Analysis Overview
SHA256
e65f08b6749e63fea544cd201161e63abe6925e0e739faddda2bd4af5af56b97
Threat Level: Known bad
The file softorganizer.exe was found to be: Known bad.
Malicious Activity Summary
Detect Vidar Stealer
Stealc
Vidar
Lumma Stealer
Downloads MZ/PE file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
Program crash
Unsigned PE
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Checks processor information in registry
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-07-11 12:18
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-11 12:18
Reported
2024-07-11 12:23
Platform
win7-20240705-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Detect Vidar Stealer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Stealc
Vidar
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\GDHIDHIEGI.exe | N/A |
| N/A | N/A | C:\ProgramData\KEBFHIJECF.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2016 set thread context of 2880 | N/A | C:\Users\Admin\AppData\Local\Temp\softorganizer.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\ProgramData\GDHIDHIEGI.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\ProgramData\KEBFHIJECF.exe |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\softorganizer.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\softorganizer.exe
"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
C:\ProgramData\GDHIDHIEGI.exe
"C:\ProgramData\GDHIDHIEGI.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 112
C:\ProgramData\KEBFHIJECF.exe
"C:\ProgramData\KEBFHIJECF.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 112
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\DHDHCGHDHIDH" & exit
C:\Windows\SysWOW64\timeout.exe
timeout /t 10
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
| GB | 104.82.234.109:443 | steamcommunity.com | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 77.105.132.27:80 | 77.105.132.27 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 8.8.8.8:53 | tea.arpdabl.org | udp |
| NL | 185.107.56.203:80 | tea.arpdabl.org | tcp |
| US | 8.8.8.8:53 | survey-smiles.com | udp |
| US | 199.59.243.226:80 | survey-smiles.com | tcp |
Files
memory/2016-0-0x0000000074AEE000-0x0000000074AEF000-memory.dmp
memory/2016-1-0x0000000000AF0000-0x0000000001054000-memory.dmp
memory/2016-2-0x0000000074AE0000-0x00000000751CE000-memory.dmp
memory/2016-3-0x0000000005280000-0x000000000548A000-memory.dmp
memory/2016-4-0x0000000005860000-0x00000000059B4000-memory.dmp
memory/2016-5-0x0000000000580000-0x000000000059C000-memory.dmp
memory/2016-6-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-9-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-11-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-35-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-51-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-61-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-59-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-57-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-55-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-53-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-49-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-47-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-45-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-43-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-41-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-39-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-37-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-33-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-31-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-29-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-27-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-25-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-23-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-21-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-19-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-17-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-15-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-13-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-8-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-65-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2016-63-0x0000000000580000-0x0000000000595000-memory.dmp
memory/2880-67-0x0000000000400000-0x0000000000648000-memory.dmp
memory/2880-69-0x0000000000400000-0x0000000000648000-memory.dmp
memory/2880-68-0x0000000000400000-0x0000000000648000-memory.dmp
memory/2880-66-0x0000000000400000-0x0000000000648000-memory.dmp
memory/2880-76-0x0000000000400000-0x0000000000648000-memory.dmp
memory/2016-74-0x0000000074AE0000-0x00000000751CE000-memory.dmp
memory/2016-77-0x0000000074AE0000-0x00000000751CE000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Cab3822.tmp
| MD5 | 49aebf8cbd62d92ac215b2923fb1b9f5 |
| SHA1 | 1723be06719828dda65ad804298d0431f6aff976 |
| SHA256 | b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f |
| SHA512 | bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b |
C:\Users\Admin\AppData\Local\Temp\Tar3845.tmp
| MD5 | 4ea6026cf93ec6338144661bf1202cd1 |
| SHA1 | a1dec9044f750ad887935a01430bf49322fbdcb7 |
| SHA256 | 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8 |
| SHA512 | 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b |
\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
\ProgramData\GDHIDHIEGI.exe
| MD5 | 5dcb471423fbb62d7c218760aee4936d |
| SHA1 | 7d72a2295639a8702ecdb77cc020b7a9eef48b04 |
| SHA256 | 837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd |
| SHA512 | d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736 |
\ProgramData\KEBFHIJECF.exe
| MD5 | 0b4cc01ce62da8ed72b98a896c11c1dd |
| SHA1 | eb87a11df4f7a0066389094ee9ba8a4e189794ad |
| SHA256 | 6ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc |
| SHA512 | b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d |
memory/2880-630-0x0000000000400000-0x0000000000648000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-11 12:18
Reported
2024-07-11 12:23
Platform
win10v2004-20240709-en
Max time kernel
94s
Max time network
204s
Command Line
Signatures
Detect Vidar Stealer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Lumma Stealer
Stealc
Vidar
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\FBFIDBFHDB.exe | N/A |
| N/A | N/A | C:\ProgramData\HDAFBAEBKJ.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1332 set thread context of 3536 | N/A | C:\Users\Admin\AppData\Local\Temp\softorganizer.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
| PID 3772 set thread context of 4592 | N/A | C:\ProgramData\FBFIDBFHDB.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 3308 set thread context of 4724 | N/A | C:\ProgramData\HDAFBAEBKJ.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\softorganizer.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\softorganizer.exe
"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
C:\ProgramData\FBFIDBFHDB.exe
"C:\ProgramData\FBFIDBFHDB.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\ProgramData\HDAFBAEBKJ.exe
"C:\ProgramData\HDAFBAEBKJ.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\KKKJEBAAECBG" & exit
C:\Windows\SysWOW64\timeout.exe
timeout /t 10
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 76.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
| GB | 104.82.234.109:443 | steamcommunity.com | tcp |
| US | 8.8.8.8:53 | 109.234.82.104.in-addr.arpa | udp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 8.8.8.8:53 | 221.241.109.65.in-addr.arpa | udp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 77.105.132.27:80 | 77.105.132.27 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 8.8.8.8:53 | stationacutwo.shop | udp |
| US | 172.67.172.239:443 | stationacutwo.shop | tcp |
| US | 8.8.8.8:53 | 27.132.105.77.in-addr.arpa | udp |
| US | 8.8.8.8:53 | bouncedgowp.shop | udp |
| US | 172.67.214.52:443 | bouncedgowp.shop | tcp |
| US | 8.8.8.8:53 | bannngwko.shop | udp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 172.67.146.61:443 | bannngwko.shop | tcp |
| US | 8.8.8.8:53 | 239.172.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 52.214.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | bargainnykwo.shop | udp |
| US | 104.21.47.93:443 | bargainnykwo.shop | tcp |
| US | 8.8.8.8:53 | affecthorsedpo.shop | udp |
| US | 172.67.135.137:443 | affecthorsedpo.shop | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 8.8.8.8:53 | radiationnopp.shop | udp |
| US | 8.8.8.8:53 | 61.146.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 93.47.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.135.67.172.in-addr.arpa | udp |
| US | 104.21.68.158:443 | radiationnopp.shop | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 8.8.8.8:53 | answerrsdo.shop | udp |
| US | 172.67.203.63:443 | answerrsdo.shop | tcp |
| US | 8.8.8.8:53 | publicitttyps.shop | udp |
| US | 104.21.25.154:443 | publicitttyps.shop | tcp |
| US | 8.8.8.8:53 | 158.68.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 63.203.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.25.21.104.in-addr.arpa | udp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 8.8.8.8:53 | benchillppwo.shop | udp |
| US | 172.67.160.230:443 | benchillppwo.shop | tcp |
| GB | 104.82.234.109:443 | steamcommunity.com | tcp |
| US | 8.8.8.8:53 | reinforcedirectorywd.shop | udp |
| US | 104.21.83.48:443 | reinforcedirectorywd.shop | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 8.8.8.8:53 | 230.160.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.83.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tea.arpdabl.org | udp |
| US | 172.93.194.61:80 | tea.arpdabl.org | tcp |
| US | 8.8.8.8:53 | survey-smiles.com | udp |
| US | 199.59.243.226:80 | survey-smiles.com | tcp |
| US | 8.8.8.8:53 | 61.194.93.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 226.243.59.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
| GB | 104.82.234.109:443 | steamcommunity.com | tcp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 8.8.8.8:53 | 18.31.95.13.in-addr.arpa | udp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
Files
memory/1332-0-0x000000007497E000-0x000000007497F000-memory.dmp
memory/1332-1-0x0000000000680000-0x0000000000BE4000-memory.dmp
memory/1332-2-0x0000000005690000-0x000000000572C000-memory.dmp
memory/1332-3-0x0000000074970000-0x0000000075120000-memory.dmp
memory/1332-4-0x0000000005840000-0x0000000005A4A000-memory.dmp
memory/1332-5-0x0000000005A50000-0x0000000005BA4000-memory.dmp
memory/1332-6-0x0000000005580000-0x000000000559C000-memory.dmp
memory/1332-12-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-16-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-66-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-64-0x0000000005580000-0x0000000005595000-memory.dmp
memory/3536-69-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3536-67-0x0000000000400000-0x0000000000648000-memory.dmp
memory/1332-71-0x0000000074970000-0x0000000075120000-memory.dmp
memory/1332-63-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-60-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-58-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-56-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-54-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-52-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-51-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-48-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-46-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-44-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-42-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-40-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-38-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-36-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-34-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-32-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-31-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-29-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-26-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-24-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-22-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-20-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-19-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-14-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-10-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-8-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-7-0x0000000005580000-0x0000000005595000-memory.dmp
memory/1332-72-0x0000000074970000-0x0000000075120000-memory.dmp
memory/3536-73-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3536-78-0x0000000000400000-0x0000000000648000-memory.dmp
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
C:\ProgramData\FBFIDBFHDB.exe
| MD5 | 5dcb471423fbb62d7c218760aee4936d |
| SHA1 | 7d72a2295639a8702ecdb77cc020b7a9eef48b04 |
| SHA256 | 837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd |
| SHA512 | d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736 |
memory/4592-156-0x0000000000400000-0x000000000044F000-memory.dmp
memory/1332-155-0x0000000074970000-0x0000000075120000-memory.dmp
C:\ProgramData\HDAFBAEBKJ.exe
| MD5 | 0b4cc01ce62da8ed72b98a896c11c1dd |
| SHA1 | eb87a11df4f7a0066389094ee9ba8a4e189794ad |
| SHA256 | 6ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc |
| SHA512 | b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d |
memory/3536-170-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3536-173-0x0000000000400000-0x0000000000648000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5G8JI3LV\76561199735694209[1].htm
| MD5 | 6312eb72b629c5dd7d2dc44c339158ce |
| SHA1 | 1956fc476f484290133c39c9741ec0fdfbeb0544 |
| SHA256 | 2760332d6bbc2943cb00e5029081bc16fa549a2cf63fef65bafa72ef5173d5e8 |
| SHA512 | f965061f7a208f13a40ec8003d24a917f6ef6c5421c023d28b984a7e43974b342409be7a4526fa414e9692a91a1c56b2013ca145b9ea997769328585f46ee4e1 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
| MD5 | baa2409ed7f6a7e8bba952df083e96bc |
| SHA1 | d8ad93370da697703762fef037a411218e800a85 |
| SHA256 | da9bbebc50ba4463f66d800e4f748bd5489d411b93e2b14b72e9095c33545d69 |
| SHA512 | 7404f98c6312fbe3c5ed747738de2655ca4bec1357f9566dabbb630ef110d39bfa03a5c5cf685d96c885ada550ef007358f9a5921d291dd0e2a486e41dd3d216 |
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619
| MD5 | 605e42c1174615ebb03fbd0f073383e0 |
| SHA1 | a939ee83654c4d534fe8b54c8f1b2e2a18072043 |
| SHA256 | 5577426d83e3ee4d364d28f0aaaf9c361e21027dac215bff73bcc3c9f447fa4d |
| SHA512 | 7c9fa2f72347c2d635b78176aaddcf436956de4fc2a1eca821dc6ba11da2e3f0f982e0055ca96cf8a0b60d4597719606c4cc7dfb553b4fa50bbb642208da8534 |
C:\ProgramData\IDBGHDGHCGHC\BAEBGH
| MD5 | f310cf1ff562ae14449e0167a3e1fe46 |
| SHA1 | 85c58afa9049467031c6c2b17f5c12ca73bb2788 |
| SHA256 | e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855 |
| SHA512 | 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad |
Analysis: behavioral3
Detonation Overview
Submitted
2024-07-11 12:18
Reported
2024-07-11 12:23
Platform
win11-20240709-en
Max time kernel
147s
Max time network
275s
Command Line
Signatures
Detect Vidar Stealer
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Stealc
Vidar
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\HCGCAAKJDH.exe | N/A |
| N/A | N/A | C:\ProgramData\DGCFHIDAKE.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3576 set thread context of 3368 | N/A | C:\Users\Admin\AppData\Local\Temp\softorganizer.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe |
| PID 2068 set thread context of 4776 | N/A | C:\ProgramData\HCGCAAKJDH.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
| PID 4768 set thread context of 3240 | N/A | C:\ProgramData\DGCFHIDAKE.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
| N/A | N/A | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\softorganizer.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\softorganizer.exe
"C:\Users\Admin\AppData\Local\Temp\softorganizer.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
C:\ProgramData\HCGCAAKJDH.exe
"C:\ProgramData\HCGCAAKJDH.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\ProgramData\DGCFHIDAKE.exe
"C:\ProgramData\DGCFHIDAKE.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GCFBAKKJDBKJ" & exit
C:\Windows\SysWOW64\timeout.exe
timeout /t 10
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | steamcommunity.com | udp |
| GB | 104.82.234.109:443 | steamcommunity.com | tcp |
| US | 8.8.8.8:53 | 109.234.82.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 77.105.132.27:80 | 77.105.132.27 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 104.21.30.130:443 | stationacutwo.shop | tcp |
| US | 172.67.214.52:443 | bouncedgowp.shop | tcp |
| US | 104.21.81.196:443 | bannngwko.shop | tcp |
| US | 104.21.47.93:443 | bargainnykwo.shop | tcp |
| US | 104.21.6.254:443 | affecthorsedpo.shop | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 172.67.196.169:443 | radiationnopp.shop | tcp |
| US | 8.8.8.8:53 | 169.196.67.172.in-addr.arpa | udp |
| US | 172.67.203.63:443 | answerrsdo.shop | tcp |
| US | 104.21.25.154:443 | publicitttyps.shop | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 104.21.81.128:443 | benchillppwo.shop | tcp |
| GB | 104.82.234.109:443 | steamcommunity.com | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| US | 172.67.214.98:443 | reinforcedirectorywd.shop | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| NL | 185.107.56.203:80 | tea.arpdabl.org | tcp |
| US | 199.59.243.226:80 | survey-smiles.com | tcp |
| GB | 104.82.234.109:443 | steamcommunity.com | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
| FI | 65.109.241.221:443 | 65.109.241.221 | tcp |
Files
memory/3576-0-0x0000000074EAE000-0x0000000074EAF000-memory.dmp
memory/3576-1-0x0000000000590000-0x0000000000AF4000-memory.dmp
memory/3576-2-0x0000000005660000-0x00000000056FC000-memory.dmp
memory/3576-3-0x0000000074EA0000-0x0000000075651000-memory.dmp
memory/3576-4-0x0000000005820000-0x0000000005A2A000-memory.dmp
memory/3576-5-0x0000000005A30000-0x0000000005B84000-memory.dmp
memory/3576-6-0x0000000005550000-0x000000000556C000-memory.dmp
memory/3576-62-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-65-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-60-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-58-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3368-69-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3576-70-0x0000000074EA0000-0x0000000075651000-memory.dmp
memory/3368-67-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3576-54-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-50-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-48-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3368-73-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3576-72-0x0000000074EA0000-0x0000000075651000-memory.dmp
memory/3576-44-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-42-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-40-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-39-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-66-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-36-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-34-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-32-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-30-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-28-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-26-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-24-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-20-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-18-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-14-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-12-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-10-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-8-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-56-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-52-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-46-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-22-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-16-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3576-7-0x0000000005550000-0x0000000005565000-memory.dmp
memory/3368-80-0x0000000000400000-0x0000000000648000-memory.dmp
C:\ProgramData\mozglue.dll
| MD5 | c8fd9be83bc728cc04beffafc2907fe9 |
| SHA1 | 95ab9f701e0024cedfbd312bcfe4e726744c4f2e |
| SHA256 | ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a |
| SHA512 | fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040 |
C:\ProgramData\nss3.dll
| MD5 | 1cc453cdf74f31e4d913ff9c10acdde2 |
| SHA1 | 6e85eae544d6e965f15fa5c39700fa7202f3aafe |
| SHA256 | ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5 |
| SHA512 | dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571 |
C:\ProgramData\HCGCAAKJDH.exe
| MD5 | 5dcb471423fbb62d7c218760aee4936d |
| SHA1 | 7d72a2295639a8702ecdb77cc020b7a9eef48b04 |
| SHA256 | 837340da10b33b25bca1c15db3b273bfde18110b46949e8c545f31756e7b44bd |
| SHA512 | d8febe1cc91bbacd1b0298eb88d0d25f7789ee962f4d4717cb74ca1d1081ecab78a4062923b31386bcae141900ee99c182836e52bbb4b9f362cd8bdf687dc736 |
memory/4776-157-0x0000000000400000-0x000000000044F000-memory.dmp
C:\ProgramData\DGCFHIDAKE.exe
| MD5 | 0b4cc01ce62da8ed72b98a896c11c1dd |
| SHA1 | eb87a11df4f7a0066389094ee9ba8a4e189794ad |
| SHA256 | 6ab0929361ee1a7fdc900bb0f6e50e999183a7c1aef1f44951b7847e86dfd3bc |
| SHA512 | b24fb55140210cc3c8d5f2dec84f36314a93397351a7109701b05dcb47cfbaf437c74fcafb551d8a96e845ea656a5c618b4a229c6acba8c2d0ed3849ccc48b8d |
memory/3368-173-0x0000000000400000-0x0000000000648000-memory.dmp
memory/3368-174-0x0000000000400000-0x0000000000648000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\41XQO3A1\76561199735694209[1].htm
| MD5 | 9cf7bea00610e043acbd0d9203cc74b8 |
| SHA1 | 2cd9dae3ec095caa8527cd2c2ca7517004387ae3 |
| SHA256 | 3407ea8c663fc9ffd59b2b40a658c99b5c2eff4dc61fc21a0fe4a8b2077bc6bd |
| SHA512 | 266fe90046e910ceb23ae786ed7a9b5c5530b807a3d1fb6470f228f8644b75f7f777108948120d597d072b0778604fb2ff4502addd020d337aa325fdfc874823 |
C:\ProgramData\IDAKJKEHDBGH\AAEBAF
| MD5 | f310cf1ff562ae14449e0167a3e1fe46 |
| SHA1 | 85c58afa9049467031c6c2b17f5c12ca73bb2788 |
| SHA256 | e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855 |
| SHA512 | 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad |