Malware Analysis Report

2024-09-23 04:57

Sample ID 220701-gqapbaeher
Target ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b
SHA256 ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b
Tags
qulab discovery evasion ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b

Threat Level: Known bad

The file ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b was found to be: Known bad.

Malicious Activity Summary

qulab discovery evasion ransomware spyware stealer upx

Qulab Stealer & Clipper

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

Sets file to hidden

UPX packed file

Reads user/profile data of web browsers

Loads dropped DLL

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Drops file in System32 directory

AutoIT Executable

Enumerates physical storage devices

Suspicious behavior: RenamesItself

Views/modifies file attributes

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-07-01 06:00

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-01 06:00

Reported

2022-07-01 07:09

Platform

win7-20220414-en

Max time kernel

123s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 2016 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 2016 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 2016 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 1436 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
PID 1436 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
PID 1436 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
PID 1436 wrote to memory of 764 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
PID 1436 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Windows\SysWOW64\attrib.exe
PID 1436 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Windows\SysWOW64\attrib.exe
PID 1436 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Windows\SysWOW64\attrib.exe
PID 1436 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Windows\SysWOW64\attrib.exe
PID 1480 wrote to memory of 924 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 1480 wrote to memory of 924 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 1480 wrote to memory of 924 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 1480 wrote to memory of 924 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 1480 wrote to memory of 1976 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 1480 wrote to memory of 1976 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 1480 wrote to memory of 1976 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 1480 wrote to memory of 1976 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe

"C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe"

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\ENU_687FE978D73A864E9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources"

C:\Windows\system32\taskeng.exe

taskeng.exe {308DFB93-041A-4C8A-8533-3782E6B0218E} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
US 8.8.8.8:53 ipapi.co udp
NL 149.154.167.220:443 api.telegram.org tcp
US 172.67.69.226:443 ipapi.co tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
RU 83.217.9.155:65234 tcp
RU 83.217.9.155:65234 tcp

Files

memory/2016-54-0x0000000075191000-0x0000000075193000-memory.dmp

memory/1436-55-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/1436-59-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1436-60-0x0000000061E00000-0x0000000061ED2000-memory.dmp

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/764-63-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\Information.txt

MD5 12e2a0d9873ed54be3a5480c5166fad6
SHA1 6a4350a4d33a840c3ff327c3f41278641ea13587
SHA256 9d70485e5364451ec1e2ce552c0ee1c82d97b9c044363095b59cb9a8ef7f33ac
SHA512 0e13222d5b304f06005302d6d1fbf1e20084bae0cb6531148fd7305558f7e4ab68169157670eb4cb40bb824ee3fd7321cfca25342124b19a0336f4c742e2ddf3

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\Screen.jpg

MD5 521b2a2a524f12589f81158e124792b5
SHA1 fccf445738b448bc66d2d466d29f4d5d4de46102
SHA256 29653e24c169beb3c6979b93d3e52b9f9c2f7c18906f710dba1b7b7bd52e7b64
SHA512 2be19e4979114a679999dfe86139c4eddb4e54bb3533e251fb35b50f5671f255727efcfce00132c9632e494f87d234f4d1ec78d7b8e2d8395e9deaeba25ed7c1

memory/764-67-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1436-68-0x0000000003BB0000-0x0000000003C2D000-memory.dmp

memory/1436-69-0x0000000003BB0000-0x0000000003C2D000-memory.dmp

memory/1600-70-0x0000000000000000-mapping.dmp

memory/924-71-0x0000000000000000-mapping.dmp

memory/1976-73-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-01 06:00

Reported

2022-07-01 07:11

Platform

win10v2004-20220414-en

Max time kernel

143s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4272 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 4272 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 4272 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe
PID 4200 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
PID 4200 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
PID 4200 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe
PID 4200 wrote to memory of 228 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Windows\SysWOW64\attrib.exe
PID 4200 wrote to memory of 228 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Windows\SysWOW64\attrib.exe
PID 4200 wrote to memory of 228 N/A C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe C:\Windows\SysWOW64\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe

"C:\Users\Admin\AppData\Local\Temp\ad6424fee90ec1b16258ed0118825fceb07d36c6287202f99a8703280e269a4b.exe"

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\ENU_801FE97294A87C4E9D41.7z" "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources"

Network

Country Destination Domain Proto
US 93.184.221.240:80 tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
IE 20.50.80.210:443 tcp
US 8.8.8.8:53 ipapi.co udp
US 104.26.9.44:443 ipapi.co tcp
NL 20.190.160.132:443 tcp
US 172.67.69.226:443 ipapi.co tcp
NL 20.190.160.4:443 tcp
US 93.184.220.29:80 tcp
US 204.79.197.203:80 tcp
US 104.26.8.44:443 ipapi.co tcp
US 93.184.220.29:80 tcp
NL 20.190.160.8:443 tcp
US 104.26.8.44:443 ipapi.co tcp
US 52.152.108.96:443 tcp
NL 20.190.160.134:443 tcp
US 104.26.9.44:443 ipapi.co tcp
US 8.8.8.8:53 15.89.54.20.in-addr.arpa udp
NL 20.190.160.2:443 tcp
US 172.67.69.226:443 ipapi.co tcp
RU 83.217.9.155:65234 tcp
NL 20.190.160.6:443 tcp

Files

memory/4200-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/4200-133-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/4200-134-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/4200-135-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/1272-136-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/1272-138-0x0000000000400000-0x000000000047D000-memory.dmp

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\wscisvif.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\Information.txt

MD5 0972df748fc710c8963de481fbb5e3dc
SHA1 f152ba8a7fdaa0d7f484b20fc853efdda76df784
SHA256 5eb9c7b29e31dfefa908c61497cd8cc3627c8db5f5e2f9f4dd537bee0f8c0792
SHA512 017c9dd3c53dba9ddd7f46f31f9c1d98aac76752dabf6dee95e971ed2cde189fac7c1225b67c1947030e6699d4edc060101956d91830a24c02fab967ff961d22

C:\Users\Admin\AppData\Roaming\wow64_microsoft-windows-n..plication.resources\1\Screen.jpg

MD5 df08309c42feefb8197c31040b98e78e
SHA1 77cddfe3c04ecc7edc8b40689d4f622d78cfdf5e
SHA256 61b6cd9d7a9b902aa4ee439e720190f18bb518891d847072e7f3fad6904a9384
SHA512 7d25856117b3fade20aa339a8c5eabfce77441d6f9076b98f7be2ac20211592deab9e87d6b99b4a28fd236672f0820d938a0f4fd6acaca9d18015e7a1f9dc7b6

memory/1272-142-0x0000000000400000-0x000000000047D000-memory.dmp

memory/228-143-0x0000000000000000-mapping.dmp