lumma | 86bb9a397e62d756578dbe6c40cc07050f2066db6fb5d54499e03469a7cdccd5

Analysis

max time kernel
91s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
66d5ddcec1520_shtr.exe
Size 206KB
Sample240902-tnj67avdkf
SHA256 86bb9a397e62d756578dbe6c40cc07050f2066db6fb5d54499e03469a7cdccd5
MD5 ab68db6a238464a75b669938a3512ae1
SHA1 48a7e2ed179d29d783d55fe610598474825bdf95
SHA512 b811a8f5d3d2fab469a97a9a0d59d6b132b4fecbc7048dd203d25c938e7047b487e9a85799f8d9b04c0e01f307f3ff1bd0c3af967a8813c3ab0d72c69650364c
SSDEEP 6144:DYwI7yviKKJGngBT7nI5n6gtJuMM2lxG5IvjKEO:DYwIueBT7IRntJuMPXZKEO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lumma stealc vidar default credential_access discovery spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

default

http://46.8.231.109

Attributes

url_path
/c4754d4f680ead72.php

Extracted

Family

vidar

https://t.me/edm0d
https://steamcommunity.com/profiles/76561199768374681

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 OPR/110.0.0.0

Extracted

Family

lumma

https://stamppreewntnq.shop/api
https://locatedblsoqp.shop/api

Signatures

Detect Vidar Stealer 20 IoCs

stealer

resource	yara_rule
behavioral3/memory/1088-92-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-100-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-95-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-125-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-126-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-141-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-142-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-158-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-165-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-167-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-184-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-185-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-192-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-193-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/5008-231-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/1088-234-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/5008-241-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/5008-242-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/5008-257-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7
behavioral3/memory/5008-258-0x0000000000400000-0x0000000000657000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	RegAsm.exe

Executes dropped EXE 4 IoCs

pid	Process
2032	AdminGDHIEHJEBA.exe
1904	AdminCAEHDBAAEC.exe
740	FHCBGDAAFB.exe
2780	KECBGCGCGI.exe

Loads dropped DLL 4 IoCs

pid	Process
1988	RegAsm.exe
1988	RegAsm.exe
1088	RegAsm.exe
1088	RegAsm.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 2032 set thread context of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 1904 set thread context of 588	1904	AdminCAEHDBAAEC.exe	106
PID 740 set thread context of 2016	740	FHCBGDAAFB.exe	115
PID 2780 set thread context of 5008	2780	KECBGCGCGI.exe	118

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4436	588	WerFault.exe	106
4556	588	WerFault.exe	106
4660	2016	WerFault.exe	115
1624	2016	WerFault.exe	115

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminCAEHDBAAEC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminGDHIEHJEBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KECBGCGCGI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66d5ddcec1520_shtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FHCBGDAAFB.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2432	timeout.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1988	RegAsm.exe
1988	RegAsm.exe
1988	RegAsm.exe
1988	RegAsm.exe
1088	RegAsm.exe
1088	RegAsm.exe
1088	RegAsm.exe
1088	RegAsm.exe
1088	RegAsm.exe
1088	RegAsm.exe
1088	RegAsm.exe
1088	RegAsm.exe
5008	RegAsm.exe
5008	RegAsm.exe
5008	RegAsm.exe
5008	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 1856 wrote to memory of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 1856 wrote to memory of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 1856 wrote to memory of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 1856 wrote to memory of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 1856 wrote to memory of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 1856 wrote to memory of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 1856 wrote to memory of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 1856 wrote to memory of 1988	1856	66d5ddcec1520_shtr.exe	87
PID 1988 wrote to memory of 3432	1988	RegAsm.exe	93
PID 1988 wrote to memory of 3432	1988	RegAsm.exe	93
PID 1988 wrote to memory of 3432	1988	RegAsm.exe	93
PID 3432 wrote to memory of 2032	3432	cmd.exe	95
PID 3432 wrote to memory of 2032	3432	cmd.exe	95
PID 3432 wrote to memory of 2032	3432	cmd.exe	95
PID 2032 wrote to memory of 4984	2032	AdminGDHIEHJEBA.exe	97
PID 2032 wrote to memory of 4984	2032	AdminGDHIEHJEBA.exe	97
PID 2032 wrote to memory of 4984	2032	AdminGDHIEHJEBA.exe	97
PID 2032 wrote to memory of 2664	2032	AdminGDHIEHJEBA.exe	98
PID 2032 wrote to memory of 2664	2032	AdminGDHIEHJEBA.exe	98
PID 2032 wrote to memory of 2664	2032	AdminGDHIEHJEBA.exe	98
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 2032 wrote to memory of 1088	2032	AdminGDHIEHJEBA.exe	99
PID 1988 wrote to memory of 3868	1988	RegAsm.exe	102
PID 1988 wrote to memory of 3868	1988	RegAsm.exe	102
PID 1988 wrote to memory of 3868	1988	RegAsm.exe	102
PID 3868 wrote to memory of 1904	3868	cmd.exe	104
PID 3868 wrote to memory of 1904	3868	cmd.exe	104
PID 3868 wrote to memory of 1904	3868	cmd.exe	104
PID 1904 wrote to memory of 588	1904	AdminCAEHDBAAEC.exe	106
PID 1904 wrote to memory of 588	1904	AdminCAEHDBAAEC.exe	106
PID 1904 wrote to memory of 588	1904	AdminCAEHDBAAEC.exe	106
PID 1904 wrote to memory of 588	1904	AdminCAEHDBAAEC.exe	106
PID 1904 wrote to memory of 588	1904	AdminCAEHDBAAEC.exe	106
PID 1904 wrote to memory of 588	1904	AdminCAEHDBAAEC.exe	106
PID 1904 wrote to memory of 588	1904	AdminCAEHDBAAEC.exe	106
PID 1904 wrote to memory of 588	1904	AdminCAEHDBAAEC.exe	106
PID 1904 wrote to memory of 588	1904	AdminCAEHDBAAEC.exe	106
PID 1088 wrote to memory of 740	1088	RegAsm.exe	112
PID 1088 wrote to memory of 740	1088	RegAsm.exe	112
PID 1088 wrote to memory of 740	1088	RegAsm.exe	112
PID 740 wrote to memory of 2016	740	FHCBGDAAFB.exe	115
PID 740 wrote to memory of 2016	740	FHCBGDAAFB.exe	115
PID 740 wrote to memory of 2016	740	FHCBGDAAFB.exe	115
PID 740 wrote to memory of 2016	740	FHCBGDAAFB.exe	115
PID 740 wrote to memory of 2016	740	FHCBGDAAFB.exe	115
PID 740 wrote to memory of 2016	740	FHCBGDAAFB.exe	115
PID 740 wrote to memory of 2016	740	FHCBGDAAFB.exe	115
PID 740 wrote to memory of 2016	740	FHCBGDAAFB.exe	115
PID 740 wrote to memory of 2016	740	FHCBGDAAFB.exe	115
PID 1088 wrote to memory of 2780	1088	RegAsm.exe	116
PID 1088 wrote to memory of 2780	1088	RegAsm.exe	116
PID 1088 wrote to memory of 2780	1088	RegAsm.exe	116
PID 2780 wrote to memory of 5008	2780	KECBGCGCGI.exe	118
PID 2780 wrote to memory of 5008	2780	KECBGCGCGI.exe	118
PID 2780 wrote to memory of 5008	2780	KECBGCGCGI.exe	118

C:\Users\Admin\AppData\Local\Temp\66d5ddcec1520_shtr.exe
"C:\Users\Admin\AppData\Local\Temp\66d5ddcec1520_shtr.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminGDHIEHJEBA.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Users\AdminGDHIEHJEBA.exe
      "C:\Users\AdminGDHIEHJEBA.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2032
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:4984
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        
        PID:2664
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        Checks computer location settings
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\ProgramData\FHCBGDAAFB.exe
        
        "C:\ProgramData\FHCBGDAAFB.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:740
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 1372
        8⤵
        Program crash
        
        PID:1624
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 1340
        8⤵
        Program crash
        
        PID:4660
      - C:\ProgramData\KECBGCGCGI.exe
        
        "C:\ProgramData\KECBGCGCGI.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:5008
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\GDAAKFIDGIEG" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3696
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminCAEHDBAAEC.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Users\AdminCAEHDBAAEC.exe
      "C:\Users\AdminCAEHDBAAEC.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1904
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 1348
        6⤵
        Program crash
        
        PID:4436
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 588 -s 1320
        6⤵
        Program crash
        
        PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 588 -ip 588
1⤵
PID:3156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 588 -ip 588
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2016 -ip 2016
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2016 -ip 2016
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CBAKJK

Path C:\ProgramData\GDAAKFIDGIEG\CBAKJK
Size 114KB
SHA256 693617c470d7472e751d872341061cfb663f22ee95bdb42f9db01f02cb90df9c
MD5 3cfabadfcb05a77b204fe1a6b09a5c90
SHA1 f106b5ed22265e64bc61dc5cf1e2d33ed12ec18d
SHA512 d5502023a17213919e2e991f5ba2d0d2c08223fd489d876a47a37239b637d03ace9cb9b92deb71460ae4030194ca49ce9e9752e0bf2ccbcd297dc5afe62a4e7b
SSDEEP 192:KZPM23W/l1jXhPE4nP+hoIky6cVqLVumf:I02m/lxhlnmhouHcVumf
MD5 SHA1 SHA512 SSDEEP

Submit Download

CGIJKJ

Path C:\ProgramData\GDAAKFIDGIEG\CGIJKJ
Size 11KB
SHA256 5a4ccff78425ef2a22c31c679c92b6228f712bedd485396264fe7382e70b0ea8
MD5 bfc1b0062db99c7a25daa7f7985111ae
SHA1 353d3308825005b6578a190246676e9a3f349712
SHA512 7ee1e6a23d9cc500c26332c82cfff652f0976be9a2a6923262009336789abc50a3f1cbd992b6862bfd2b42aed650848e70cd63654aa12dab655dbb34465f7a72
SSDEEP 192:q5nrR2flayKvNxndz/NcdNxnIzQHrK60raXocM8DBw8VP:bkvNxdzyrxOQLpKzcwE
MD5 SHA1 SHA512 SSDEEP

Submit Download

EGIDHD

Path C:\ProgramData\GDAAKFIDGIEG\EGIDHD
Size 116KB
SHA256 8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
MD5 f70aa3fa04f0536280f872ad17973c3d
SHA1 50a7b889329a92de1b272d0ecf5fce87395d3123
SHA512 30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
SSDEEP 192:CTPNbUJ6IH9xhomnGCTjHbRjCLqtzKWJaWtETVumQ6W:UPWJ6a9xpnQLqtzKWJnsVumQn
MD5 SHA1 SHA512 SSDEEP

Submit Download

GDAAKF

Path C:\ProgramData\JJECGHJDBFIJ\GDAAKF
Size 160KB
SHA256 e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855
MD5 f310cf1ff562ae14449e0167a3e1fe46
SHA1 85c58afa9049467031c6c2b17f5c12ca73bb2788
SHA512 1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad
SSDEEP 96:bBY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:bBY/tH+bF+UI3iWGVYWNkqp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

GDAAKF

Path C:\ProgramData\JJECGHJDBFIJ\GDAAKF
Size 40KB
SHA256 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914
MD5 a182561a527f929489bf4b8f74f65cd7
SHA1 8cd6866594759711ea1836e86a5b7ca64ee8911f
SHA512 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558
SSDEEP 48:2DcnBA+IIBoCVEq8Ma0D0HOlf/6ykwpLf/EUwMHZq10bvJKLkw8s8LKvUf9KVyJJ:uSQCn8MouB6w9f/8iZqmvJKLPeymwil
MD5 SHA1 SHA512 SSDEEP

Submit Download

GHIJJE

Path C:\ProgramData\JJECGHJDBFIJ\GHIJJE
Size 20KB
SHA256 ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7
MD5 a603e09d617fea7517059b4924b1df93
SHA1 31d66e1496e0229c6a312f8be05da3f813b3fa9e
SHA512 eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc
SSDEEP 24:TLYP1kwIrnLbXYFpFNYd+6UwcQ8ri5fB:TcPawkLLopFsU1+B
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebl3.dll

Path C:\ProgramData\freebl3.dll
Size 669KB
SHA256 edd043f2005dbd5902fc421eabb9472a7266950c5cbaca34e2d590b17d12f5fa
MD5 550686c0ee48c386dfcb40199bd076ac
SHA1 ee5134da4d3efcb466081fb6197be5e12a5b22ab
SHA512 0b7f47af883b99f9fbdc08020446b58f2f3fa55292fd9bc78fc967dd35bdd8bd549802722de37668cc89ede61b20359190efbfdf026ae2bdc854f4740a54649e
SSDEEP 12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcp140.dll

Path C:\ProgramData\msvcp140.dll
Size 439KB
SHA256 5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062
MD5 5ff1fca37c466d6723ec67be93b51442
SHA1 34cc4e158092083b13d67d6d2bc9e57b798a303b
SHA512 4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546
SSDEEP 12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

softokn3.dll

Path C:\ProgramData\softokn3.dll
Size 251KB
SHA256 74ebbac956e519e16923abdc5ab8912098a4f64e38ddcb2eae23969f306afe5a
MD5 4e52d739c324db8225bd9ab2695f262f
SHA1 71c3da43dc5a0d2a1941e874a6d015a071783889
SHA512 2d4168a69082a9192b9248f7331bd806c260478ff817567df54f997d7c3c7d640776131355401e4bdb9744e246c36d658cb24b18de67d8f23f10066e5fe445f6
SSDEEP 6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\ProgramData\vcruntime140.dll
Size 78KB
SHA256 8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825
MD5 a37ee36b536409056a86f50e67777dd7
SHA1 1cafa159292aa736fc595fc04e16325b27cd6750
SHA512 3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356
SSDEEP 1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdminCAEHDBAAEC.exe

Path C:\Users\AdminCAEHDBAAEC.exe
Size 334KB
SHA256 c45735085c630196f711708160c78f204d8fa3fd36dc7c49cfc039442ae4c9d7
MD5 24b1ff1f8ba8c5e20613a652b7ddcafb
SHA1 48cb72e8fb1bb1d586ccde26de74154130d2b219
SHA512 d277a6a0830dabc5b7d535f3d84c948a70ae3fd9a16948b55ccd69340726390f6346c91098c0a48d8f40cb76a83299fcfccf92b59675f36692b8537bbd720c8c
SSDEEP 6144:FxpZyOaZfFb7BrazG0/yWbFmss4GgI7k4nab/hY/ryS4tURNBFmfa8X7HqvIJ3EO:FxLyrRFb7hoG06WbFmhs4naIGtU5FQZN
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdminGDHIEHJEBA.exe

Path C:\Users\AdminGDHIEHJEBA.exe
Size 282KB
SHA256 90c0395f668f198d1aed010aaabbdab7c7f78b5a8c90072f4a2225683ebaac36
MD5 9d1e5520a634731ed9747be9e9af7c5d
SHA1 6bc547c7e26073f71be0017e29c8702ddea2fc11
SHA512 3cc597e4b451252361707740fe58ea18ff8734a9adad48458760518d1828beb55bd0ddb080daf7c1a29cda462b7cabab3c3829fc5c811b1d3069a5d507b7cbaa
SSDEEP 6144:A2nQ8BC0EIUnhElVMKMBMmhRbEiy+ssEO:pnQ8BCYhli3npyyEO
MD5 SHA1 SHA512 SSDEEP

Submit Download

156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE
Size 2KB
SHA256 2e0e9be598d0f657d9f1f3b4ff8bc5151751b7a639216bf362a40c6453cd6ce2
MD5 221cbda4be9defbf02dfd97302d75c46
SHA1 0d21680154fd26b408730476d1aaf6a845a929f3
SHA512 6c7299a7520afdd37872302dcb33cb732688e94e99674889aef12cd45a7be9213ffd3dbe22f39ec0d1a588f342cab24255cee6fa1d129185ec33c8aa7c84b305
MD5 SHA1 SHA512

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 2KB
SHA256 235b6b76edce553b578f71630f2142d5912707668009d1d6e9616af094c0e966
MD5 3e10c8ad351895a4c7f0d67f068fe698
SHA1 7a78e8a78b1b5991152f4de1e2d4d5eb259cb942
SHA512 a2296585db1716f904f2758362207060b4bb3898556c43ef5bbfc1bb54bd2d3b36ebd84ff4791053ead37647561b07cbd526048d10c648c1060a89de5ffb8e0a
MD5 SHA1 SHA512

Submit Download

EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Size 1KB
SHA256 cc4813486165df18b36b09814922c3f054897170ae412a7aa13c1178e25cf56c
MD5 4eb9f3b5c13e5f37ea56ec2861b48419
SHA1 5496b7e9b7d004f454fbfaa9a6b979e15ef44eb0
SHA512 13d71c96d91f116423918d6b0efa74e9d37eb8a876c44f7560f4bee21b74f5ebbb71d31198da5b344cbe03765bf1cc886f1e741fca68df9ee1a97773955d2579
MD5 SHA1 SHA512

Submit Download

156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\156887258BBD6E1FEF562837733EA04E_5BBC02CEDFD3F7AC9E268D830CF231EE
Size 458B
SHA256 6b03d33f699b64ef549f969ba79c46f363818a0cfbe6005a3b14d25696fbcf20
MD5 f2b078e50500d3310b64b2137457c175
SHA1 b265ce9854bcf08107e88cf6582949c8916e3eac
SHA512 84eb7b5a248b14865e055fe6c87a628cdfb552f42fd662581bd5ebb7b7bbe952513df3447818104ccb5ad6a71c0d189ef2e8b0ae5f8da25b6d5ada02be9c21aa
MD5 SHA1 SHA512

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 b1db5b3f24e26fc2655c2632e460076b05058955bcbe78e29ea671e1636ca671
MD5 80316cef23c53db20363cee331fe7033
SHA1 15861927cde66507e81c11d4342e45bda1f29bf1
SHA512 93eb1ac7e10e6d137eb49b9e9858dad1f45f7d5d40449b7645ec570bb5c9304abc0f7234d71c0c635f378bacc08229ca6121d7e0aead25fa6cd50a3eb17db25d
MD5 SHA1 SHA512

Submit Download

EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Size 458B
SHA256 f4e79c9c55b331d7eec5225d78b83aff577f79685e86039b55738240afeac902
MD5 d93c4c81abce3eac461e1f1a2c1753f7
SHA1 58faa498a83ff68fef67554e14d27a9aefd7718e
SHA512 f4a06f28f6cdb5a984dea4cc412ba211a5ea57dc9d380ebe782ee81bcccfc21eb37a19b6a8071f4404846fb6d0a67ce9ed09e736d119b424460646b35acddc92
MD5 SHA1 SHA512

Submit Download

KECBGCGCGI.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KECBGCGCGI.exe.log
Size 425B
SHA256 34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
MD5 4eaca4566b22b01cd3bc115b9b0b2196
SHA1 e743e0792c19f71740416e7b3c061d9f1336bf94
SHA512 bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
MD5 SHA1 SHA512

Submit Download

memory/588-120-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/588-124-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/588-123-0x0000000000400000-0x000000000045B000-memory.dmp

Download

memory/1088-158-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-95-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-141-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-126-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-142-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-127-0x0000000022860000-0x0000000022ABF000-memory.dmp

Download

memory/1088-125-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-165-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-193-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-167-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-192-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-234-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-92-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-100-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-184-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1088-185-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/1856-7-0x0000000074720000-0x0000000074ED0000-memory.dmp

Download

memory/1856-1-0x0000000000320000-0x0000000000358000-memory.dmp

Download

memory/1856-0-0x000000007472E000-0x000000007472F000-memory.dmp

Download

memory/1856-88-0x0000000074720000-0x0000000074ED0000-memory.dmp

Download

memory/1904-118-0x00000000004C0000-0x0000000000518000-memory.dmp

Download

memory/1988-91-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1988-6-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1988-259-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1988-5-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/1988-9-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Download

memory/1988-8-0x0000000000400000-0x0000000000643000-memory.dmp

Download

memory/2032-99-0x00000000728C0000-0x0000000073070000-memory.dmp

Download

memory/2032-87-0x0000000000410000-0x000000000045A000-memory.dmp

Download

memory/2032-89-0x00000000728CE000-0x00000000728CF000-memory.dmp

Download

memory/2032-166-0x00000000728C0000-0x0000000073070000-memory.dmp

Download

memory/5008-241-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/5008-242-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/5008-243-0x0000000022320000-0x000000002257F000-memory.dmp

Download

memory/5008-257-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/5008-258-0x0000000000400000-0x0000000000657000-memory.dmp

Download

memory/5008-231-0x0000000000400000-0x0000000000657000-memory.dmp

Download