Analysis Overview
SHA256
3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971
Threat Level: Known bad
The file 3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971 was found to be: Known bad.
Malicious Activity Summary
MassLogger
MassLogger Main Payload
Deletes itself
Reads user/profile data of web browsers
Drops startup file
Checks computer location settings
Accesses Microsoft Outlook profiles
Looks up external IP address via web service
Suspicious use of SetThreadContext
outlook_win_path
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
outlook_office_path
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-03-27 21:25
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-03-27 21:25
Reported
2022-04-02 07:01
Platform
win7-20220310-en
Max time kernel
4294182s
Max time network
125s
Command Line
Signatures
MassLogger
MassLogger Main Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HHHHHHHHHHH.vbs | C:\Windows\SysWOW64\notepad.exe | N/A |
Reads user/profile data of web browsers
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1388 set thread context of 1940 | N/A | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe
"C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe"
C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe
"C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe'
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 3.232.242.170:80 | api.ipify.org | tcp |
| US | 8.8.8.8:53 | mail.nirongrup.com | udp |
| NL | 212.7.211.17:587 | mail.nirongrup.com | tcp |
Files
memory/1388-55-0x0000000000240000-0x0000000000255000-memory.dmp
memory/1388-56-0x0000000075C41000-0x0000000075C43000-memory.dmp
memory/1164-57-0x0000000000000000-mapping.dmp
memory/1164-58-0x0000000000080000-0x0000000000081000-memory.dmp
memory/1940-61-0x000000000051C9C0-mapping.dmp
memory/1940-63-0x0000000001DE0000-0x0000000001E66000-memory.dmp
memory/1940-62-0x0000000001DE0000-0x0000000001E66000-memory.dmp
memory/1940-67-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-66-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-69-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-68-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-71-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-70-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-72-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-73-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-74-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-75-0x00000000002D2000-0x00000000002D3000-memory.dmp
memory/1940-76-0x0000000004A35000-0x0000000004A46000-memory.dmp
memory/1940-77-0x00000000061A0000-0x00000000061DE000-memory.dmp
memory/1940-78-0x0000000006810000-0x00000000068A0000-memory.dmp
memory/1544-79-0x0000000000000000-mapping.dmp
memory/1544-81-0x0000000074640000-0x0000000074BEB000-memory.dmp
memory/1544-82-0x00000000024B2000-0x00000000024B4000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-03-27 21:25
Reported
2022-04-02 06:42
Platform
win10v2004-20220331-en
Max time kernel
91s
Max time network
96s
Command Line
Signatures
MassLogger
MassLogger Main Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HHHHHHHHHHH.vbs | C:\Windows\SysWOW64\notepad.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 736 set thread context of 1300 | N/A | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe
"C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe"
C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe
"C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\3a3606d38bd55a8a0c627f22f38ed873744e6fe62af75766dbe4707f68fe8971.exe'
Network
| Country | Destination | Domain | Proto |
| IE | 13.69.239.73:443 | tcp | |
| FI | 62.115.252.81:80 | tcp | |
| FI | 62.115.252.81:80 | tcp | |
| FI | 62.115.252.81:80 | tcp | |
| US | 93.184.220.29:80 | tcp |
Files
memory/736-125-0x0000000000640000-0x0000000000655000-memory.dmp
memory/1132-126-0x0000000000000000-mapping.dmp
memory/1300-127-0x0000000000000000-mapping.dmp
memory/1300-129-0x0000000000B90000-0x0000000000C16000-memory.dmp
memory/1300-128-0x0000000000B90000-0x0000000000C16000-memory.dmp
memory/1300-131-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-130-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-133-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-132-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-134-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-136-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-135-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-137-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-138-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-139-0x0000000000AC2000-0x0000000000AC3000-memory.dmp
memory/1300-140-0x0000000004D00000-0x0000000004D92000-memory.dmp
memory/1300-141-0x0000000004E50000-0x00000000053F4000-memory.dmp
memory/1300-142-0x0000000005450000-0x00000000054B6000-memory.dmp
memory/904-143-0x0000000000000000-mapping.dmp
memory/904-144-0x0000000002760000-0x0000000002796000-memory.dmp
memory/904-145-0x0000000005370000-0x0000000005998000-memory.dmp
memory/904-146-0x00000000051E0000-0x0000000005202000-memory.dmp
memory/904-147-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/904-148-0x0000000006010000-0x000000000602E000-memory.dmp
memory/904-149-0x0000000004D35000-0x0000000004D37000-memory.dmp
memory/904-150-0x0000000007900000-0x0000000007F7A000-memory.dmp
memory/904-151-0x0000000006590000-0x00000000065AA000-memory.dmp
memory/904-153-0x0000000006660000-0x0000000006682000-memory.dmp
memory/904-152-0x0000000007320000-0x00000000073B6000-memory.dmp