Malware Analysis Report

2025-08-11 01:38

Sample ID 230224-wy6t2sac76
Target FCEE4E3E7DDC82570DF89F9CBF013D01.exe
SHA256 81f94cffb6a6c854eca0e0b8d5cf43b43736b549d01f56f946d08760523598c7
Tags
warzonerat infostealer persistence rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

81f94cffb6a6c854eca0e0b8d5cf43b43736b549d01f56f946d08760523598c7

Threat Level: Known bad

The file FCEE4E3E7DDC82570DF89F9CBF013D01.exe was found to be: Known bad.

Malicious Activity Summary

warzonerat infostealer persistence rat

WarzoneRat, AveMaria

Loads dropped DLL

Executes dropped EXE

Checks QEMU agent file

Drops startup file

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Suspicious behavior: MapViewOfSection

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-24 18:20

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-24 18:20

Reported

2023-02-24 18:23

Platform

win7-20230220-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe"

Signatures

WarzoneRat, AveMaria

rat infostealer warzonerat

Checks QEMU agent file

Description Indicator Process Target
File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A
File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\Windows8.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows 8 updated = "C:\\Users\\Admin\\Documents\\Windows8.exe" C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1200 set thread context of 432 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Documents\Documents:ApplicationData C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1200 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe
PID 1200 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe
PID 1200 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe
PID 1200 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe
PID 1200 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe
PID 432 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 432 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 432 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 432 wrote to memory of 296 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 432 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\Documents\Windows8.exe
PID 432 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\Documents\Windows8.exe
PID 432 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\Documents\Windows8.exe
PID 432 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\Documents\Windows8.exe

Processes

C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe

"C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe"

C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe

"C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Add-MpPreference -ExclusionPath C:\

C:\Users\Admin\Documents\Windows8.exe

"C:\Users\Admin\Documents\Windows8.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 drive.google.com udp
NL 142.251.36.46:443 drive.google.com tcp
US 8.8.8.8:53 doc-0c-4o-docs.googleusercontent.com udp
NL 142.251.36.1:443 doc-0c-4o-docs.googleusercontent.com tcp

Files

\Users\Admin\AppData\Local\Temp\nsd84C.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

\Users\Admin\AppData\Local\Temp\nsd84C.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

C:\Users\Admin\AppData\Local\Temp\nsd84C.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

memory/432-67-0x0000000000400000-0x0000000001462000-memory.dmp

memory/432-68-0x0000000000400000-0x0000000001462000-memory.dmp

memory/432-91-0x0000000000400000-0x0000000001462000-memory.dmp

memory/432-94-0x0000000001470000-0x0000000005156000-memory.dmp

memory/432-95-0x0000000000400000-0x0000000001462000-memory.dmp

memory/432-97-0x0000000000400000-0x0000000001462000-memory.dmp

memory/432-105-0x0000000000400000-0x0000000001462000-memory.dmp

memory/296-107-0x0000000002760000-0x00000000027A0000-memory.dmp

memory/296-108-0x0000000002760000-0x00000000027A0000-memory.dmp

\Users\Admin\Documents\Windows8.exe

MD5 fcee4e3e7ddc82570df89f9cbf013d01
SHA1 b5a7d853e8f041876aaa82d4b28664246d28576d
SHA256 81f94cffb6a6c854eca0e0b8d5cf43b43736b549d01f56f946d08760523598c7
SHA512 3cfbbb64cff247ac9930733770f86385d65cb92ac7fe242494c70dbe58b8b461ac9ab98b4f84dd9c49627eff4cdc8c6f5e5403bb470e06dbe2bc69c6f8f4621b

C:\Users\Admin\Documents\Windows8.exe

MD5 fcee4e3e7ddc82570df89f9cbf013d01
SHA1 b5a7d853e8f041876aaa82d4b28664246d28576d
SHA256 81f94cffb6a6c854eca0e0b8d5cf43b43736b549d01f56f946d08760523598c7
SHA512 3cfbbb64cff247ac9930733770f86385d65cb92ac7fe242494c70dbe58b8b461ac9ab98b4f84dd9c49627eff4cdc8c6f5e5403bb470e06dbe2bc69c6f8f4621b

C:\Users\Admin\Documents\Windows8.exe

MD5 fcee4e3e7ddc82570df89f9cbf013d01
SHA1 b5a7d853e8f041876aaa82d4b28664246d28576d
SHA256 81f94cffb6a6c854eca0e0b8d5cf43b43736b549d01f56f946d08760523598c7
SHA512 3cfbbb64cff247ac9930733770f86385d65cb92ac7fe242494c70dbe58b8b461ac9ab98b4f84dd9c49627eff4cdc8c6f5e5403bb470e06dbe2bc69c6f8f4621b

memory/432-116-0x0000000001470000-0x0000000005156000-memory.dmp

memory/432-119-0x0000000000400000-0x0000000001462000-memory.dmp

C:\Users\Admin\AppData\Roaming\Photolabeller\Byzantinize\Vandlbsforureninger\Snares\Afdamp\Tomlende\Anormale.Res

MD5 3fbaf63329b8985adf7122b89ac7c9c6
SHA1 f8f537d5453fedb2e58f15ce352d8c691a67300a
SHA256 4dff4e2620dbc65e53e03623c56d8f29cbf82847363fc098af6a81947ab7770d
SHA512 7108362de34fc8f814ee46f27e3b8ca9d13e5be0c62f6337f3d0385e7883fb2fe673e73856d46e48403e3090bda20e411cd624fed48f164d3745f407b63d56f3

C:\Users\Admin\AppData\Roaming\Photolabeller\Byzantinize\Vandlbsforureninger\Snares\Afdamp\Tomlende\Achras.att

MD5 b1671f380f00d206191060eefd4c7aa9
SHA1 881a18f8dbfe26c3ba4db02e4310aadfcdb83d68
SHA256 425e2c996fd7f3c0c08f1df1a286a20253a667cd31d76447c5a99d9c6af05baf
SHA512 f6ea715a9aa8dbb94dc8379f5185f84935b85c45e30e3efcead01282e91b8d0b2d3600a3bb72b8a45b4bf113ee95ba06369c1d7c490b0899cedb85357230a2f6

\Users\Admin\AppData\Local\Temp\nse46F1.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

\Users\Admin\AppData\Local\Temp\nse46F1.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-24 18:20

Reported

2023-02-24 18:23

Platform

win10v2004-20230220-en

Max time kernel

120s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe"

Signatures

WarzoneRat, AveMaria

rat infostealer warzonerat

Checks QEMU agent file

Description Indicator Process Target
File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A
File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Documents\Windows8.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows 8 updated = "C:\\Users\\Admin\\Documents\\Windows8.exe" C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtCreateThreadExHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4180 set thread context of 1444 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe

Enumerates physical storage devices

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\Documents\Documents:ApplicationData C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4180 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe
PID 4180 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe
PID 4180 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe
PID 4180 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe
PID 1444 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1444 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1444 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1444 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\Documents\Windows8.exe
PID 1444 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\Documents\Windows8.exe
PID 1444 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe C:\Users\Admin\Documents\Windows8.exe

Processes

C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe

"C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe"

C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe

"C:\Users\Admin\AppData\Local\Temp\FCEE4E3E7DDC82570DF89F9CBF013D01.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell Add-MpPreference -ExclusionPath C:\

C:\Users\Admin\Documents\Windows8.exe

"C:\Users\Admin\Documents\Windows8.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 199.176.139.52.in-addr.arpa udp
FR 51.11.192.49:443 tcp
NL 8.238.21.126:80 tcp
US 8.8.8.8:53 73.254.224.20.in-addr.arpa udp
NL 8.238.22.254:80 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 131.253.33.203:80 tcp
US 93.184.220.29:80 tcp
US 8.8.8.8:53 drive.google.com udp
NL 142.251.36.46:443 drive.google.com tcp
US 8.8.8.8:53 46.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 35.36.251.142.in-addr.arpa udp
US 8.8.8.8:53 doc-0c-4o-docs.googleusercontent.com udp
NL 142.251.36.1:443 doc-0c-4o-docs.googleusercontent.com tcp
US 8.8.8.8:53 1.36.251.142.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nsq710F.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

C:\Users\Admin\AppData\Local\Temp\nsq710F.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

C:\Users\Admin\AppData\Local\Temp\nsq710F.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

memory/1444-144-0x0000000000400000-0x0000000001654000-memory.dmp

memory/1444-157-0x0000000000400000-0x0000000001654000-memory.dmp

memory/1444-160-0x0000000001660000-0x0000000005346000-memory.dmp

memory/3788-161-0x0000000002AE0000-0x0000000002B16000-memory.dmp

memory/3788-162-0x0000000005620000-0x0000000005C48000-memory.dmp

memory/3788-163-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

memory/3788-164-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

memory/3788-165-0x0000000005450000-0x0000000005472000-memory.dmp

memory/3788-166-0x0000000005D50000-0x0000000005DB6000-memory.dmp

memory/3788-167-0x0000000005DC0000-0x0000000005E26000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lyun1f2w.tt4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1444-177-0x0000000000400000-0x0000000001654000-memory.dmp

C:\Users\Admin\Documents\Windows8.exe

MD5 fcee4e3e7ddc82570df89f9cbf013d01
SHA1 b5a7d853e8f041876aaa82d4b28664246d28576d
SHA256 81f94cffb6a6c854eca0e0b8d5cf43b43736b549d01f56f946d08760523598c7
SHA512 3cfbbb64cff247ac9930733770f86385d65cb92ac7fe242494c70dbe58b8b461ac9ab98b4f84dd9c49627eff4cdc8c6f5e5403bb470e06dbe2bc69c6f8f4621b

C:\Users\Admin\Documents\Windows8.exe

MD5 fcee4e3e7ddc82570df89f9cbf013d01
SHA1 b5a7d853e8f041876aaa82d4b28664246d28576d
SHA256 81f94cffb6a6c854eca0e0b8d5cf43b43736b549d01f56f946d08760523598c7
SHA512 3cfbbb64cff247ac9930733770f86385d65cb92ac7fe242494c70dbe58b8b461ac9ab98b4f84dd9c49627eff4cdc8c6f5e5403bb470e06dbe2bc69c6f8f4621b

memory/3788-186-0x0000000006410000-0x000000000642E000-memory.dmp

memory/1444-184-0x0000000001660000-0x0000000005346000-memory.dmp

memory/1444-187-0x0000000000400000-0x0000000001654000-memory.dmp

C:\Users\Admin\AppData\Roaming\Photolabeller\Byzantinize\Vandlbsforureninger\Snares\Afdamp\Tomlende\Anormale.Res

MD5 3fbaf63329b8985adf7122b89ac7c9c6
SHA1 f8f537d5453fedb2e58f15ce352d8c691a67300a
SHA256 4dff4e2620dbc65e53e03623c56d8f29cbf82847363fc098af6a81947ab7770d
SHA512 7108362de34fc8f814ee46f27e3b8ca9d13e5be0c62f6337f3d0385e7883fb2fe673e73856d46e48403e3090bda20e411cd624fed48f164d3745f407b63d56f3

C:\Users\Admin\AppData\Roaming\Photolabeller\Byzantinize\Vandlbsforureninger\Snares\Afdamp\Tomlende\Achras.att

MD5 b1671f380f00d206191060eefd4c7aa9
SHA1 881a18f8dbfe26c3ba4db02e4310aadfcdb83d68
SHA256 425e2c996fd7f3c0c08f1df1a286a20253a667cd31d76447c5a99d9c6af05baf
SHA512 f6ea715a9aa8dbb94dc8379f5185f84935b85c45e30e3efcead01282e91b8d0b2d3600a3bb72b8a45b4bf113ee95ba06369c1d7c490b0899cedb85357230a2f6

C:\Users\Admin\AppData\Local\Temp\nsk1EBF.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

C:\Users\Admin\AppData\Local\Temp\nsk1EBF.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

memory/3788-197-0x00000000073D0000-0x0000000007402000-memory.dmp

memory/3788-199-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

memory/3788-198-0x000000006DB50000-0x000000006DB9C000-memory.dmp

memory/3788-209-0x0000000006960000-0x000000000697E000-memory.dmp

memory/3788-210-0x0000000007D60000-0x00000000083DA000-memory.dmp

memory/3788-211-0x0000000007710000-0x000000000772A000-memory.dmp

memory/3788-212-0x0000000007780000-0x000000000778A000-memory.dmp

memory/3788-213-0x0000000007990000-0x0000000007A26000-memory.dmp

memory/3788-214-0x0000000007940000-0x000000000794E000-memory.dmp

memory/3788-215-0x0000000007A50000-0x0000000007A6A000-memory.dmp

memory/3788-216-0x0000000007A30000-0x0000000007A38000-memory.dmp