FFF72700000-0x00007FFF72909000-memory.dmp

C:\ProgramData\EHCGIJDHDG.exe

MD5 daaff76b0baf0a1f9cec253560c5db20
SHA1 0311cf0eeb4beddd2c69c6e97462595313a41e78
SHA256 5706c6f5421a6a34fdcb67e9c9e71283c8fc1c33499904519cbdc6a21e6b071c
SHA512 987ca2d67903c65ee1075c4a5250c85840aea26647b1d95a3e73a26dcad053bd4c31df4ca01d6cc0c196fa7e8e84ab63ed4a537f72fc0b1ee4ba09cdb549ddf3

memory/4324-142-0x0000000000D60000-0x0000000000FA8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a2650906

MD5 c62f812e250409fbd3c78141984270f2
SHA1 9c7c70bb78aa0de4ccf0c2b5d87b37c8a40bd806
SHA256 d8617477c800cc10f9b52e90b885117a27266831fb5033647b6b6bd6025380a8
SHA512 7573ecac1725f395bbb1661f743d8ee6b029f357d3ef07d0d96ee4ff3548fe06fab105ee72be3e3964d2053de2f44245cca9a061d47c1411949840c84f6e9092

memory/4324-148-0x00000000721B0000-0x000000007232D000-memory.dmp

memory/4324-149-0x00007FFF72700000-0x00007FFF72909000-memory.dmp

memory/3024-150-0x0000000001400000-0x0000000001B4C000-memory.dmp

C:\ProgramData\GIIEGHIDBGHI\DGIJEG

MD5 59071590099d21dd439896592338bf95
SHA1 6a521e1d2a632c26e53b83d2cc4b0edecfc1e68c
SHA256 07854d2fef297a06ba81685e660c332de36d5d18d546927d30daad6d7fda1541
SHA512 eedb6cadbceb2c991fc6f68dccb80463b3f660c5358acd7d705398ae2e3df2b4327f0f6c6746486848bd2992b379776483a98063ae96edb45877bb0314874668

memory/3024-186-0x0000000001400000-0x0000000001B4C000-memory.dmp

memory/2368-187-0x00000000721B0000-0x000000007232D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9d1145be

MD5 89ac016c1961d0ffcc49f2d83d105bcf
SHA1 b3a1c224bcbfb5233cd818437f1adf301d50f272
SHA256 5c604ec518a6a6c02526ffeda98d61f02921307de7d975888e05716880eb333c
SHA512 a55def4b6ede86724fbc11c4ab2c69c648f44c0325bccdaf4ff8ea7c8fc075da1dcc24c5432dd8f77d42280b4b29c9963900fb4861f6ee06a70f1d7eaba7e46a

memory/4324-190-0x00000000721B0000-0x000000007232D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a5665df4

MD5 a8812ecc29207273cc5855021630dfbe
SHA1 417989a8d4aa7c552ed7b4f16b77a77dced4d9ff
SHA256 ebd9bed3a7c0472d179e536ab6295c292dcbfa9910001ec761a59c33b454c1d4
SHA512 41c6274303e9869e5a1e82f8afdd03fcb562ddc27a9c09830a0f5126f1e3e4e171479f3328449a874375a0ee2229a75b2b7f72f23b47d2c4acd1d30e0dd0b2eb

memory/3024-193-0x0000000001400000-0x0000000001B4C000-memory.dmp

C:\ProgramData\GIIEGHIDBGHI\CGIDGC

MD5 3f50a5b944f34447d367a5a8cff2202c
SHA1 1470119d2911daec46655258de736bec57fd64d3
SHA256 a2802ce60a24ff018322f342908e349910992c82d083a304e332fd0be7ae9e2c
SHA512 5a37ef0c319009f4a21d5aa11621d769a90545ec18fbbc1cd849bed3132a4eeb46c334cd11afbf1ad213f2718c94d3e76695b459def87590c769db88c5aea286

memory/4748-199-0x00007FFF72700000-0x00007FFF72909000-memory.dmp

memory/3024-204-0x0000000001400000-0x0000000001B4C000-memory.dmp

memory/3084-205-0x00007FFF72700000-0x00007FFF72909000-memory.dmp

memory/4748-206-0x00000000721B0000-0x000000007232D000-memory.dmp

C:\ProgramData\GIIEGHIDBGHI\VCRUNT~1.DLL

MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

C:\ProgramData\GIIEGHIDBGHI\softokn3.dll

MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6

C:\ProgramData\GIIEGHIDBGHI\msvcp140.dll

MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

memory/4748-221-0x00000000721B0000-0x000000007232D000-memory.dmp

memory/3516-225-0x00007FFF50C40000-0x00007FFF522E0000-memory.dmp

memory/2996-228-0x00007FFF72700000-0x00007FFF72909000-memory.dmp

memory/2996-229-0x0000000000600000-0x0000000000671000-memory.dmp

memory/3516-230-0x0000000000400000-0x000000000040A000-memory.dmp

memory/936-234-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/936-238-0x0000022204770000-0x0000022204790000-memory.dmp

memory/936-236-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/936-237-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/936-240-0x0000000140000000-0x00000001407DC000-memory.dmp

memory/936-239-0x0000000140000000-0x00000001407DC000-memory.dmp