Malware Analysis Report

2024-09-23 04:57

Sample ID 220717-bxlr9sbdhn
Target 52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc
SHA256 52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc
Tags
qulab discovery evasion ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc

Threat Level: Known bad

The file 52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc was found to be: Known bad.

Malicious Activity Summary

qulab discovery evasion ransomware spyware stealer upx

Qulab Stealer & Clipper

ACProtect 1.3x - 1.4x DLL software

Executes dropped EXE

UPX packed file

Sets file to hidden

Loads dropped DLL

Reads user/profile data of web browsers

Checks installed software on the system

Looks up external IP address via web service

Accesses cryptocurrency files/wallets, possible credential harvesting

AutoIT Executable

Drops file in System32 directory

Enumerates physical storage devices

Views/modifies file attributes

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Suspicious use of WriteProcessMemory

Suspicious behavior: RenamesItself

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2022-07-17 01:31

Signatures

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-17 01:31

Reported

2022-07-17 01:50

Platform

win7-20220715-en

Max time kernel

122s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 852 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 852 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 852 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 852 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 1984 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe
PID 1984 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe
PID 1984 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe
PID 1984 wrote to memory of 1596 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe
PID 1984 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Windows\SysWOW64\attrib.exe
PID 1984 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Windows\SysWOW64\attrib.exe
PID 1984 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Windows\SysWOW64\attrib.exe
PID 1984 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Windows\SysWOW64\attrib.exe
PID 1988 wrote to memory of 1364 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 1988 wrote to memory of 1364 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 1988 wrote to memory of 1364 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 1988 wrote to memory of 1364 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 1988 wrote to memory of 984 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 1988 wrote to memory of 984 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 1988 wrote to memory of 984 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 1988 wrote to memory of 984 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe

"C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\ENU_687FE97579347BEE9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources"

C:\Windows\system32\taskeng.exe

taskeng.exe {CE15D579-8896-4B9E-9C93-96B7F072B42D} S-1-5-21-3440072777-2118400376-1759599358-1000:NKWDSIWE\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ipapi.co udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 104.26.8.44:443 ipapi.co tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
NL 149.154.167.220:443 api.telegram.org tcp
GB 54.36.162.187:3128 tcp
GB 54.36.162.187:3128 tcp

Files

memory/852-54-0x0000000075511000-0x0000000075513000-memory.dmp

memory/1984-55-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/1984-59-0x0000000061E00000-0x0000000061ED2000-memory.dmp

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/1596-62-0x0000000000000000-mapping.dmp

\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\1\Information.txt

MD5 41332c270c4bedd3a2de2d5806cd49c5
SHA1 4d22ee89ff99790e9f427cd8bb2190379e73f054
SHA256 f2b91cee9dddc187c5e47ea4a0bc6d7c6e239db255901ae7e1c4c2f734597161
SHA512 8a10a9fcf5cefd1d6b10bb08629de53b8909b9bf220d0678d7e4a2d354940e1dbcb287048dbb853ba7666f701b7132b2aa38b686e2de1f0b2484b0cb055091a9

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\1\Screen.jpg

MD5 df1a8eaef759a47ac3540b49b7933e84
SHA1 6eb56035a077a4e8d26e69e2f400cf98b6bb17c6
SHA256 be960ff45b50e14dc2301a3a4abb9b10c9119f80bff4d4fa868a793b1d56a94f
SHA512 cb19669ebda8c12f893deb6db58d38fc95db4e6b132b6f2cb939afd0a37d2f5edb9708ec87558c086f7717804357d988357401f00ced641a9e26ec3e2aeba924

memory/1596-66-0x0000000000400000-0x000000000047D000-memory.dmp

memory/1984-67-0x0000000002A30000-0x0000000002AAD000-memory.dmp

memory/1984-68-0x0000000002A30000-0x0000000002AAD000-memory.dmp

memory/2040-69-0x0000000000000000-mapping.dmp

memory/1364-70-0x0000000000000000-mapping.dmp

memory/984-72-0x0000000000000000-mapping.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-17 01:31

Reported

2022-07-17 01:51

Platform

win10v2004-20220715-en

Max time kernel

132s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe"

Signatures

Qulab Stealer & Clipper

stealer qulab

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Checks installed software on the system

discovery

Looks up external IP address via web service

Description Indicator Process Target
N/A ipapi.co N/A N/A
N/A ipapi.co N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe N/A
File opened for modification C:\Windows\SysWOW64\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe N/A

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:\localhost\ C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\winmgmts:\localhost\ C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2420 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 2420 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 2420 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe
PID 3772 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe
PID 3772 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe
PID 3772 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe
PID 3772 wrote to memory of 448 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Windows\SysWOW64\attrib.exe
PID 3772 wrote to memory of 448 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Windows\SysWOW64\attrib.exe
PID 3772 wrote to memory of 448 N/A C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe C:\Windows\SysWOW64\attrib.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe

"C:\Users\Admin\AppData\Local\Temp\52e7e7bf145dd3fa5003e54d28453682164a2a0c020863d206541a53a8de87bc.exe"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe a -y -mx9 -ssw "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\ENU_801FE973DC4F213E9D41.7z" "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\1\*"

C:\Windows\SysWOW64\attrib.exe

attrib +s +h "C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources"

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 ipapi.co udp
US 104.26.9.44:443 ipapi.co tcp
US 93.184.220.29:80 tcp
GB 54.36.162.187:3128 tcp
US 20.42.65.88:443 tcp
US 204.79.197.203:80 tcp

Files

memory/3772-130-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.sqlite3.module.dll

MD5 8c127ce55bfbb55eb9a843c693c9f240
SHA1 75c462c935a7ff2c90030c684440d61d48bb1858
SHA256 4f93f3543139febb91e0c95dc9351008e9147a484732ee5962c7df64f6868028
SHA512 d3578bd7ef01f9e25983c24eb9bb33f25c37d650cc79b823c3ec19f196d4a00deb506c1e1f774f15e5664d5263b02570fec11b322022b90a0ff1b10943188a02

memory/3772-132-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/3772-134-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/3772-135-0x0000000061E00000-0x0000000061ED2000-memory.dmp

memory/3772-136-0x0000000061E00000-0x0000000061ED2000-memory.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

memory/4716-137-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\bcd.module.exe

MD5 946285055913d457fda78a4484266e96
SHA1 668661955bf3c20b9dc8cdaa7ec6e8dbbbd63285
SHA256 23ca34a7d22fdb7d36014928c089c982cdfb903e9143aea60d38f228c9594beb
SHA512 30a490b774d5736215b340d3a192825dc1dfbb7c8d9974c8ab2a09eff2429ed7cf99969ec6d651c8056549798da092ffa600681288dbd7c6f60515acd3630d95

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\1\Information.txt

MD5 069bc76d48e7076733f71fe614b32432
SHA1 9ebb269a10e7f461c1d88880c7a21925c4e91e50
SHA256 b41ada04285a9063b3fae2986e346703631274470226563340f6757b24aeb689
SHA512 c876bcb1cfc23cd54f95cd448f63734d209816aff69cfc0ff434c87f0de71d626b3301ca692bf16a9981b7af9125db67674221a925236c444535fb5e7870e726

C:\Users\Admin\AppData\Roaming\amd64_microsoft-windows-s..iprovider.resources\1\Screen.jpg

MD5 3b27c508e8651501904d72cd6487953b
SHA1 458654496495f3e6817c97a3c7afeef4322d1c4d
SHA256 1414de91f00beec669634e9a62e7a8c8569d4212b2e48bf262dd15767b9c021f
SHA512 eeca226e197ddd8bb2f9c1de160f1eab00c7d71c0b7838c79ab9bbe642bac87764dce754cd6622f47d9d8b03d873c7e32f37a67f7fada5976201c7a8d70bb8e7

memory/4716-142-0x0000000000400000-0x000000000047D000-memory.dmp

memory/448-143-0x0000000000000000-mapping.dmp